��E���0���,��?�K�����^��N�H@�i_�7���-F7��9�"���l�Xj* ��{��@���wQykp�\ک-B ������a�^߹zsu�r��~��G����J�z ��L-D��� �L�\se8��{���"��ll���A�����ky�s�3��n��Y����U��(H��Qqf�_m�}�&���FmwZgt}����4��\=$3�� �������YW�ٙ,�tO徂*��{r7�c���f�qe����p2��[�S�n�:����A�o�Yݕ��{��~��L�QǺ0�!Ėhͫ��N�}}]$�F�o�O���an��z���z%�NOF| ��~���dz��So���e��<��9ц�[�pM+C� ���D(��*��1Z%�߬O�U\D�/�z�W�������hx�be��n��=x80� _��5���� 3?YV��Ex�«�?���P/�=[����;�:��:< ���S�kow?W�V�2/�J� �Z͡�Xn(,ӭL��mN%ٮG]^�i �ʵ���ڵ�)�9$�Z�t�w���������.d��A\2�_�3)���y.a�"B�m]f��(7��E��cu��}lS�5P)m�Wv�fp(]S��a|���W� v��w�ӛL��X�H�N���4����!V�Z�tM����WL��1��~;��^��ȕ�g���&�~���/�����~ط\1.3��I�бF�X��Jx�Z��8�]���º����lY ���uۭ ȹ7�J�� O�½�)��&Z ��5`�T�q&3tA�k�7ґ%���v��i#�5�2�{�%5�d����+�>�Of�`ꇓ[W�����x(Sf�}\v�#a��HyQ�Y� � =gQ��������IJ�Fޞ*������K[<�:��ru�s�OT����g���O kn]u�O�o6>�r�L� $�`.�>���-�iةrj���kT^<������E�f���d��[ ��ZU�ÇB�^6��%�9z=[$�E��*�."�o�!�̴�J"��<<;~�td�V�,*�CI5/�:��0A���� qQ��R����wP�P�hOv~�5� �Dn�8��e���h�6=��H��I_G�f,-�k�QJ��Z䓐ê�ƴ\��M���sd�(#�!�O�T��0 3di�m����X�����%��U��Ju�|�����V0K��MǸ�����_�!bA��wKP���L� ���n�WJ➩EO�M\_������!i�{$��5�|+c^(~�wO��oɷw�[laR{�d����eI:c/����w p���'U�_Т'2�Ѕ� �-&W� ^&��qU=�w愭�EM�IU'�1��a�N�ѡ�ʴG�6�Ռ^Ap����/�H��2c��&������ ��f��$LPY����5x+cz��W3�I6�RDz��h��q��$o�D<��O�hG���<�ŰiX��V�5n˅ŭn� �!�[V��L����@6f����W�A��Z��Lh\~�0F���.a45�غ�G�0����R�ߎ?рF���\�Z�j0*.H��%t�y�?�O�6���_J|�(؝��MRyA!�ˮ��Ðz���c�u+@r�gv�Ѫ�Y\үH�����?��~%��D t[6�]*M�~B��}�g�5��B���փ��v>2�{xCR���k���� h �!z�L6�X�=c���~�8CV��ɩ�@�$�2G���0NDӤ�omy��Bʭ�Зo�K<U��8u�go�KH�d�Z.厳e���+�lո6��c9~n+��X^�qG_�V��7$�L��$��ٲQS��?�ݓ�c��:?�R����x��:��s�=��C*��u��p��N��Z�!�Oo�T���^�^�cv�yv��_�������Չ��t>.�r����s�� y��.����y=JbK����� ݂����"*Y�I@�<�KzĒ<-��0F���C�F�p���K����}S4���&~�F~ m��{g<�>� �{� �P)�E�:���ǟ��m�}��9d[��fuɳ�Z��=��Q��<q��F*�K|�uA�@u"����OP�����0?)7�3������l&�Ժ�e�H���A��v���{[�x/�����X[��& .ò4�8n�@㡎:Y!ދzD�Io�&���@���D&�2'��q����z#�i�4�b�Q���2r �yC�(��f�4��K|�s����f�_̥�P B.�@��Vftn�λBJpEWo���)9�ݤ��l�4y�/�"i�j�uu!�I�?�k� ��;G`�����.�^'b*�|Ӣ>�e���|Ԩ��j+����AםoH.)�?]�9�p\��r �z�����nKM����h��B,�'�UbNsG�m�ĭ����q�\ �{��(cV�Uoe��ucnǢS>AA0>4L-oBo��JP��M1� ]�b�ے6!8�h.Nj��D�g��?����GAZF�eط+��9 q���Q]������A��(r����P ��^{ Rѧ��r��R�`I!�!��#��T�����JZ�5��Z�U�4� �r��ff��##%f�B����F|�O�`o�/T���q�ԉ�P əd�����qY���Q�I۔+)�X�]�wP����q���}ʗȏ�@>��{��ܳ��|/���Ңs��)��`���+�i��� ��y��R�����,=��r�N���6|h/��*��� �g;G)H����v��{��n��x́�Q�̈́�āw۸�v%$�u5����3�ƑyOvz}%(�����:v�Kև P|9��۩$n�?M�%q}8jp�>ܵ$� >��骻�Ո�ߥ��$_�t���r��d!��np�sI>��P&��8f�(4ɞ�Q�K�1}5���O��E�l �.}h�D���g��*ߔg�p��=�eak&�>��?���wS=A�������1&���η���N� ����>��a!6�^ByKV����- �e��q�� Ƭ�դR�$�[��o�����ѻ��ߗ�Q
Static task
static1
Behavioral task
behavioral1
Sample
4a7efa9aadc1e2dcd057abcf795fe88b.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4a7efa9aadc1e2dcd057abcf795fe88b.exe
Resource
win10v2004-20231222-en
General
-
Target
4a7efa9aadc1e2dcd057abcf795fe88b
-
Size
11.0MB
-
MD5
4a7efa9aadc1e2dcd057abcf795fe88b
-
SHA1
50cb56316118a795570b087213770943773415b1
-
SHA256
e262e66cc626c6955948c540e1414c719e9ed55b8ee8f4ce8f63de913569354b
-
SHA512
0ec2c47686826d48a7c5d673742a8c0ac516f1294a9d654bffda6068770bf4f6681f27323cdc897d77e706e839eed8c6a17dfbdc77bf97fa1fd533de9898ce7f
-
SSDEEP
196608:8M3zyMDpv6JSS6eYKKWiVcBm1TCb89/SMYMyOZbMUO+GAqZUXwCeK/nKryvPUvMa:9jDpsSS3KOBm1TKU630MKGA5gtUKryXm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4a7efa9aadc1e2dcd057abcf795fe88b
Files
-
4a7efa9aadc1e2dcd057abcf795fe88b.exe windows:5 windows x86 arch:x86
31e12a831b1924711627fb5ec7ad437e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
recv
version
GetFileVersionInfoSizeW
winmm
timeGetTime
comctl32
ImageList_EndDrag
mpr
WNetCancelConnection2W
wininet
HttpOpenRequestW
psapi
EnumProcesses
userenv
LoadUserProfileW
kernel32
Process32NextW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
BeginPaint
MessageBoxA
gdi32
CreateSolidBrush
comdlg32
GetOpenFileNameW
advapi32
RegEnumValueW
shell32
SHGetMalloc
ole32
CoInitializeSecurity
oleaut32
GetActiveObject
Exports
Exports
Sections
.text Size: - Virtual size: 512KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.x30_p0 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.x30_p1 Size: 443KB - Virtual size: 443KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ