K>���@������Ĭ�!���9T���j�����W��>Ϯ�3�Ha#Ż�����d��>�m�sznC���ɐ��R�� � ] %r�`/���6L!il�+>�� �h���Һ��H�ٲ��x�H�HW�<%������G%��Zy��Bk掤V��&G%G6=��OT�i����e��;��`#R��_��e�I�����DÉ��Вe�y\�B����",�Ø�F���,'F'���s�3#�y%���1Ga x�|�2��\���)YT|�z����h��+ le�:_)ܜ봰#�qL4��7��g��"Ң�/�ߵ�g��$���O�( &$�x6� �ڰ^��'����Y���ٕf���͔��_ �<Ղ�O8�E�P�g<�AP~[]�[_�wx�����ΔƎJ�M�}�\b1 d�{��1-GX����� C@�:��m�m���x=U �d'�f:2�s��}OPo�%!vtc89�bL�F�~P��1 :��m�t���A2�[�t����e}��#�����Ʋ�OoN���2�����%�l��`�=�*!$+�yv��{7hřQ�HR��`5A�l�z���)]#� ���{�:�,�{��H�i*֠%��&p�5����3��D!d�8/ ��]��<�SZn���������y��`�����}�F�c��0���f8=��a�W벪���}�l�Y�����BA�|Փ�d���`��}�t��d�`�DLi!�b��"5h\,�#:���}�k�� C g����-�n�~��V~��R���/��9<�&��9l��m�{F��Լ�5��}�]ȉ!L���X�f��3�ΚP�#k\c�l����[(�qa̅WX�� iH �(�6P�V5�ةz�6�䬙���l�ʈ��r����őx�<+�h��������_D ���#�����rop��i��f�H��.Y�%���_�����L-��@��f|��7���%�pD�ꂂߐ~,�A�pIU��K�5(SNҟo�S>3j�D�^^Q�������� ��(�>Y��,�)�V'�^+�U�?6z�P��l�)َ tM���#�q���}�Iy�q� g�%U��U�2��q����|�D����/�3��1+�%q�7�ݱ��/�|�6�p��f6�zz%����Ò���T�:�rY/w�F�+W�~ʌ���,A�{\l۵�r�/���t���zI[ ��Q����`7� ���ĠYErSf#�-�|e��fP6��?b�@҄�k���!\]ܞR�:�7��Z��mB��\ؿ^���~�m��5��y�s�肉����e ��B�5�7�f!�% ����������`�d!\�l���[�cI�k-�����y��e���q"��7�_m��-&��v�{r:�EiDUt5�����ΕE;u�U�+�.�(�UD�Z#��~��F��YK�� A��_Wv���(�V<�a��ƪ��+Έ���(,����+-����yd=]H�:1�T��g�(<����������t5[���Þ���8ڊ-�t�m d���DQ΅S�/�I���2�NH��*�Z2�tX'6�z��r�<��*�n®���YV��j3Sx=:<FeK�����)�R��� |b�?�wz��B���K�`���_ǻ�Ir���e'uuk���NV�"πq,�}0��5!x���6��OOP���k���ʡ ̲����s�1�8kU�#�@ڌ��~/fD�HҹU��ee��d��ro���j�Of32{�:��|������MQI[1�d������������z�A����L����0�t -��[�a-vG��bh�b#th�³��*:g�0�xKd ���M|4,�lHw?�V���Iii�I�d� )O��MՋZO�SQ2 ���أR�Of�g�����A"���C����b4LȬ�]�>o(Z��J��� �bI?� �sI ����AJZ��٣�]. 8H�nl�/S�.?�}>{-��̑�-�q�<;3A��Ld�;l�����}�����Svm������H�jY��UqA��s����/944ri7�G�su��v��^��6�pRvT�~,N(W%&Ҩ0(�/�b˗�[>��}ED�yW��a7�2��8dE��`q~ uh.H9 E��x� |��ݭ��;}w�j��.��4y�UH�1U�&��3�9�b~t�w��/��Љ��|X>>��/j����7���Fcr��9�T�tC�ԉ���������y��ez:�^/+�(˟��K���u� ��) ��~�}e�9I���<��:�����?�5���"�(��!h~0���%Z<j�/�+_�^D��;xu�XII��U����!F,�_B����<��q�Q#�#n�D�w�fWˀ��=L� ����E�w�!�R���N�i�9��y�u��_ʏͰ��+��#����c��n�o�K�}K���*�J��Q��A{Dg�W�3;v��be��bܜ�����l�UR�k�qB3s��ܶ@������:|�-Ǘ�0��t1*� �`�����Xlr�QV�,3*� jW�j�݁v#�I�N{]=�C����2���d4�r%}�0V{�˒[Iĩv���E%��I��82]#���x�(��(���~���v��_���Fd��TM���5�ic;�Ʌ���J<��5#��|wb�%� ���Rƌ�Rf7UڧIl���mY7��m��&�ce��{����de���m��@�ܤΨ�co�g��4 �����]���Ŭ��N������D��[p-���,�!K7�\��)����_0���"(nyv]Q�z"�ix6�Y�PD�����LC�̇�)Ƥ�_�\!x�d sC]�r�O�����v�$�U>���7�T��ΰ`i�|E���Y�䬾�b�f�fvZ�9��x��H���Ū�R%�ca�*�II�!?r4R�����6�䀭���I-6ߣJ+�M�^"�'(�}W�8g����u�M_<�`O��Ԓ%�#8���tI�u E�^�.�$�WD�VO(5��ޠz�g�"�С=���H8ć���a�
Static task
static1
Behavioral task
behavioral1
Sample
30cd66a95bf144b9682f85276c322c487493712cad3019c42162c1d712e325fc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
30cd66a95bf144b9682f85276c322c487493712cad3019c42162c1d712e325fc.exe
Resource
win10v2004-20231215-en
General
-
Target
30cd66a95bf144b9682f85276c322c487493712cad3019c42162c1d712e325fc
-
Size
11.0MB
-
MD5
eac345249b6c59013214f4e7ee902371
-
SHA1
1a09742f9d8e42d4020d1987609cb59af23cc954
-
SHA256
30cd66a95bf144b9682f85276c322c487493712cad3019c42162c1d712e325fc
-
SHA512
49f81d3101c1550cb844de8a42b8cae567c6fc73a09b1c343a70eb50f19cb6fcd5accda62997ae63eed349852e29f06a16f200698dce725406347f768c252153
-
SSDEEP
196608:5vCSJmzmfre504UBwRK0YyA5RSqsZ26BDr9v6WovTj2LrD6oaJSpNtOlfFeiWxC8:5vCSRfreW4UaR3Y0qszX9ATjArDvaIpB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30cd66a95bf144b9682f85276c322c487493712cad3019c42162c1d712e325fc
Files
-
30cd66a95bf144b9682f85276c322c487493712cad3019c42162c1d712e325fc.exe windows:5 windows x86 arch:x86
f3ecde41906ca99dd9dac00edcd72f52
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CreatePopupMenu
gdi32
RemoveFontMemResourceEx
comdlg32
GetSaveFileNameA
advapi32
LookupPrivilegeValueW
shell32
SHGetSpecialFolderPathA
ole32
IIDFromString
oleaut32
SysFreeString
ws2_32
WSAGetLastError
iphlpapi
GetAdaptersAddresses
shlwapi
StrCmpIW
psapi
GetProcessImageFileNameA
imm32
ImmGetContext
gdiplus
GdipFree
usp10
ScriptItemize
Exports
Exports
Sections
.text Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 483KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 254KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 13B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tmd0 Size: - Virtual size: 9.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tmd1 Size: 11.0MB - Virtual size: 11.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ