�b����i������ !6H�"K99��0�P���L�](�4%��*S#G��(���φ@E��Y-�����.�$c,�r �D+)j�?�-�6^�I�����y��VVk5��vX�=4O��@��vV��J���I�6��CQ �z�{Z���*!����hyp�9��1g[V�*����zp���"�%�������o.8��$�3��Ѷf��'�?<�d�?}!�9�#��x뙱6����CwQp�+)�<����y�=�T��o�ZUn��:��˾;�vU{������z�#���x�X���a�\�w�'= �#<�W���e|iR��J�*߶�WT"*���1CN������%�3F�k����y����L"�9�q�G-IM�����7��h���'&���c�/��e�����c~X��9�U�!�4. !(�|; ��ٔ)i5û�ƦrL�I�K��co�� ��7����&�����7hwH���f�B�a���XT����a@B�LuzF7�\��h�����W�G���߱*�>xIa.�8���=l���i7ނ��p�o���n}ry>����g4�|��K�T5?à���[\x��Xi˳���b���6 �>zcQ�wOߞ�~������:�#ߛM5K!u)?���);���!�$�J�6�4p@�S���u�pm�'&X]�[���D���-e�eӰ��i������XK��:���<gW��얬c�۞�ue��0�i 5ɡH�E�<=s�v���R����'�[l̫f#ZH�&�P��7nL�,�U�+8z�������Χ��Q����-�r���ˍ!�p"u��4l��R���c�0uw{��E�6"�9;)VQ���V������J������G����m����Iχ�G}��䊽O���mv�7��f�&Z>^)̟���v��ߒ�5 ��a�T���po/�uN^���IZ�"�;������)�x���D��"�C��5^Y�$8G�B���� V�?���X��Ɗb�f0�{���;����z���?�yP�?����cC{��X�ZB���n���|�}� ��[������/g��Vp��X�jgS����o�:ؑ+E�Ksڡ&i����i��XҢ&���מAh���aJ���'��3��Z�Ĺ�®l�EOm��QS�.�dشm����-��ȉ1��xǼ��_VּN՜�Oi±Qov8Z�Fy����H��/Ϣ%]�ч��}���4��@-�e��}&��I5j�����xm�+%iWP�p^���>/�j��埠j���b��D;^~}y�E�]C݀�@m��奪�7m�o�]rX�WK)PQd9nvsZ���t-s��W���m���iXh����h9�}2�r�37ڏa�1;��[(3��Ia�����ʐ�\�u6�_�l���h�u��+���J=��_ B������I�����5'�L���=�����L�)��_��I~�y8ki�n@�(��G1��S�A��A� s�ŏ����D1��%��)�}�K$�ay:��4 �������7�;��ܑ_�-;b�b���寋�-�v6���1�����mS���}�4�� aE�&��ߴEZZ������Wȼ,�c��g�� W��,�}��\���F�����\���Q���!���j!�9�K%������}��� 5fX�iҼZi^�[�b�Ш���$j�#�GS�c�g@���d��,i�D�vVBk��ЂM!�`v�������:Y��I:�~??R�mq�i�2Z-���@�'�br!G��w{�BnkN\0��pV��G��\w�Õnx�Y-̉J��O�ڃ��4��\�oy���i��0�"�� E��E�q�ҟylR쀾�?�Л0zhq ��J��B�Y��݁���ǖ�I�F�NB��Z=�"0���+��'� W�l��^H@�qnz��U�G��o�.^���C���[͘�Q���X��+l\�����G��uQ �p_���w�lI�!��hd���w��I���%�A�~�9S��~����4�m���ӗ��:1}�,�`aZfq��m�;��o��x�W�:���C��t�!�(���ZB �yFyo,+:���� w����>�$���&Wl2�w1�>�3�� �J�I*4Su�Y �K���/��0�z��F���ugj�:���]$���v%��W��$|�#��ߋns=�!�E�jN1猳���J_e���C���p�����tNy������뼛�#�o!�W !cѓ��첪]fwz�1�rh��W��a � [����Ճ6�^��?�X����i`(F�B[�,��E3�,F�0�/J��a<� o��i> ��Q2&G��ۛ�T�0A?�{{�P/&�E��J[kr�����7=h��`3��"+0:�{{�ɘR��h�D�i�V�۞.��n���m^�膿��g��r�6i��j��觧������\�>��5 ���f6t��D�r�!��� �P t̝V���;:Q������g������+�O�@T��ܸ_���]��Rݝ�l`g�ۃ�����L�߂�aE651�a�0y-/�8��s= b���NF4"wBđ�&KI��$w���@`ru;ԛD�D�C���B�>m֕'ȥ��� ���n1%� s�Fx���m�ĩ Z)���8BA;@��Q���Hs�u�i��rv��8 G��)�?+E�q�b� � !�(1�^[ϲy�Ҥw�5*�Cv.�c�E��p����ϼY͡�H�d����y�;wp<井c��w�CU�[uѩ�@��Y�+"����g������yE�{���oߎ�I�� _,���.e��~rF����phHUR��DG��-�T�)�w��nd�T��n�� ��+��b�I�9���S��jB|;����5�.����#�;�uz,�0�N�����}��_��72D_�K�emxQ$�;�� �����>�ǹk��s�Op3�{��H=�\�=���A�u��z�.&}m`M�%����zN@i~FH�.���S*���Wp� ���'����$Cp;n
Static task
static1
Behavioral task
behavioral1
Sample
11ccfbda3ce162e82a6b2c82b478256d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
11ccfbda3ce162e82a6b2c82b478256d.exe
Resource
win10v2004-20231215-en
General
-
Target
11ccfbda3ce162e82a6b2c82b478256d
-
Size
1.2MB
-
MD5
11ccfbda3ce162e82a6b2c82b478256d
-
SHA1
735aca16748678e87fa17b57c53bac3983642c62
-
SHA256
cfb5fc06ae3bb2f0e306f249d5227f7e5363c1feab97b9645f748435b7872570
-
SHA512
b747b4e01dafd5a4852b67bcccb9889bb23d04fedf974aa83303a07775d7aa82d311fd7a2188b21cf653dffdab9397db641f453c3abe197273450231c835ae47
-
SSDEEP
24576:GKFmt+ECcR3DtfWAAK7sLMrXirq/CgR/LCq8i2iqinOZs2Nkq46zgXd:GH7CcRRf4CXQvMn82DgDe6zgX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 11ccfbda3ce162e82a6b2c82b478256d
Files
-
11ccfbda3ce162e82a6b2c82b478256d.exe windows:5 windows x86 arch:x86
3dc02d68ab75f0a7ed2484a6dde78086
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualProtect
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDlgCtrlID
gdi32
GetTextExtentPoint32A
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
advapi32
RegDeleteKeyA
shell32
ShellExecuteA
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameA
oledlg
ord8
ole32
CLSIDFromProgID
oleaut32
SysAllocStringLen
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 226KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 560KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.upx0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.upx1 Size: - Virtual size: 584KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ