�i-_!��Ȳ2�� ��걪�M�����bi����'�}v=���U����#�-�n{S��3�<�w�3�ͮ& orl�bHz@�3.sk%�d��ڵ �&|��0������O!DN�x�>�������T�o��dG)pu�V0N��ac)~E�$��9�����"F�(N�d���/���D��I����Չ�.���O�a��c���~�mz�ل�#�=�)��k줭ꒄ�"R<��"[��F��;�y��J/�;� �l*0n_��� �?>um�44�p>������1=�Si�cbǟ�sۈ�ʁ��v(�yʚ�L�t'Z<WT5h��#{9��\d7���@�����g,� ���TS��K����q�ҙ�ܳ��|�I�HEN�UcY���H��WNX����u�a1�����.+z���}y���._��j1\h_.��,�ٱ��J�g��q"-+&���.�{O ��I4�ʉ��L�_�F^@jNL �m +,����OfQ�*���W�d �'�Er��6~�p�c�-%Y�͆D��*L�!Z���$�A��y��ڹ:\QHpi�e�E>�3��v�ܷ�mݧ���ذ].M��$@������_��o_����*�D4B7�/�+ �Q��o�;g�wr:�-��m\��G"����l �ہY�_h��G]Ha44qT���Y�$�92���D�(S|��u\G���xt�I��qA���"�T~{�kf w�����P����x��8�JX ��̓y���)�5�!ʞ����s�Fc�����i�(��߽L��/�0��tv�s����g��f�x_)��)����b��b�eZ���B��=X�I���6��n����~�*?Ȣ�W����6�q_z������n�`h�>5�'��ǒ���;ͱ{���F�3�5�oK6�Y�����u"6�L���zM� "�}� �l���� �/ǯN�W��5�����b�ð�K�+����sx�B�Y�x3��-)N'Y�iJo�{��{P��� ��}���dV<�-n\*���m\ Bŭj�3TϦ�٥R�+*���/�b �H$���OU�YxYAW�S� Tvv(#U�����E��O�Պ� >>{ Xo s}M�"�])&�ۼ �J��ؾXh��,a����̯���~}X��o�� �εx�"\.]��`I 7X���97��տ k;mG�А�������Kz?R5<S(�"'�5�p'�R���Kߑ�I��~�K�@�� ́2<��B9������N��diR/�J��T��dA���j� ���!�NH�[I��!h� ������ �'A5~NV)4{��o+۶�� < f�w��Vp+�7�Q1K?��Ϛ�=8|�W��^��������r���܌V�0�t�Ӥ�z��_��|��a�%����\DZ����ϓ����ɺĨc�8��o!3k����듢����CV{7`�~�la���K6n�r�~�%Z4HV��P�Hb�s>u�M*�0����%s�f�ŨkHM�N��IJ��$n�O3S�,����a?��z�_�����5ć�ѩ}Z3��/5c]���C�H��È�hK�(��D*k�١G�C�Ya� i#̃k�e���(��~W]$�R�դ�e���2�/7u��:��������eѠ��GDGct%=�{��4��=�d�cƦ�::e.�Ps�zŰX��|8�b�V�T�E1Dc{n���[��&V����ՒU���W�����.���/$ �����>���w��Y@��`���h�����"��c2�^��C�"~��j�U�iü`�Ӱw�g����u`Ԙ��p*���b�� ?nEZ��Oߝ�,)�(\^6�E|��֢��Q��UO�+@��f�(\�[�]խ�sP���G�E�j'��C�j���<i�A��\u�l�ʳZ@V���k�QF#����K�x�'N@��Q�4���N�r��#%j�� s�N����2e<(|����A?Je-{�v9�U����2�������we��Hpeɣț������u�d*�ȯ�ګ����wᢋ���,�t${�<�uLve(ZA&Gާb�|������W� ZѣmXf�a�"�����2y�c���;�|��T���]�L��tZ8Eh�z��B�E4K�� ��F�]G�/�/W7�k~ |����x��@8������W���p������LiQ��b�wր���(3���Ͷy����Z�&4z)X��퇐�}D���}]�F)4��ꦡ��}7�h�G��[\�Ѵ�(�]j���&���A @ ַ��uݲtص4 ���h�T R�jP�2��t�{�3`6�k2dbl9�)���(�51�7��(�W���g�ԮK>lh��Ԥ۳��V2&�-���H���3�V�q\���њ�G���%=��'r�xI�����MQD��M%��e퇹���!>q�-��V���� \���p�RqI��I��_�2����y4�W3�iƉ���:M��ZO4�� �ޑ�M�`����,ι-Ô5���>�����r�З�F�Q��@xy��a��� Z,]S�7���6z�7|.w�#�����Rg���C�&�rB7��o!�`��J�z�@?62#�I!2Y\bT#~���Am�����`q����!���NI��!~!'���Ft�K��q�t��8��(� !�\O>��TT�O�E�0������<?C�����v��"��k�6�3������UPV z1>=�,��(��\�U�UB*�T:���n��,#�L�l�Әn�7%�pf�+̤y-q��|�9���.��Re��~�/����B,���5(r������E0ٱ��9��>���vٰi>�j ׁ%K�*�ն�P�����<�>~6���aY�?if�u�����a�0*�a .H���<xYlW�ŀrJ�5� M�����ض6�*��;�C�Ԉ����m�5��P��R%*>��1 o3���ұ�d�z�G���\,�����ⲴbN���Ia�m8"�X����](�}��\��@��9&�Q��
Behavioral task
behavioral1
Sample
4822e8aba8e120859dd32f4ede51d131.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4822e8aba8e120859dd32f4ede51d131.exe
Resource
win10v2004-20231222-en
General
-
Target
4822e8aba8e120859dd32f4ede51d131
-
Size
3.2MB
-
MD5
4822e8aba8e120859dd32f4ede51d131
-
SHA1
97afe3796f2972391efe3be4e29f957a826956ed
-
SHA256
4586f2b1429144fca8ebc728bb8ea62037c0c2e431e57bdd8b92fde4d379721c
-
SHA512
bc902ab55d348e2b76d18f3189a46eb271f08f0661ee7a30dd682790841381f61da3a03f0d1a3665ac666cbdb45eb7941284ce2287aada9b1c59e4f30d4c036b
-
SSDEEP
49152:Cp2vwXlbRivV5XKWyxOQfY35QMd20s17hI0beEaFQt+y++pxlgkNcBG4:CpTlbIV56bOQQJQMMRyEa+tPpx2ic
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4822e8aba8e120859dd32f4ede51d131
Files
-
4822e8aba8e120859dd32f4ede51d131.exe windows:5 windows x86 arch:x86
118a5d093b908687ee3cf9238463dc58
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
PlaySoundA
core
VulanUnHookDll
kernel32
GetVersionExA
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
user32
MessageBeep
CharUpperBuffW
gdi32
ExtSelectClipRgn
comdlg32
GetFileTitleA
winspool.drv
OpenPrinterA
advapi32
RegQueryValueA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
Shell_NotifyIconA
shlwapi
PathFindExtensionA
oledlg
ord8
ole32
CoRegisterMessageFilter
oleaut32
OleCreateFontIndirect
iphlpapi
GetAdaptersInfo
wininet
InternetOpenUrlA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 425KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 336KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 22KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ