�NL�ōg�遼��Sތ:�Qq�N����$ʏf=�!��^��Z��j��a/��T�i� }Si��ֳ�QN��-��aK��m(����zb8�I�Q�wF���X�4���^l�=���%p7V�z�%�� �!���Hvf/-IY��� �@�u����e�O�/��"�����!4����Dd�O�7ɐvB7x,?cS���CQ����<l�K���4Α������]<����O�g)��B�tHa�p*��秪V:��foK]�j�M�*�Y�Lg~w"�d&�]���{�X��9���� c "�O��q]�+�����'��t��U����}M�F�z����v����Oɠzrʛ.>92�+ 찔����'�Y$;�?r{b5�h�*�y����,"�ܦѴR�'5�\^��A�@�p�\)�� @������s&R�^�b���'(d����)N �7M���U���6X��?�D���X�N��UR3s��]�s��?~w��p�ߖ����F��o����kQT����@V�� ��6���r�.�ET�C�����,�3a��Q�"%�w���k��J�;n�%��#G�w�����q`e����������ª��7���k�VJ6�5���x:ʢ\.X�^Y��9�_a�,�)��+��,_]���K���m+e��rK�����1����6��C��^|���&�DGq�9�/o� ���-������hsa�Dh�@o��8�[��I�#���,X�FN^�|�������ޙ��L�����F��X�MDR�T-��W�a�����>�g���0���;����<�{˄8jػ��s��^���̮��cΜq@�M��vq��0�x�C�)�" �l�����>��=4*���VV����}�o�_� �b����#���T�(;E@f;�Ƶ_Qa�ÊGW}|�����m��������/b�פ��\�H�`��ۦ3�ĕ��+�qG��$X0� �f@r���U���i3m�I\aن����e���+Q�Ax���X(,��A��1���Q�"�F��m��K *��v�K)D)�(Ř�æ>��) 8'"�,^��^s!)��BN:v��e�so ��P =�a�v��Q�vK?v3x:��(�IWcPHε���^j�)��Ҿq�TM�@��Ѡ��#�,��]n��x��f|N^��Ӄ9����g�oq�4ّ�Ўz��^+U+��4��h0�HU�7\،1�"y��$7�NĜZr�������}����1-��Pq��̾�\��W�>��|*)-}B,3 ������O���2��'������dj�-�4� �Ni��߃^�#`"z����H=���|���k� �+�c���������hݳW��g��F�<�g�CI�A �5ϼ�"p��'�.���8�0���dl�%�t�\� t0!�R�� ���4���'��Q�kn��) =|3�����A�m�'LN&��⪗���>� �������` 5��eYB�t�c�%&�Mx�}������V���a"�,Kg`�,�y<���^��O�=̜7Ժw��j���Х8��v�d���d�U$J�O�\䄲����o۲����oQ%���O�&�~�N+���h0m�5���@�D�>�EE� � �~+�v��A5Q/Iޮ ���h@�(�'���5N���\f��xM����L�d�0��'�t�5�An+u�HP_�|�^��,y���d�2R�>@�vO;/��|��a��Zf����(-a��[���é |��K[s�����/ʘ��@���2C���O�h��LD��#c�oe�!���>eށ�TS]6�=�����qS+�'�.��#�ݔ�e[`���W�F@������1E�����@�r��O%m�!}K$���W�]����V^�]phB�Y���;���9���M(��):�a߫�#iRD|{��m���2�����J����: ��RD����^&Ԥw�{��>s�?��$�����7��&��@zbΐ�w�F|b$-��Zq������A��U�����\^b�ŵ�l�d ��$sߥ}J�B�G(�Tc�� ]�+!zp.�YX�֟%�%��V��@���?oM�3�b�NJ7N|Y^���)pr�dNG0�9<ع�l�;P��>>BA]1p5���(zܪcEA���%�V�O:+܇4�KD���x�i{~�3x}��1)�����2�������[��:�P�m5�$?�U��qd*?7��ڝ2w{ZG��g�د&�d�!�_����Ǻ�K��G�Q"m��\SC_ <ہ����=���:�ӈ�hz�U���9H��S�_Л���]�2s�RȴT�ˡ�s���C�a�n8����Z��t�EѾ*���cu]�9���B�_�ff���y`��l�d�F�Ĥ�+i$�(Dz8��x��4���b�`���I�!-v: 1�⸮ "L�T����+��Iw@�2߸i ��5��=6���v��1�g��P�_�C���Ӄ*$8� � s�~l�����V#$��\����[(���v;�Cc�)]<�$��#:�=�u����.J�H�ڶW��.��q��'짽�^���ٹ��a��r���@n�k�� ]�Xv!(�'{1�}��7@�S.B� ]k�gJ�vx���P �Ort�����|�������$jf����;-?�w;��OC�`M;��'4Ɯ���b|E���X:��t��E ��O��x���T�T�,Z��E�T����}����a��O��~b��>�����m��� i_<M��<��k�7�h�U��y��Kf�V���Ż=����k��G����W���ѣPh��L�V��2�����f�r��3���)�,��+ⶵ`]�hh,���GA7������ʩ�J�#�x��2N�-���l,�����G��6�<�ŷ�����o���Y�e� a�o���L_�:ʶ�F�vW����"���@��3����LSȋ��0��ɕ|[iЎ�'��V�)7���a�ynJiK��9�����^��Z�6+� /2kjf�pd��$5��1�,(����:��=v٠:���%��r
Static task
static1
Behavioral task
behavioral1
Sample
b7dd662d5ff7f40aa3963f07e91cd4a63213bffdda96c75bae60b6397b8e3e16.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
b7dd662d5ff7f40aa3963f07e91cd4a63213bffdda96c75bae60b6397b8e3e16.exe
Resource
win10v2004-20231215-en
General
-
Target
b7dd662d5ff7f40aa3963f07e91cd4a63213bffdda96c75bae60b6397b8e3e16
-
Size
6.9MB
-
MD5
a7ec45a8667b242ae4c93ad72a15b3c9
-
SHA1
134d5b265f4f7a7032179fd3e6f0ef17b0a0a209
-
SHA256
b7dd662d5ff7f40aa3963f07e91cd4a63213bffdda96c75bae60b6397b8e3e16
-
SHA512
4bfae33fa622ae82a0d1ea7ecf7345c552bb1e21801ec1458096153bde1ebd118085af907cd33a530e102d32cfedf6085454c2ef8ad10c95bf4443876c836efa
-
SSDEEP
98304:p1GYWvQv0Q3mZ3tHjhAhaKj0egkMSlJh+k/aQTFGTRp8OXgs/DVDj4qZkZKtBy:v4QvR2ptHt7lkMKfaY0TRp8OX9tkZx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b7dd662d5ff7f40aa3963f07e91cd4a63213bffdda96c75bae60b6397b8e3e16
Files
-
b7dd662d5ff7f40aa3963f07e91cd4a63213bffdda96c75bae60b6397b8e3e16.exe windows:5 windows x86 arch:x86
1c350468b7b388c56a95a28fc6c98d84
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
GetActiveObject
advapi32
RegCloseKey
user32
ActivateKeyboardLayout
kernel32
RtlUnwind
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
Polygon
version
GetFileVersionInfoA
mpr
WNetGetConnectionA
ole32
CoCreateInstance
comctl32
ImageList_Replace
urlmon
URLDownloadToFileA
shell32
SHGetFileInfoA
comdlg32
GetOpenFileNameA
wsock32
setsockopt
winmm
timeGetTime
netapi32
Netbios
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 48KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ