�=�#���y���W�����Ȃ�ffP=c����5/d��C��5B(�@�f�i|౨`8���0lY�����"H��9��cg���C�ji/Y�L�5)Z��ɧ�̦vv:o)�_�ʒ�~�3B��m�%��c��A<)��,M�Υ�:���r[�dn3���p���==���h���4'3J�GoA�1��s��G�[E�f����9�xRR���@�ڑ�s�Q]��\�C����r������;�������������� 3�4^��[Ա&�%�꽼��Y��,T�|)�G6�| �P���-�&t�#E(W��%��"��X�,UP��KeMA\c���K���0�ISu4��37U��i��f����Y���Z���b<����Z���������J����]a+���LJ�@y��x�@ �`.&�% ��%J�Ը*%�?�A��+ӭ��Y��W�� L���h�?�fz������V<�비]턭d���")��/r�t��Ⴀ�@�M��X�Kp'\����������CFq�~����$�����q�ej�;�hsO��'��_` �-�@��(�6�7�����������P��r�Do��o����#4&zY&�V�}7�{=q�vįI�!*���i�@��@E��Ȭ٦�;:�| �9��4W��~���(���L�GZn��YQCJ��S !�]�S�P�,O]0�i��C��Zv�B>q�F���X�����Q�+S���+�CPS�Ք=�۳�D��� N��/��k�i!tv K??��b)�z����^��}s��^� 4�� �^�\e�M�d ���\|���LaQ_�crTD��5��.�����0J�R.���SݽF ��%��[��!�#@nᚎT�X�V֍PJ+�?R����Z��ҐmƂ�;�0ar� 0B�\q.ٮ�*�!�&���?�|4��̶���t��9#��J��Bk$�k��&��`�"Y�h�7(�<��OF�^nmQ��5��B�z�}� ��+[ Eh�_V�X�Y�Íͪo[O�N)7%s5?l<-�qW����&h�%�2��^�&���wj1�q����|rhm�-��aC�̍ãb�E2�� ����.�� ��",�Rl��ˋ��< >@�'��Nʂ�!Z��M��R���j������'�����<vT�i���yx8�T���)��]O'S��Z����5$C÷��Ŧ���Y,l� +�����X�!� �tR�!i�]��7�d����Fd}�/G�xq��J���<�N�-�'M�]���Q�h���ú�=�6�ꝸݶ����Jh��W�?���7ڧ��0��[_:��{9yJ[�q�ǥ�S"( ���0}�ڋ�#�á��M�J�E��4��E�^%��y����M��k`���.뱁� �^'���S��#�JJ����+�w�L���;ˇ�o�!��qZ�)��� }.�� �Ow��:Q�o��� z��� *oB)s��~���ѧ�7�3aU����������&P�� �D�C?DI��c8�M0eS>�/)}�]������3ϗ 6*9�/M�e�����*dq����]Z��>����h{�KR���n�Ui����,����) �A�bf��q���n� ��/ҹHJ#��0��\ѝp��q����@TPnC� �r���ڳ�1nֈ 66����Je�Ϧ.U�sT#�#4N]7���&H�C�cSఙ��H(@kO�r��J�J��ewF��� ��wٛ^�����A�$����V����g���"K�⫢��V�i�d���i�\�d�I0��/�}�ܢ%��g��5L�"T�Q�t_\l��_q���������F3|���h�^DR�lrw8t4��{!=n;��Hص}юa�z�|��Y���.�")2�2�H��(@���#-�GH��2�>s���� 7�7I�һMŞ�����%��U��P}�%m�ޫE�G�i�U�����g�r�"v�+D�,��'c^�2�v5і���eB�D����X��Wm���rV���遶NO�r�� �/��P;Ȃ:HC���i,�����L��@�z���=L3],P��Q��`�U������. !����ck]���HLJ(��Y�����[���|��5��'���3�K�h"�n����PQa��YU���C�wK�!Kѓ`����Z���Ul�}G���5RFPF�Bx��^(▒G���������z��%�>�= 6��O>ҋ���l���E"��]t��:i�]T*]��;�Y2C�B�H��5l��R����ڨ�wg����w�.V���2�H�7ڗ{`��{<�5P$�� ���{���%���*�cCɁ�=J�:U`�B)ՕŐF5y��6؎N��Ch�K@�s$f��WtpSX��}Y�x�X�JN�A���g�dc9�O�.�<f�<���$(��kV�$?�:�sVT�}&��D��-MZ[k̽��~uY���ߛe���4Qd���qСZ��k���Kl�3`����%��hpP�����6W ���<Mz���BB�T�ΐ�_G�Ɵc�<]?��c?�T�#A�;Y�LWTy���I!"+*��!��!�+��⊔�-A>R���#���w?e�3��:� ��V��=��~�(��f�"����T��$����E!0���o��.���"�G�+?�O��l�c_�⓿��5{X&Y�4Y�n��EfK�&��r��/o�V��l�Pց«��ϗ���-g���B>��WU˳��B���I�ég&Q�x�q��C�8]���n�2YvX��(�����߅W�)�~:aX�#��s���I��|I*/�q8>������5���1�1$�/Q�_�'�{�2�[���`VOƞck:O�+ W�Hx�G�yc�JD�Ti�(�Ԃ��vx0 �Nu�?�.������Ð+��(�Fi[�RJ�^r,QA�<�M��Z��� ����b���7��@�6D�����C� �ܓ�N¯?�cת�h}���qk��x0w�r2_�5��^��,�%o %aRz�A��G Eˁ��Gu� ��l�]�?ۻd~����\mh��Ҝ�1���E�c�/
Static task
static1
Behavioral task
behavioral1
Sample
36dc5d703aa8c14058f96671fa749d18.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
36dc5d703aa8c14058f96671fa749d18.exe
Resource
win10v2004-20231222-en
General
-
Target
36dc5d703aa8c14058f96671fa749d18
-
Size
64KB
-
MD5
36dc5d703aa8c14058f96671fa749d18
-
SHA1
ee18ac063f3a8073cce2a0a8d2981d0c7051fd71
-
SHA256
3f01fbea1c3b83ffb5acef7208ee4012bbee6fee237ed1c1196bb247858257fe
-
SHA512
88ab7072b5b93b07551e35baf94d31050039d45f113971dd713c39b2540a284b7ff30b652e75768a4e451710486d8d0ac516a4dcabdfc60c371c4cc2cc503176
-
SSDEEP
1536:orH0Srs6+3ns8LQsD2yif7iWgzF5PjBS6sxwfz:orH1K88TD2/fmJlVL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36dc5d703aa8c14058f96671fa749d18
Files
-
36dc5d703aa8c14058f96671fa749d18.exe windows:4 windows x86 arch:x86
efb15bd0be8fad956444fb0c177c9349
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCurrentThreadId
GetLastError
ExitProcess
WriteFile
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
GetCommandLineA
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
GetModuleFileNameA
FreeLibrary
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
lstrcmpiA
_lcreat
VirtualProtect
VirtualFree
VirtualAlloc
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
CreateFileA
CloseHandle
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
CharNextA
MessageBoxA
oleaut32
SysFreeString
SysReAllocStringLen
Exports
Exports
Sections
CODE Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
1 Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE