��o�qӰҶ K2j�L ��(�r�����PFZ�Je�0>�31�Cv��E�N���T@��k�jN���� �n�T��B��_{_��܁F�V vHc�z�S�hf��ف:���G��P;�)�ѼO��p;��G��:-l�x�Ј�x��O�`��<�)�>��]\-����� �gǀ�D�=,���Or*�G���a�J ���b-i�]��;�/�fhR�,�ܑ ��my9�l٫c(o���m��Z���yF쨐b�.4fOl�m�3�6K]%v��[е���R ��s�qN��+#c}[7gK����3�'bk>������ }7�y�d�-{y@�Ķ��Oc�P���]�hB�M����L��z��^MX�m#���z}y��B8[�Y�&�����ҡ���e�,�ޚ��Q�71�� �D���a����۠x��P�P���K��"3��D���.��M�?�@.q�1!�X��Q-��f�&JHw���SП%��W;��+�\�}�%)����%�+��lኮD�`��m����=T\��}�˳��[� �`ȳY#���Ԅ���ҁ�� �s3;*���&4//��a�0�6������|9�-��٠�x=�4˜�\jf5u$ё�%�����ҿ�v/nк�hr/��������4�,5�fB�n?7��Sh�͙aʝZAB�#����2�$��_}����Fg���_�rſ0Ѣ����°��0������U�������{{<{D���:�Ȃy�ɷ-�*��K�W_�[��i��]��Oq�[��va��[�����@/ZG��/i��w�4/7�[���/��E;6ň-1;rx�"�k:��&�oa¸�:�ޭ4�/����"fX�������~��!7q7¡��l�cv�c��f�D3�d1���+� �O���h�����9މ�X��y��� ��t?�"f��<A�1.�I3��5狖�6xV�~���{"~k1˅� �4��(�B����� �6�� ��q"�)��b�a����c�����{�A�So��@�7�u5�+�~h 2��$-g M�++N�J]���͡z��-�인������i��j�3�S��l�����Z�"3�<��q����F���|�� o7������G�%v� ��pXc)�w]/�UFO�gy'r����z��ߋ=#�J������E���)\���4�h �%#� �Q����-4_���J����1D��s���f��qT��tH���㊌Je�E�t��?�Yĉ�E�U� JkK�T�����؎ntc2j�7�Z=>�Q[f��X)=Q��.[jE���a���"-<����`�A6��](�7�2�>w��'�ci�h��8�6�N&����?^4S� g����J˾�-��OԽ,,�o|����@O3cӤ����B���'v�����!�~T�8ƫO�����C.����9 ջ�k[���m:[N?�#��'�3��t9�_,��i�L�R�n��� ��������G�&��!�����YD���+s��3z��hmk��r�/�W��Y��~����r$�e�qN4��������:��CmE@D��xx;��!"�pO��Q�'��� 2��Nl+�R9�#D��.�]� ��}m�3[+f�U�n�1���t(�1L��D>���Z��V�g�(�D����^^<��!m�ҠM���~(�F��o�}���p<�`����h �|��� �4h�y �-�<PR���B�I�_�9ב�x"ci��e����ֿu'=�UkC�39���]�U���3xU��@�ݺT_G��z��PD=��B��h�%� ��1���R��k��=�9S�Td6x��ä/�C����-�.���VP����s���M��;Cٲ��g;����z���~D��^�aG�>F��x.m�9M��Ə2q)�`,Oj�w *dn�P�n��ZZo����J�RK>��`3Q*��� �xd^��Q��x�vW+Ö�ڌ�dr��/��7*�~ e-�~g�^������Mj!��L�6�)�����"e]�{�=�1��M|����,��I���WC�u�4���+`*�-�3��t��4!��P�8-�l�Zs'EV)��f���|a�����Ta ��S�e��q��Hh�8�/4��u Rb�g���cP���5�9�b�憝E�;�i=��۔�~�V�k�$�r|����<��E�� � g`��å� ��S2�iE~5�;�8�#��D|_�m�V��1{� #��f+��aٮZS��_�َ��2�j��ND�BS�����Y�}B�%i.��Ŗ4���Y1d��rA��6\3e3�)ng�q2�J�ٛ&���f��͛�G�T�1c�q���<_��'ג�OO���?' s��pp@Е�C'���~�[x��%g,��ç�`�iVz�ӆ�8���߸��ܼ7͠ ��O�XJ�a�*�Y�<}gD��U!��%҂%�fh�-,���4��L�眠�;#M��%��md�!M��4c_ϋ)�]�K�O��:�j��K�y�Q}���^0:^J��n{�8G��4]�����^=oP:Y�5�(o������c����ʂ�U�i1�*"5��e8��~�������)�s`�V�&4��oq��\4^����XF��Jy��ނj�����>as��l�V��� ͐�{���'p�#���#B�=��7ϐ~�_E��\�쾀 K�h����3���>��&��^�,+���v/ƭ�"���??��B���Ć���6���Z�5��<��#ī�4�r0����<Y���-�ܩg������(�I��f���Pܷz�K?�������̥�C�ǎ�:J�j1E�5I�lN�z5v,q�sY:| �� ?_��i�H&�P����Ah�SВ�,��k"��;P�.T�����GŞ˔�K4� �C�"�4{/��#�p��cz��� |[>L��+�8\9wUX��%��'����)�'�0B�����-U�q�v<�E�����$�������=�]�
Static task
static1
Behavioral task
behavioral1
Sample
4dfe7b7a37dba8f95d86ca528e78a230.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4dfe7b7a37dba8f95d86ca528e78a230.exe
Resource
win10v2004-20231222-en
General
-
Target
4dfe7b7a37dba8f95d86ca528e78a230
-
Size
2.3MB
-
MD5
4dfe7b7a37dba8f95d86ca528e78a230
-
SHA1
c3c32f8af2fd4c86f70b56b5f038dc171fb9ba03
-
SHA256
78f9e35c3f53e4e165e80f22b0f68da5e23392c80b7c18478bc410b05b63969b
-
SHA512
9d19119d6b45ac1d779653463fa528f43f09880b5e5a9aa4b4d91372df6de31347bdb817110072a2d758a764b2f9adcd6f3103132d69ea154bcf33a3614d2ee7
-
SSDEEP
49152:W6Ze467daGfTm/nGVFk4hYxk6ggaIQOttyycQcnl:W6JMpmKFk4huk6WIPt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4dfe7b7a37dba8f95d86ca528e78a230
Files
-
4dfe7b7a37dba8f95d86ca528e78a230.exe windows:4 windows x86 arch:x86
976cd775e6a5ddeba4dbd4b42b5d2057
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaOnError
kernel32
ReadFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE