������-�1��M��H8&,����J� �C�!w�EY{����X���~��3��ۆ��'��V�Iۧ�ɍ�{�4��O�8g.��>�*�[���"��T;�nl%~��4��R��V[�m���t��Fv-+]kqE�a���!����z����hy�CL�-�-б|S�v`J����J�t>����<7��eD(�D/{~OOp�}�9S6Q���'u�-z�eh=��<�b���p�w�E�uey�c�v�������w�Wq3�dfܒ�0� a�/n-�[F�3n��&k���zL��ϕC�yW��b�N�XE�(�䭖�io՞��K���p\evk���#��Uş�F �����cQS?�+��D�>��������O>���P9.�j�ҝ 9 juȨ��N��^�i<� ޟ�e�^>��Q lVa��Sm�+����e���5�w�`��en!��Pp��ypH��Ҙs<���"�ˎ�f�[B���f+M�>�ػ��p����z ���vZ� �=AFT�jm>(?VX��� P��'�J�@�`A��_��'N��A�]@-����z�z��߹��4�R�[äP�n�W��L]�K�g9�5闠s0#.%;5�Q�t:+D�̯ٙw&e2<5���r�Y:��M�e��W���#;?�Υ��-۽���o��l6��K�5�s3��Á�K���@�Qcf|Q����d�F�lqÀ�w{��oB�%'8�g�i'Q�^j��;|@ۆ�� ZM&���s��:��n�[2�3�-�ן�^I��'4 ��c�� G���u���F�br���u��ŕ�Pq����&6<_���Mփ�,l�Z����*C��&qG�����+EM�b�%ξph@Y�f9�c�f�_���K��U:���?M�x3���i袛�*��� .rF� �@a0=U_GUO�Su�G����-I0ϕ�X����/@��M�ӫ��m�溘ڐ+��e�����UP�e,a�E��W����^M�NғӀ$�T�1Y�������1xa�P�xгճ�m�}��<LzXnq�.��.[����m*O������F�\�O�2uy�0R{��ށ�XU��(nB��f+��π j�z���E!e�y�38�k�$Į(Y3��R���;��N�SM3�������i���a�����&`8k8�^KM�Յ����^y ��; ;�+9fb�B(&�4��'s�z���(�đ���k;�!�� ܐ��K�a�����#�X(�i�4�\�<��YZvu����������&gR�W����TOE�/�췸�v��CK*+���LL~�L��0o�,����t�&+8-���9���%�ٗ�,+�Z_x��T���Ñ����+�̭�i�����v��"��ѐ����� +t�a��v>|N?����=�#��RO�kh3Q��W[ln�Z�UohX�����K�,�M�%I��x���;�v�w.�?\@��Z�qF�̚ug�WQ�3J�5ӳ��E�CO�P�+�93�� l���n) ���'Gb�-��%t;EVlLH5�"ϵ���<B/��ji�x�������1���VLP30u��������qل�CX%!��Qh0z���D9����t=H�����u-Hsfެҟ)�2˗>����w�CHXAa# �����ʰm[���ŎN#��G.`m8�]�I�Džu�Ɣj�D"����p��Y��6������Q��.9��)�vg�Z�0��!,p+�@S�2B�8�ꠁ��|��A�)U:�����������,��-����s Zh\� ��P�r���/�#l|��]���(�-�c�Y�>4�}����lk��5A)ʺj����z� ��$O�����>�����:��;Ho�����H~�E�z7^�0���uF��#ɷ�� �I������,+旃�q�����?�ܧ�ld祕]�<�4n�u�"ȌLx�%��c��Pej��3��i��>����h 2V����8L\�w�ȸ�x�ւd�R���|���M�)b^8��t�=�r��Am�?�*c1��(,~�����ӆ��h��;�0%��u�s��tX8����9��Ml�wi� ��u���{�~�����.�=U�3��x���RZ0�*e ���"�z�XO�I�m���ԁ�n�4�A������1���Mwk��ۘ��c��Tj�x^_��!���B62Ĭ��A�/�~�B�Y$�3;�Id࣊8'87n�p������ޟʱS(U��WEhl�oo�I�W�־MM%Y�ʾm�?��H}5��cDi����Ϟ�{�k]x�X�;�l_l� @�M%?��F�m�D-lbĒ��U����|=��ra�6JJWy���<���}a����P��I�?j�4���>*=���R��A\���:������3g����HԈg�z������J��X"�2�H���st^A<��پK̫>1'>�jWI챜�㧣ј ;��#���F?f���Q!��}�Gr~����b�O�P(�o��hK���ğTrH(�icx�Rb�����\��d�N���9mK��<}���EZ�0OÙ��8����nb���t�w��� Mw�{�\�a��>+bTJ��Ba�E�����4Z���;FLHꑝ�;��µ^��2�dZ�����D Kn+J�I^�b*�]�(U��~��i:��F7�Ѫ�y^+%�������)k�;��/Z�F��CU�!�$�a�7�U�v�r��_��*���o����8�Ŝ|�1����o_��rLPj�S�a|A��a\ATM�Wۑ��/;osgς��wp���ܞ�+~"s�u�hp�?���|O4u��RU�"3ZP����`X���X4>�9t���f�#n#�[F�[c�MqB�f+�jX�²���Hmag�k}�7Nqk�����w�r�;^��U�$(�rK�Q���G�9Ɍ�w��ʬ�3�R5%�)��9#��Nt����� ���R��Ni�64�@Cω�2A���k��hs�����)��:���$�U����zXTޣ�gkd�?��M���L�T�9����^���?� �Zp�-z�b!&�܅3���K�)
Static task
static1
Behavioral task
behavioral1
Sample
4e327bded196b9db93b9d48d5406735c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4e327bded196b9db93b9d48d5406735c.exe
Resource
win10v2004-20231215-en
General
-
Target
4e327bded196b9db93b9d48d5406735c.exe
-
Size
845KB
-
MD5
4e327bded196b9db93b9d48d5406735c
-
SHA1
9d1c609507daff2cb1fbeb2d6780109f5c7a6177
-
SHA256
ee43376d8b6dd5a3a230adac74fd08b406c1b04082fc752853aaac2da0773d58
-
SHA512
1ec4bd6a6038c9307609133cff8c571207ff4beef8370a026d098dce9c44f9fc70683e679a867a66e8baa1ed2bd57e64eedabc25cde265ba5edabff693f56243
-
SSDEEP
24576:Fc3oyO3ECZAoPu2VK/rYIfZ6bHSBwjFe:u4coP05fZ+y+jFe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4e327bded196b9db93b9d48d5406735c.exe
Files
-
4e327bded196b9db93b9d48d5406735c.exe.exe windows:4 windows x86 arch:x86
5181bbba85215ceef54e6420f144b69f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
FileTimeToDosDateTime
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadCursorA
advapi32
AdjustTokenPrivileges
oleaut32
SysReAllocStringLen
version
GetFileVersionInfoSizeA
gdi32
SetROP2
comctl32
ImageList_GetIconSize
shell32
SHGetSpecialFolderLocation
wininet
InternetReadFile
ws2_32
gethostbyname
winmm
waveInPrepareHeader
msvfw32
DrawDibClose
wsock32
WSACancelAsyncRequest
Exports
Exports
Sections
CODE Size: - Virtual size: 612KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 22KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 385KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 676KB - Virtual size: 676KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ