m䆇)[�����=��^>�d3Pz�&n9�ve�a-]��C�/Bm`�;0<�U�R#�ҕA�F���>��%�T[^�*B I��",S��G�*1_=�;k�o ,�9\;j��^o��Q�,�i�j�?��������50��6GJ�$�ՀeFm>�t�'��Č/#��9"ă8=R}8_�9>��ۏI�h�x~m� w�p�t[;pL��z98 @8#ǩ���CF^�x�֣b�ǹ1|�`i���g�ly��3���D�ɨgI���&Ȗ磦�@�������i�`�LV� �7��XJ� 埸o�X\��+`�U��yXU�n_���m�\f�p/q�ޏ�.��^Z�7���B�(Z��2����Z���X��vػ�������!gfN����CM�����cڥX�v��V�(��zEQV��� �q"^!�'�k���Ym�ٿ�+LM�4���V�N���/∕c*j�ϼߐ�s��i�M� He"���=����i�Jo�Z�F@u�n*[s�>QӴ��g8���r&� �p�ڼ�D�-�#���P%剤�*O�C�^^�7�b���K�;t����;Y�S�C���ћ��tC`�.sv����e�ĩ3L��+���� �* �_������u��:����4�X=S��&;�s��WA��f��7����p��F*����q���7h�� X�Ė@�7K`E}� ta�K.G�xQw�D'kB4��9�9��]�*�kq)�Q���Ν�������ucv��=X9ÆA��q��o�ؠ��A�T-Ↄ��~n�P�.��'2��sCSk?W�/�*�G������Ѡ!�"�r�����7����K� & $�H`���ЕA�!"T����i���?���M�� K��8�9�g�e�*�b�[��6h� Btm�|L���J�Í�ൔ��m9���XTL�a�#ym��|�������7ɕ�T��w�#����:��}2g�b��Õ�9D`Fz�3���m��hK�BGa�?o�_?���=����]*7�h�@�� 4����GN<pU %�rV�A����Ŕ�c�_�_$��3���B�����Ur �FH��9��${T8(��U�F�@Q�r�w�n�_��/���b.Ci�K�>�O-��p΅Ox����ޏcڭc���P��I�X��.7����|u�E��=M@X���+��JC�_ω߿%>^���!����=�N��im)m�����b�7���j���� ���2�W%m��i Zo�J���Z�^����3O�<�:3(ב����k�6Ƽnz�����1��J����fM�3�m���z˴�\&�Gl��%^2�IBG)����Z� ���3��5O���g\��>˨-���*9 !���S?��Y8��!;e� }����� y��I��\;�/"[�v�x[���b�㡄�f'��"�����v���Ω�؞̖�qh'�1u)� C��Rys)Z!;�>���ht�3F�;�oe_E\��IV%- ����f�f�!j#8+��A=f�w�0�˘D oe�D�A�i�H��</�t�������\��֗��몈E�>�bt� �����JhT�3Ӟ���~��ku�ʦ!�)v�\w��P% J�*͈��s�xH��8o>�)�=���g�Ҹ��{�E�uOv;z၇�@2�t��OJ����y��}?�Ϊ�+Dp�p��H�#��l~Ѭ��kl���>�{�����;�F�/X��t1x�ip�uY��j��`D-�Y?�������'�wM�1[�;s.>n9��E�w��P%T9�Oal�R�%}�v;�pt��:fr��{'�����"�� :�+�Ȟ�������k"F��9����zO��G�������\�|��~u�s�EKw��(p��&�K���F����!T�l��� L.W� ž��8�{�/���lW���M �����3'��`�Eug�g�������N/������g�J��r�EE���f�6���%쭚��v��4��(j�5�s���z�\#xˢosɻ��J�ɸ��$�f^�4�� D��i��n �����ݚv��I� �Y�q�h*���������8�l9{��@m����K�Հ��,��v��0�o2 �:�f��2(���&Vi��������d�n�<�O6S���� o,�1z�W���Ћ����n0vx���7e�`�U����/�_ux]g���D"��2�ۻ�n�I�B���K����������ەY<����Ql;��� ��s�݁Hu;��{�6? M�b�\�M��c;n�t��"��k�L7��4��)�`)?���i��6�R�>ͳi���H��e��,-!+8L���\8e1��%�k�_����S�0������Y!��������m*��!H��@��pG<�>��><w�R�Fr��X�d!f\4��#��<�ԉ�����N�T���?M��,���Q��_�Te���ի��ɚ�|�D����gA<� `WT��|�S�%R��3������E?ÅlK7N����)0��oOilp���>,����5箺6��ѥ�p�qau\� �K���-cU��.�^�Jo�k�*Y.�"(���vg�%��+p��?QɇN�\���M��M�)$6�~e皔Lx��s1�*:�Vp+�yT坛��n��\R����xK> ���>bl��G�.Xf}n��0���9�1�\Dp�N ����)�5�ĕwcV�ioτ6��i�ʔV)�����j�Z��#�Z���i"5α��k�-i����k�p�EXȕa��ð5���}�օ.�.�m��3�eb1��,��4ּ��+�A8SQQS��ς�-!���ai�g�L[vߩ",Ѡ]����z����9����S���0ЏH��4�>����/������{&�}6�,|��`.F�$/�"��!��'O��/XQd�*������#�+��)�(����;-xs�'<�Y�,B�����]�T{����E<�Ny��I��1�*�G +��{����3r� o�B�Pl[�L��;�eb#�x��^z;QO���PD�MQ!\
Static task
static1
Behavioral task
behavioral1
Sample
bc8b548ec38ce04e2c79ffdc59e974a1d8a09946c2bae9bb994db75c7f185bc3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
bc8b548ec38ce04e2c79ffdc59e974a1d8a09946c2bae9bb994db75c7f185bc3.exe
Resource
win10v2004-20231222-en
General
-
Target
bc8b548ec38ce04e2c79ffdc59e974a1d8a09946c2bae9bb994db75c7f185bc3.exe.zip
-
Size
82.6MB
-
MD5
e63142b13d2cfaf46adb5ff090d9de3e
-
SHA1
54f3dd3059d4182ed3e8db73976d39816c9d7a40
-
SHA256
02ca640fea6ab020bc886f05a66176f92bfd17a7909bcde9b8cf5eb0d854e1e2
-
SHA512
87f8f578375ff70e7d3dd22633577ee7b64fb85fdefd7e210fc04d0ce060dc52ae25ce69bb2ea03f57545cef7644c32589fa9031ba53656dee4088d44dfe33ae
-
SSDEEP
1572864:jMwbcfIbFQvmfu0E0D5bxbM7lqw8wvtFWJXyByeM8/gczU6dAWWy:jMwbcmQvmfu0EAZxbC8wVFoGyeM8/gc5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/bc8b548ec38ce04e2c79ffdc59e974a1d8a09946c2bae9bb994db75c7f185bc3.exe
Files
-
bc8b548ec38ce04e2c79ffdc59e974a1d8a09946c2bae9bb994db75c7f185bc3.exe.zip.zip
Password: infected
-
bc8b548ec38ce04e2c79ffdc59e974a1d8a09946c2bae9bb994db75c7f185bc3.exe.exe windows:5 windows x86 arch:x86
50135f6f115c5bea832c523a5436e347
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExW
DeleteCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ShowWindow
gdi32
GetDeviceCaps
wininet
InternetAttemptConnect
shell32
ord190
shlwapi
PathAppendW
ole32
CoCreateInstance
wsock32
gethostbyaddr
comctl32
InitCommonControlsEx
advapi32
RegQueryValueExW
mpr
WNetGetUniversalNameW
urlmon
URLDownloadToFileW
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 326KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 75.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 84.3MB - Virtual size: 84.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ