�� �����0��-���K.��/�Q?����V��>z��1b�<7u�u9��;�]ltc�7N:T�t��xW\��+g�x�������h7f(���c��B����?�RI�Tt�ܦ�C����BКS�f&1`s��j|��'�J���ߊ<�� r�Y��)�w�V�%J���Z�6�)䉏�������}��?��,�ǫ��� ����]�����Y�):u�{Y;b��e=U�!�e��C�,7��)��� ���7+! ���V4Y�����Hr�!��X�m����E�ef{y���9a%..E!�iq��WDY����?ͯgs�-�sH� ��+��/�/��� ��L�ы���gLJ����KZpA��>�nNX �^%������i��b=�����NuH�>^%�m9S�NQkL��S�I>�t<L �&����^65��D �k<8���c̓փ��������j���$I�^Y����.�üv��:<R~���NV��[�u��� W*a�u���%Ki·��^�ߒ�Ӌ4�DB ����{�p�*Q%���i�|��Pwqd&��ޓW���6p�iV)~Y(�gDJ�C��%W�HȂn�L+��Y�xd3�2Yx��Wifz] @�ra��4��H~!��$��2�a��&���7�+��4�[�bIK�{�1HE����W�N����q<_�O Cgc�9�i���m1��h�\����fͻe���\T� �R`�T�?����"���ꠙ��� �f(≫�����J�Z)��m��ɍ�}�HD�-/�C����h�j |�σ%s>KH�l��g=�Z����RY����|�N���d��ҺtI�k��c 玽�b��7I ��Kf%uvh����x��QE$�.kȦ�L_=A᰾5��ŭ4+C�)sf�Z��6�[��Ņ�.�W���fWȏ���D1�� ����1߱�� �K�̓`���%\�1���,�C���K��!�!05�����@�0��i�$&%@7���]}O2�b�+(�V��Ur�86�ԧh 5�����V��X�?q3u(3 �S��Z��g�$�֕������iPb|s��<�⽥��wۤ���A���=�hj�,so�]����g_c`�[���#5�[F��M�0͊�Go��������8����1�S�RmspIMuQ�1k�n� ��D��N/�]h!U'j�?i��!�B9��w#��x)t()l?�k����tv���5�"Y[�<$)�CZ�Z���FY}�^Wr�v{u�:0�#Q������^,3 ��J�|�pt�*H ��g������;sV��rM�-�T��6�O�k�Ȕ���i������>��pW��">���j���}��a>���bd���Նrw�r���0��2c�:7�;h��(n�K��n.O�>�8��Sك��9Jl:���1O�F�3����2�����J�W��V��J�=R��}Dg�=��J�/�Q��L�K���ԣ���q-�5�5�KS�F�ua1�-�6& �=B����d��c��Q��1�uK��[�iIU����yd�@Cի|y��+�g�&H��@�?��ؽp!�D\�I�1������,+K���zb��1�m���le����=�T�Gb�m�����0���\�(Àj{���.�t����|Ml-��%A]�ѝd`�&"��������P�GT[,��xk6&��_=+YHj�_i� ��F �Q�����R+��!Nm@�Mއ0�dP$�Ʒ�[��ܘ���g,��gd�'�6��jY��-_��Yd�b�ͺh5��ԚQ����d�j>'�T��۠�� ��%+�.�]���y�x,�U8I������6ݮ�eh���c5ōi�����]e���<�uǑ"�^��^�� ;O�[�2b�b��l�f��л�W�A/3MZ�a1P.M���)4А7���8�F�٪"��=ɭ�n��]Uq��飯����/�ub���U�D��a!T�? ��P$\$X}%�R����W���0��%��������%(�+� $��gj$/��A A����eG4��!���v/� t3�Z��%O��\���̉ᵀ��c����u�a�+�oI K8��+d��$]�.��-�݁�~��t��!�w�j�"���&��3{��뙒;���l)T��A�i�� ��"6'�ߊn#Y:��B��A?�H�E���@�B.+������-)�LM�� ��e0^�f{��F��h~:[��F~w_�� ���������V��d�7rsďN<g�U)ndƂg�g[M1�gZ|Ⱦq��4��ޭ���Y�3X��KΦ�GL�R"绱��v�`���Ͷ۰:�/�(B�+�6X�C4uV�>������,EA�!\���'���#�!s+ �-ͳ!��!.(WuTh��[�q?�)Sҡ�^[o �$*b}��c��(�i��1$q]��dK���%;�(c�UW��z�J�����Ul/ȳV�<���0�_Z���v Am��v�W�d%�i�߶}�gZud�|�Д/<�ԣ�@��H�Ov�GX������xc�2k��J�0 Y��$\�5��S ,|�+]W2�� �$t��0>�+?7NV�T�|��Bo�A���Hf��5������W��h<��x��<͵<��*bn`��"\<�������NN��eV�CM)A�A�k��Bz"��&�̫kv�d�Hi�A��]P+1f,2��>��j�"���oJ�� 2W7��4�h����'F�2�z����ׇ�>SDLA-"�3�+p#��C���?5������١�D�H�c�#��Ozy�ʻ�T�� ;HUG:q�k�ijfGץL����ʪ����|�ٵ�����'��9��%K�eՐ�t�p2wHB����6>�7�.��Xx��6/�ϼT�f��vw�h�Ճl�%s{^NF���[b���9�j��Ԡ3��d�-��$���"�3�՟��ǻA�,C����k��-U�����[/�v�N���ʩ� �X7l���r:@���"�}�32p�8Z#��8^�B���B��J&?��
Static task
static1
Behavioral task
behavioral1
Sample
5a993a09c6e73b996fdafa05cc3f8122.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5a993a09c6e73b996fdafa05cc3f8122.exe
Resource
win10v2004-20231222-en
General
-
Target
5a993a09c6e73b996fdafa05cc3f8122
-
Size
63KB
-
MD5
5a993a09c6e73b996fdafa05cc3f8122
-
SHA1
9bd4d9ed6916796b749806020ec99879bd507f4c
-
SHA256
7127dba998c2fc80e2e9fdea9cd271de4327bfee850c55145cf917c0dcea4843
-
SHA512
79b9047f5050690b74215e5069f75852d8e7f8d5166eee1f4bd01b14ca7f4638e85bc7bb4b0b68246ae3a95e2713528f43be305553715fa17ed32fbb5c45bf1d
-
SSDEEP
1536:93LAMoJxnqiAna+uNgflub3IueuGtnyX7dwMnSr1WTTwfz:RAMovcna+uNB3bGsXtSWT6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a993a09c6e73b996fdafa05cc3f8122
Files
-
5a993a09c6e73b996fdafa05cc3f8122.exe windows:4 windows x86 arch:x86
efb15bd0be8fad956444fb0c177c9349
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCurrentThreadId
GetLastError
ExitProcess
WriteFile
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
GetCommandLineA
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
GetModuleFileNameA
FreeLibrary
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
lstrcmpiA
_lcreat
VirtualProtect
VirtualFree
VirtualAlloc
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
CreateFileA
CloseHandle
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
CharNextA
MessageBoxA
oleaut32
SysFreeString
SysReAllocStringLen
Exports
Exports
Sections
CODE Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
1 Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE