Vh�hI0'5�q����N�]M��j�`�����,������w3gy����tZ�Fkf�i�w���\5�4x��H����n��(�w�\�?װ��W7��V������w�U��~OWF=���|�{�7:A$���s�3�1:Ð�h�s����n E�nk���+����1]Qv �wU�qN�S�^�a��(�S��)��Orܢ��$����Η�dt����Yj�Æ�#Xva����.�Ud��! �����:uK-�,7��Y���U��އw]찾M��?�c]SZ���@��+�T��NO�q�?^���8��JM����`��z`��&F�� �"K�]Z�f*g%�����s�0ٛ6���~�1��"0I�f�E��LV�=1G�p9����w�:FA�p}^lR�#�]z�/]Z���X���f�!,NCQ ������TF��*p�@�4�跆#-x(��T>z8^��&��?�Q��j\�*��L+��m�^���Z���<��4J�����9�g� �\�s��/R����|����v�ǑN�9�@vB��B p�Ô�ޮ�쎿m�ɶ[�����SsOm�ι�5�QV0�ǪG�������t�����R�ag���ǻ��|�a��+�^��R 8{�)�� ��3��i��T�g���.�P���{�o]D.�wW^;�>���P�<���*ιJE�2x�3b@i:U��,Qj�e�52����f.����Y}��l���|Q������NU�,�HI&��<�tX_�^w�5�����́��w�YR��V���FDg��j(�u<-�X/s��R��`��8��f��+E�] ����1y�>�R��qzy�ϑR�"�m0��joO���:�8�j��)�jm^Ĕ�bvv ��*��s-�(��F��r�I����lL{ڴ� ���6?f}@�&��tX7h�zNt#̉�oxR�Ճ�srieً.�����n�m�Hʘ�6%h���T��\����esa���Ó�x�4P���SzH�/"�����ए�z�� �f)lh��v� =��]ye�Rg�����Hn�,�HU�S@'�e∂��{� �u���U���^0T��.b8(F�ב>�?���.^,Sy��(�)ݞ�����)�C+B.X�Ͼ >ySޗ��p��ּX����뙎>�����������kM�L����~�rCe^M� L� 9�M�ۢJ����y٠`����U]�� ��>{�lfV�x3T��@�u� ����U-�&j�;��������el�f����x�9��]Z�9�o<f����PЭ�x��S~�>�Q-.���� ��y�M䰑�Y_�ZFQ�|%��ukD$gacz��ZfY��?M�'<���8�[�[G����l�xas���[�uC����T���b@���T�I��h�;��C[Ĺ�5�W^N��#��T���-�5p#?e&��)4��'�.eK�)r.A��IǦ��`�U�(U�6'�t@o�K��*���+��m�КƉ��,�9U��5����%[HEh��H�(�<��|˫��.�`d^�'A*�U)�۫�z��UG QI�s#�Q�Rߵ@e������S���ܢ~�>BO�q'��JT��ݪ>3��1��q�F�ye�����t�م�?Gͮ��C)�1������=4lXh/,�EW�S�d�������/\��Bo�� ��:�#]k�G���ݣ��o'YL� `k�r�ɛY�Bfy;�W��ֿ�f��Ƣ������=�BQ�W\��O��,+.������i���_���K��v����A��ھ]�����:G[�\��Ts�NDU��X���7���g���^u�Ы�6c��Ϙb�45բ��"���%ejbu��;�V�(�:�I�>ŝ�Bx3Jzr�� IT�CJ���ɫޡ.�DN���~���b��>��]�+ �`7=����Ѻ�T�����3�]:��e͂��K���t3Q괟![8�Oǁ�h���^�X?ײO�|'�I'����� ���s� )� ��.ε9D����~<��׆��.�� �`[ERP���r����&t����=����6��Ζ�;���Zщ��D����&XH .HC k�NC���SC�[>@�0�nZ;��y-� Φ��7֟GG���\�+`N&�¨��K%�g��_z��bLn4p�+O4zK�EM���u�� ���6�tq��G�8t˨VH �z!r�N5�9�|�������5��%� �O�1�/��٘br�6�(�I���0���@+�����r�>c�n8*��(4}Ɂ��9�G���w��B��^����ǿϐscF D�j�� U��?N��H#��#%�&��xr�=�܋���?��þDC��`�Ů�OY�VË�}��ń�g���m49���Y��D�+�[��|�@�LվM�$FT�GJ�ݿ�������C*.�8kx�/��������?�Xp�E}�E�U��$�(s���L�J��H�s��\lS�b���/�_RP vC��j`�E�h��2��H����i�AVg�F�@خ��]O��1&��?H ��m1��S$�LkSw�~i֧���o�LFk�\���|�̩m����} ���N�h�D/�y ��I�����6���;V��w�E�gϕ��hv�ҹv�u����*EwC�-���^�N��|u����س�I�b�g�u@N,2T��8��Aأ��x��jz���4�����$)ˢ�*aR`��zK4��_�å�hm�Kp�V��.q��謏�iXe�R��}<�buOd�l����9F[�1C#������ƧTSy�A�z���9s���5_�P�8 �9(<\vmy��w���'�nHvH{�ՠ��Us������ %]*$|�� >��Y�= K�F��K�U�iR�CH� T|� "���TN����[p��j{nd������6�O�B����)ޒ~`T��Q�Ã��O�"�!���0����H�.�A�^-��?*��;+/k�.�uɽ�&;���sT�a'�������z�2Y/6�I%��MjU�@b߮�
Static task
static1
Behavioral task
behavioral1
Sample
44c89479f73977c3ac65796bf4c3c183.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
44c89479f73977c3ac65796bf4c3c183.exe
Resource
win10v2004-20231215-en
General
-
Target
44c89479f73977c3ac65796bf4c3c183
-
Size
732KB
-
MD5
44c89479f73977c3ac65796bf4c3c183
-
SHA1
da67a96c2a39c57031fdedede4327e8d68d0e52b
-
SHA256
6ee7349e52b449a7839db3f9f8084fa5a2ff04f3dc9b8249e9b6f27431cd14a9
-
SHA512
e7b7ba33d229fc91528fcb70be257d54b458dbb5b50b4ac3189ae6abc975f46228a353752a780bd85500fc461b760fa8de6195990f1c8a21c1b82b4d85589718
-
SSDEEP
12288:j8utA/H4RYIVDsg4BafX7tnP3XwmSD72q9VKe4l+RDTc+Wmq5F/qnOK/:ha/YRYIVDsg4A5P3XvOhXbFx+hrC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44c89479f73977c3ac65796bf4c3c183
Files
-
44c89479f73977c3ac65796bf4c3c183.exe windows:4 windows x86 arch:x86
cacc16689cdc8553e05b2d3c08c92b2f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ddraw
DirectDrawCreateEx
imm32
ImmGetCompositionStringA
wsock32
recv
kernel32
LCMapStringW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
gdi32
DeleteObject
shell32
ShellExecuteA
ole32
CoInitialize
dsound
ord1
winmm
mmioOpenA
ws2_32
WSASend
wininet
InternetCloseHandle
advapi32
RegDeleteValueA
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 11.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 716KB - Virtual size: 713KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE