F�d��Q}��Y �a�TS�����,]����"���=6*k���=� ���3�����]��߭�k���x��b��9�5!1C�� N����S�Z�ݛ�|���]$�Ho~ n�UQX��B��h&��S��z϶���@��@��$�ѷƶ�o )�k�������pu����%��e�+�������'O��s����-����3EE�!4G�2��A� /�y_�L���o��DE �a�=FM?\*L���ě�~ub��R���4�����E@A����}z�U��O�93� ��X���eX����{�5k_�QWte�E �. nl�zElY,�v��{;�/s?��߸e�LM6������x���`�a!�����o�I��U��V��o�/�.+����9���c��6���ת�_�����o� �z�y�myw8��������E#��x�Y^�?:�ǚ/�����#8�Mv&,!�M�k/u��0������ ����7f�H%�"G��뗩���I=:�������r��C����<Ypg�+@M�g�j��*��Zzn�KM�{=�1��}����l���7ܿxL����P v$+��f/�+ZZ�"��y�J �$܄��u�ѯ�?8�u��H��aڷ*.n>���.�ù�p�q�X�M筳"WX�k���z43kU��y�O��_�9�E�*�E�V����`~"4�s���{c-��lCcX#+>h��\/�-��x� ��^��C���Qcq��kf���8[&����+�K'�(�%�;Jl�?��m�s�P�p�wi�B%T�����+mf>0 ���Ѥ�wjZ0kʹ��!G;�"�����뛧�\�9�b�)9��A��w'����M���ҙ���o�Hx���}8-{&�����Nq����=%j�c��@�r�dԃ�"�����Z�W�"갎�čJ���2����Z�~���g8E/x��VŦJgs��G�MړM��*mK�c�'|>2G��ub��c���x��� �7[ڝͿ��H�^�?�� �,��k�(��^/�̀��jl�얎4��q�Q�P�Q��ysڐ�sN`��!���"�D��$v-����b̦~n�ؓ���O�3�U�oX���^��kX�-�^>z� ��Z�;��Vܸ�7���D���*������� �������9����#��r!�ҫ�v���Y����a2�K7�!�G���uhJ����Et�d9�.�L���n��5�U���a(��������DJq���*�X�P���m�r���� ���FW��fm#�(5.���z���6�b��zw�����0��+������!�b�nÚ ���������=��@O8ib�qc`>���: ��a���c����S5��B�4���q���2�����D���n&O���y�^y������bRȲJ\�[>�C�jbn�n��n����:5�4�i��͢4��*����%��ul�����|�o�m�{���I�H ��������h���`�{�H= mz��4��Zs�_�}��~�R"λR�Rxx��V����sT��Nm�����Sq��R_�aMI"N���$�L⦛ Q�֡�~7�OĖ+�_�)<d�YA%�^ޢ@g���o�~�������'�s�s������5����c<�h���o�ui�a���⮟�,dzO��,�����a��3�&y����@;K�c%�����b}m4�Œ~ �9=��=����~;�d2�~kdd��?/bO�0�[���v�qK�8#�ڛ�t��EU��քU��Dz�vA0��o�.0e�zy�� zP$]zo��rm�8)׆< W�Ԉh�=>oL!��z��T�У�w��\��|���.)Ԝ���K_���^�^s���UG{Ħ���-���!9?� �4�c2��[��� p�4��:qgs���-�W�g��[�:gT��\��y�������#-��O)�W�s�`q�ߐv+�����=K��o�����0��_��# A�-z�ؿ��T�\��$�i��HF���Z'�~�z��rF�'o?`A6A+�^�ֻ\� o���bt�9RH}j|)<��=�����s�L�x/��ɷKa�����ea��ڃ��nW��]�z�s���B;bk�$�����y݆VAW�h�dګ�/�ͳS� r)HI����E��a���&���s#��#�7�,k�����5�W�d��x��o�����j�ޱWy��Z�ս��p�(�2�����`��d#�mo^a/���w��8@��z�f�15�� 1��fu�<+z�fM��ÂH4v��������YWh��>o3������������ ����3�k��_�U�_t�:w{�}�2���a8G�Ot�����P��]?Ǩ>�W*tbu��F"2^!v�$}\�B�9PSxN�;9���o� `3�9�&L�t_���N�b`g.�8��h' d����P�5�s��M����#ߩ�D@hy� ����\��K�;U�1�?���0?h;�`�c�D�٬�|6D`�r��]s��s(Pl���}��>e��H�/ǯ��kDH�P���3�8�&dM����1q��{/[�V)�vg}� ��o2�(2U�� 3:�_~G��v����:�ii>�a��� ��W�ԑ�逻�����ױ4U���sF���1��p�}�?�/Y� W������u��#��~��zѽ:���)Z�!��U4$-�`v�7@�+s���1�{�0d ��#���,��7{)��=��*L���O��t�,�k�ؒ��������� �@M���>;�<�R�� �e��\f��")�F7%�MR�q_��p&�}��Η?���1��a7V���/����gv��48��PB��.�%�+������#@"^�|�Y���-ۧܦ��5_�\��ޔ�ewf!ל�� `�/f'��0W��HFkɠX�:wrmf���g�ҋm�������[z'@'���X����v�{���!��?JӉQ���0T>J��a��x�-U�cP"�Z��1��C��^�r^���m�����Z�0
Static task
static1
Behavioral task
behavioral1
Sample
02e409126277674e15856268f7750411.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
02e409126277674e15856268f7750411.exe
Resource
win10v2004-20231215-en
General
-
Target
02e409126277674e15856268f7750411.exe
-
Size
687KB
-
MD5
02e409126277674e15856268f7750411
-
SHA1
d6f8f4be901a3910b8e6ceac00d47a055125da60
-
SHA256
bb1938fe29f0279ae838be9b4bb28b0ba7bcb3982a5f738252f72cb6e5b40298
-
SHA512
60a785bdf8588c876e3f81d90fc94f1d822cb3faf2091c36d1729d0b5a7115af8c6270edecef6e3739d5449c5be179fc305940d7b22f9f058743549ec9ee5b2e
-
SSDEEP
12288:Usbxo1OFX8b2QMPkv97F9OWlv5praZXmxM7kkAKg2IIEC6eajArE:81K8yLPw9p9P3aZXWkAKg2IIBJakrE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 02e409126277674e15856268f7750411.exe
Files
-
02e409126277674e15856268f7750411.exe.exe windows:4 windows x86 arch:x86
1f1eabbf091aa2dfbccc6d349963844b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCurrentProcessId
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowDC
advapi32
RegisterEventSourceA
oleaut32
SafeArrayPutElement
gdi32
GetDeviceCaps
comctl32
ImageList_Create
shell32
SHGetPathFromIDListA
wininet
InternetCloseHandle
ws2_32
WSACleanup
winmm
waveInStart
netapi32
Netbios
wsock32
inet_ntoa
avicap32
capGetDriverDescriptionA
msvfw32
DrawDibDraw
Exports
Exports
Sections
/ Size: - Virtual size: 610KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
! Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
3 Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
? Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
8 Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
7 Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
7 Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
8 Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
5 Size: - Virtual size: 322KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
. Size: 624KB - Virtual size: 624KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
6 Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ