g����.ha)P���.'�N$�G�`�r˨V�J�\%״��$��;*�o��-�Gy.�W�?�XNH�<��V��|��0X�U��,�P|�f/f�G��t�ѣt���](�\+�������}ao�Xձ��+�{�I1�?�)@�?G'J��}T��{$y��>�n;� u[���F����Ha�0H�'F���'G"���I�Q5��&��Ͻ�����YIcX,���� ��ivɬ/li�4��/��(zfkc�5����'�i��䆊�~�>��ў�<I��vk�q�!��*ܔ0�[u������}h����L7�U�?��2/�I���#�%������Y�d�볺��r���!��#�Ϥ}��N�iY��e�]������K��w\kÂ��"�Uˊ����%�������"�{�t�25jЮ\�����Fn� 2"�oy�#��c�gU�E��#1`�p<�A�>��6�.�"�����6Ê �)��ň�e��Z�W��[��J����Dd``�������2���67'�F?��_�����"�b�p�?N���쀿����V͈+�C�_ ,ӧ�hb��)ӻ�?�|ힴ+'��Ǽ~�9�=�^�K���6<d����H��0��3�j_�`z^�K���1cX���Le'p3 YL;�D�둌vs���c��QK`�t����!�Ƀ!�7�d�T���U��U�9N ��U��;g?��u��{��#���x~�A�� y�3�K��\�<1#�������dgPN�]�\�U�=PPA �p ��W����s��q9��o��c;K�~��:r��뻕8ob���=��{��'2��_���ЕE$�E�����<��Iv-� ѝLS�M�';�S�?�F������̦��b&���g�B�5B؝��7�j��1�<#~����8����l�`��Ag�;w�BІ�6/9dfz�.���<�S���2�{2�bܫ¡$�KȾ��ԡ�ᑡZ����ȑ(8S�Q��2�u�y���q���zQ�e�-�UMNP(2�)�?��5Jg�4��ύ��9���Mr�� ��l<6����W�溂N�x�LU�GM��+��#���"�0�F@���uG����ڢ Z{�6#���Oa���JX�ӊ'����sJ6����i�s����zX9y_�=!���<Wu�G�F�|t�L�/_��tD�0���2�F�g�ْ}���� gFʼn�Rlɞ��=���v��"y� ����X�9�*�q:kv�����sєZ"i�j��IQi�LcӬD�1�o�,���R���;�t�4��L���2x�R��� ���w�PȠ��x (GH�CG�I�#s@R��%5��]#\�-����#�SQO f�����gX�M�=����;���Z�"V��&7r��u����ǧ���5M�\m>�����+��!�4�k��c�yM��~��N3�6�270������k���A�d?��K�#���AA�5i��ٵ�!OY�����ق�k��ug���^HY��ђ ���#��d_b�iSk�����y�������UO>R��˪~��햆? H�6�6k{(���-kB��㌎�q���_�2�|l�E�R��S����"��8�U���V��+����W^�$ �R#Uy��l��ڀ�E���f�t�f��e�h๛R�Z�P�s~���j���GW�v������z�V������^��r�"��r{RH*��������b��Ʋ|�ޯ:�L����\�<���1!DwI��i�������K*�U�k��Y��N���.+���(���볇>��'�W�6��O���ݼw�`e=��3��$�-8SC_DԒ$��f���zC�Vl��?��a��0腦�����@���- Z&���N��_�C��.�[z�>�S��4�V�`�Np�M��%�Z� ���;�(;/��K� ��x[m�?�����_;���ⶑ>�^vk.���C�C~J&_����fc�sT�1�o�R#�7��7�TE�XX�jAsME�h�uΑ�Hr�����1��HX�������%T�U*��C�sR��o�d��%+�RW F��3������jM�7��D�����"��XX�pc��F�5��Y�QA��D̮�e�b���(�1;�v��''t���w³b'�v��N4��M=MKn��E�� �#1̸��� ������U�����2�V���tn��{�f�*և�"� ���r�t��!�OiWW�o�HF3����3m=�-�V��NVJ�g���O�e)�V�D��P��$r��U�3��� %\���V��x��q�4Ȣ�VwfPCb����D��e�����J ��3��m�/�z�&$�H6e}hTd-�?�ў�gWu�G�W `��C>c���G�̘��{�qO���H����8�I��\H�rM��`xrƹ��T�xo�Mô�$�,�t���fn4����8�ˊՒ?��-3����Nz�w*l8xƅ_��;�2E����n��Nh�ҭ"������vg�FR��`5����׀���9e�s�%T�"��-����&�P��z����7���Xj�rd�v�'������s6�Icc��6GeK�Q��0c�i,}�͕�ū���HJ����^qD��ʑ<R�wL��/H&ȅ烿������SYK��i(d�<�Y��� [�g�tTl�[#abHù�ɽ̖�f���[s2[�w6O�n�;�'S$�/`1�Ի��Y�;�e]����G�L ��6i����ܷ�,���F=RR��,eµL��,�Z�'i�͠@�쭜��,9����K�V;܇�\�Q�LW�C���&����VG����2�~f����=d+]:����ߗ���l��4M�lV�%3�W5�c�̾��C�� �l��AF<2���X�M��>9$/Ϡ�8mb�K�EHcL�����=ۙ��<��_�=8��~��+),E���C:�_�x/0�i��J�7���cW�+�G��L���8�3�����(�d�0���������;,���@���|�e��t�r��e��gxFv����f����֓��T�ԑ
Static task
static1
Behavioral task
behavioral1
Sample
37a5766ebdbf336bd2eff5a12883c5cc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
37a5766ebdbf336bd2eff5a12883c5cc.exe
Resource
win10v2004-20231222-en
General
-
Target
37a5766ebdbf336bd2eff5a12883c5cc
-
Size
200KB
-
MD5
37a5766ebdbf336bd2eff5a12883c5cc
-
SHA1
094a5d4e3d1e66d03016c62d1bea98bd4fa6eee1
-
SHA256
699057910879f1adbec462db1187ffc90b010b24ef1253c7fe6eb73b27a68976
-
SHA512
2a02a69331faf40a5f0f1f80681913438f11a5131f8b78e00a1b865c13484908e52f7170c21258ff6316fc398fb5fcce3d52b9bd462c2582a5ae231ad662475b
-
SSDEEP
6144:6ThmrHMW8BYYF1Ni1StNeiCZGGcCQI3BH+k8arS:6SHMlF1NSSvbI3BH+1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 37a5766ebdbf336bd2eff5a12883c5cc
Files
-
37a5766ebdbf336bd2eff5a12883c5cc.exe windows:4 windows x86 arch:x86
9db0cf0268208efb980cb36c9ab9c2ca
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaStrVarMove
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.y0da0 Size: - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.y0da1 Size: 184KB - Virtual size: 183KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ