H_�}:N�{M���x�I?NX^,w�~�����*��͉�θ��j��$2,eQ*t����d�Y���Db˪�1��r��mϞǑc Ok?Gc���ŀV��>��eQ�� ���5S����]O�Lz-n�� ߒ9��l�SV��>I����[��v]�&���%���N�d���W�Ph��~��8?�W�wJt�0������w1���o��ov^�QJC<���TrO�t��5�/�1���ܛN]GV�^,���{�QޜNMs��c� FaR&�]�M$e�❢��t����&�W��/��z/&%:�/�r%�ʪ'(��46�X�K�Z�SO������<8���mc)�*��-P#`a�8\ST5�"��*�<��n�C����SO'L�hbؚ��Y�k;�:��*GG����'��mx L��2]p�˰n���qxυ����������3��=�����-ӂ��89ci`�{u�{G>j_��5�C� E4����C_ �Ʒ��s�j�@СΩ� �.��A���u���ET����!b�&� Z`[��e��:1�μ�hy�H�4���y4���f�j��v�������h���?>?�ae����r�������;��K?>���2���&m��/U|��}��'6/���w��8T�1$=H�g���h���5�J5��hT*; ���Fr�F���4t��mL�N�����W&�KF³m���I�!)1�d�� �=*c;O M�� ����]���SrE�u{��PJ�cw�| !y�*��WYfy�&����)48�һ�n�����h~ش��@�"��7�m �d��,� 4І�A��ȡ�E��b�(M�F{hl��9l��\�(�{���S�E@9���@�)��ༀ��A9� H58ː'�ByVs�[��/'\�:Z�қ��$��Wp���?$���2�NN�iv�7�^zCA<�1["��5"c�U,�s�ht��r���9�4 ����P�ܙS�$5Q��n���m�qW��A\�sy�f��l�(%��+�� U�=�l��:� s5�ȅo�+����\杻�'V���/\���7 f,�u�L�=��������I#7�i�c�\�������g�ɶ���B���@L���熌�7��J�~Q�J�fg��L>Y�Y�>���& 6i�����M9�6~����uo����Um�@ A�,�R��l��n�nO$hiYF�qV�)7a���D=a�<������<�����ܹ��{�7�b��"�P:��g�&�Vߺ�T�p>�����ʹ���uC��q#`��~�h�@5�H��7��#��m�jV�pQ�bl��FW���/� ������%��,O�C��=�ހ��C֧b Z��)p��������W���JRJз��������ѵ`��\h����A�'��B}Rw�t�����>#��������YY����۽?�P���z�Eh˹1���Q�M&p��/�`���7S��u�dBr��Xـ�l{s�Y�{��q�h�"�������<C��N���E�l���@uOsQ�����pS�!�d�8�ft!��ڎ�d08%W�[.b��}���l����͗V��}+��L],c����7�G^���{*��(L�z�bi���zb�2�Cc-�����JyF� ��՚%��g#����� $���[����@�G�(�eI�˕~��xX}���P�~�� m�aI��|���9%����;�ti�CX�����)��z)�`p��c�g���N�C��ٞ�թ���}���������h0��G_B����NS��L@�5���\@nh�ssV�.�I���U]FG�yh�N;����L� ^o��&u#bI�x����0�SQ&�J���!`qRL�L�Ҁ��(>����Y[�� ��ˠ�$���z��(&wu�� t{Q�"+�`D�֭"�B!t�p�Z��吝�D��h�*s�P�͍ssO=5�zn�ix�熽[�x?Q��o��誃ֳ &ۉe����:���K��U���( �b�?��ߚ���A�)�z������<��F&���n�����<�� ��������vT����,w�nDzƇ�8L�7:�+��x� {�?/���k�hj~�vQMg�ɐJt�Pɂx�7�AT�Ss���3=\QRa�}�0��aa9��yP�OE9+{�z�=G�s�����<�J��;�T9�Ң�Yh��F����@�ig���]� �,t��N;��<�2��\M-�<�`���'di��l��^��o�]���5�s��ruqx�%.R&h���V� 5���^:��f��a�]B&���yo~O�� [/2��#��{�������ۿ��;vt������:Y*���OSŞY�@&��g�6��p�:�eLL���h%���:��ʶ���̈́��Ò���8A��;� o��b��%�ߜ��4g����m(/�/ʹv�]s�q��2����WH����}.��<�0h���Z�X�W�bOY��E�Ē]c���C3������9��L4E��4�ω:�ي|C}�uF��/?A���P�/{Ff�,���C`� y�����U�*��:��Dy<VlO qE���('oc��4<x3O�k��v�_G8N�D��Ϧ���ן��Ad^&CQ����Z�K��[�t�z����O&I@���=�/1���%����f�8@��F÷۞@A��D��REְ����M��C2�+����էX(�����82�bA`�_�7M����6�k`{�hQ�HC/h�3�@����}��#H�$z��am#�},�����]���(�[�$E�]䗀)F���$���c������Ed�|��� ���:��E����y��f�x�ıO��z&G���3�KSȖ ��1�ͳ$��F��F��M�IH5�Q�.@�Ƿ�]�<�錗���Ӵ��`T�����w7�)��6��*J�`Oh?£�|ѐ'r�p��F��uM�����r�sr�܊ @�6�_j��twMPGF�a'��|w�1���9e�wO#o!�N��<��m��#��8V�ѓ��[�wi4%!d��܍�'||YM&�y)dE��(4��?(��:z�Az����
Static task
static1
Behavioral task
behavioral1
Sample
325cfaf6a3942af25d654ca13cc9f795.exe
Resource
win7-20231215-en
General
-
Target
325cfaf6a3942af25d654ca13cc9f795
-
Size
20.9MB
-
MD5
325cfaf6a3942af25d654ca13cc9f795
-
SHA1
22e35e72c0e4d671f0a08ca8ed81bed6f45e645f
-
SHA256
cc145daee28e88dfb6b51e77a5d9f29152d4da1f5789b2b3a4d8fcb736543e3b
-
SHA512
9ad4cfd83818d679dffa4deca0c7b4600330aad6173e60e3d92643763331bcf4602924b8690769c5a078803e9d5e01c9f89b926e43f31497749482f3e7292ccb
-
SSDEEP
393216:VDWY3GXUqmXRacn2zs/1o2I4/Y0ZZ5cBnK5BPg6azZrPa6bIxPa9XvO:VDWaGXEXRacn2k1oetrco5BPg6azZm6H
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 325cfaf6a3942af25d654ca13cc9f795
Files
-
325cfaf6a3942af25d654ca13cc9f795.exe windows:5 windows x64 arch:x64
8587364d89ddb49a7f74015130d9f84d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wsock32
gethostname
version
VerQueryValueW
winmm
mciSendStringW
comctl32
ImageList_EndDrag
mpr
WNetUseConnectionW
wininet
InternetOpenUrlW
psapi
GetProcessMemoryInfo
iphlpapi
IcmpCreateFile
userenv
LoadUserProfileW
uxtheme
IsThemeActive
kernel32
GetVersionExW
GetFileSize
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetClipboardData
gdi32
CreateSolidBrush
comdlg32
GetOpenFileNameW
advapi32
CheckTokenMembership
shell32
ExtractIconExW
ole32
CoInitialize
oleaut32
VariantClear
Exports
Exports
Sections
.text Size: - Virtual size: 672KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 198KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Tmp0 Size: - Virtual size: 20.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Tmp1 Size: 20.9MB - Virtual size: 20.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ