��uy@�'V�;��-����K\[�O�����6�{�)L���O��I��^��t<���@��6���4g�����e��y��8�5��W�p����V�=�7\�`{����XX�������Э�*�d���C��sΡ"~�߄���r��&��Z�Nkk�wM��n���!���fmo�����mIMƨ���^@�3 6��� ����5���ϔ̭[X�B�(���)�����sթ�>��뚲��t��)����:��N}z���3�xa��P������e�ఐ�ҡ �O�#z��Ab+M&g��#�&�+)z&V�W��WUw����l�փ6�g8_Ȳ�aO{G�� W.\?��V�XF>�V�x+*ɧ�f��I��o-�k��G�Y���>P�Or�MO��IH��u��R�U���T�L��E ?5�}s|.̿���������/_L䢠D��[,X��'~a�l�B�?�?�_귇R����*�+f��R�|?-Dx\�G=�����m� �+lW�W ��i�3� ��|�6Q�v���� V@r�a�&JyՎ�������!UX�#7+Ƣ��A�6�u��R�C&}��7�,�����ٙ)f$ X|sˍ.z����r�L�A`'��̡ q���)�{�8q��� �p[�T�w��X)Y���ƿѕ��&21�f3�0��Lh(���枫������z#z�Jۓ����]�� w�vQ9}�o�m1�lH�rֶp��|-�!�s�0ԚG��,�#����a��wYi`dl��b�鏪�5n��v��@�����cK��Y��s/,�%�I��&K���MY ��� +��'�M��右 HXZ!�E%v:�Xպ>u�O̙R:C�[4�l���π\������ �i���z@�?��������y�iDn�`�WK�6z���"��h�C�3�]�S�w�gT��S7�`�&���چ)���/�2���~��P�^P����V������p��ɨ���\�v02=CZ�'�������ӷ���E7{*�n t����G������2��y�]��.��u�����5l���ip��ݼ��:Jfp���sZud�t�맲vS����7:��3�6�~�1Sw��J�8��4�Ґ��&4���V����w�"�5N�}<W3�2�K�ϛ*�e�q��Ѹ�5j�b7cT�'nYA�ñU��,M�{���a*�g��L���|��8}�a�����k6e���v�м۵�z���n�̑s��$����$��Lh Y@ (jN4rH� 4���҉���<K������D��#����miܔ�]��呬R����l!@SW'���u��u�2x<�� ��-1�K����E�jM)��Ɯ������!�k�?�* ���� �aR���3������(�Ԛ�M{�� A����`:/��c;����yO�>�/�7�䫎s�F��R��Ӏ\�J8�P��PlGF���"a�:�|�uj�#� 0�/�~I�V���`��^O~���vƿIvyL���#�b83Ջ���4ֿ�@ڋ>��+��5����^$#��):�( ��)�Drſ�K��Gz��y`NVf����.Wl�U�0����������G������.,��Ca��2X�"�F�Y����߉�0����K��@p�Sѿ�Y�Ď��>P��J�&"���K���a0Ok�]���������Qh(Ƿ�J�0DH�b�@|F��u~x<�� 3�q�!�l1 ���0�H���~��yf1iKJQ'� T�K<�2�[�vF����k��奓��H�ÊF�f�*�fƸ�q����;���u�ryF,|���.Ώ�3�������>`�@�{���S���:а��c8y��rp`$~�m�������v��lm6} �Ș����w�D�3��96V��n�j�+�}RkI�(��m1�'�+���kL<V�wk��g���e�Ś�a%sf٧B,�N����!o�R<��� Y��S!(�ZC�ȋ�r�;�1�HöÓ�pŹ ����!PP��S�1��D���rbHG�jS�d�f@����ڽ�L#֭�-�FG�R�QKCnj-"�E��7�������4ɚK���Z��R`/�F �I���#p��)�4w ��;|���=��*jh��Y\�/�N��Wyߘ�M؟������ȭ�ן�}P�-��$�X��r:$��ᕋ�u���~�mY�ϝRy��>����,�U{�0~DYj�q�G�ڼ7���s��Xוn��R�� '����eٰ��UW�����'�&���L��W��f�.e�V$�z��E�?����e%~�^b_h|�p�Z9�r�l]�W+�,灋s�bz�"�H3��7 �������U��C�K ��j9�C*"#��ʨy|=�i�<L�d�@B2�Ad�g��=�P28 ���ć�l3fq��C/Nt3�ql�\/3��������<U�&��Ϝь��&X��g��^g����0d �\Oa��+�l��JH�uJ\�Y��#��Ӹ�z�/<fX���&G��E��&8h���Y�o+)2V�'�-r�3���t�u��h*�8p9A%`���'Ʋ��.�ċY�լ��|��S{@8a��ux��c� �19��=�?�[̈́�^���9ĥ��g!8�E��݄���52�`������V)T��<�B����C���WW��Jk^�@�S�w�dR��ɬh��q�s�Qx^� � gL�����f�����U�aiȹ�����^��S��G�6S,4J <�`ȃH��b�zm�[�$�-W-D�T�(1�� ���_�4�[���@ӻؔ��C L���S�F\*��������@�A��W��~�|`ݵ��:�<+U�h��N2u^\����<�۷x��+G�5�9����DcM�@����'i�8��Y�P/���:��G��9���ڸ�j������Ɔ����(}��TL5d�ˆտ�jE5���� �0;i$VD1F�M �B(p#���L䙳�7C3��{z���EfufH. � �3xׁ��x��D�7y�fވ�@�Ģ,V��+��4���M]C�̩�t@�
Static task
static1
Behavioral task
behavioral1
Sample
3692f1439e666b53d79ba2b52c97efeb.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3692f1439e666b53d79ba2b52c97efeb.exe
Resource
win10v2004-20231215-en
General
-
Target
3692f1439e666b53d79ba2b52c97efeb
-
Size
6.5MB
-
MD5
3692f1439e666b53d79ba2b52c97efeb
-
SHA1
aa50ae4cae5808dfd462dadaeff46a7f6dd7e768
-
SHA256
7e260cdf620a7bab47de665721b635a5bf76327e963f8af9a5912812f88cc28e
-
SHA512
02fddf105a341474e2a5999efd6d62d887bee3ddadcd3ed601419b22c491578c0d86969cd777258ec2e9fe91783cfa924e8ab9d0e1a1f322d4acd9f34b2bc1c1
-
SSDEEP
196608:2WOEGUreIm0EzGUZg3CC8n6IFUlvF0wXlvG7XW+yz:rOEdeIYzGHSCkAvwW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3692f1439e666b53d79ba2b52c97efeb
Files
-
3692f1439e666b53d79ba2b52c97efeb.exe windows:5 windows x64 arch:x64
0ee6d4ae5eb1609ffe523b03fa13b8b3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wsock32
gethostbyname
winmm
mixerGetLineInfoW
version
GetFileVersionInfoW
comctl32
ImageList_Create
psapi
GetProcessImageFileNameW
wininet
InternetOpenW
kernel32
GetVersionExW
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBeep
CharUpperBuffW
gdi32
GetPixel
comdlg32
CommDlgExtendedError
advapi32
RegDeleteKeyW
shell32
DragQueryPoint
ole32
OleInitialize
oleaut32
SafeArrayGetLBound
Exports
Exports
Sections
.text Size: - Virtual size: 882KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 195KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
data Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eIc0 Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.eIc1 Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ