\�&{s�q��|��JhYޱZYV^?��~NV�"���S9��be�f<(��{�q�19�Kh�'P-�Ϋ t,��qdcF��M슇Uo:{����9+�1 � �˅����"�Aw?#�(�qZ�)���h�^����@%�U{ހ �4�(�� �ܱ�km�4�e}���l7���~���� &d���i{�(�^#h����W��U��ZsF�,T��D�d���g��3)J=�0Ƶ䍋~h����w"9�l�"���$�p�յ��C�P���'�r��K�1�/��LĒKFE�\��]��hNe�ˈ�����:��e��/K/P�V�oo��5W����XM���ue�<���i������?5)'w��g�lO�T��?}0��$��K/�Pe�������Α(D��'�jX�}K�fb͂�:3����t��Pj������_��ƦM�+��;��/�7hyL5p/�F���3�1�����D�����"��ԓ������CH��݄Wd���G�9�Uq C��b�4Ó5��g6�f��(Ι�o��6���q�F���)�>3�����_tS���/�*�E=T�In �TK c7lD�O����lo.����2��kp^D淸����9��ʎS��Hi����#Z1�ʮ�[��*���A.��Ij��/ߡ��)~�7=yU�Vz���n�E��?�*B�Bs���x�nQn�QSr������ �7���0)���U���Z"���Z@>{�#Yc�G��F���^�Cq�e>��g!)�\��v�2�`8`O_����<���O�ZS����D���̓�T��'t���\��%� `D�?���6������u�@G����{Ny�b=eF<��.�����P"�\�Ւ�<��[҇��p���"��׆����>۹��>@�!��q��y|p, �T����ݟ���>�?�'Z5���iy������q�@�p�ja�7-zZ�=T���J��Y�z{�:aȦ�'�1a��ܖ��7�(o��"@i������ �/�SKD�k�O�#lX��d�MT]ã��r����|:����U���ro��г�\�w���*��L��q=�u�� 5eȴ||��~m'�S�]��d䔽�����'����{X��^�1� S#&��ٽ���-h�<���0���^E���-A�>:kHO�����$P��⚺58G��j^Ѱ��歅I�z���nf��jo����{���l��,�b;A.9�k�iV��ǐ��'�lnsGd�u^��35���?������+a�W���v��֪Uџv�^�� ��\��������q�U�&���Y�+��S����~F��z��:�_@�>4 �!b2ש�����_g��{���n3���ZyD�j!�s-�6F�j���tLr���[��\�������]�s)���I���qops: ��{w�;�ӓ0,�1.��˓=ފW��6_��#��g����R�nF�O��N(��AOhp���쟞�(��lޤg,q�a%��B��\�/����_�&�w�;�E=+`�(��ɤ��*3�@!��4+&�����*(�Hu��j����3]���c��A���a������8A���+f�>��mՖ?��y�pygWY�yh��YJ���*$;5��&-�|_Y���pw�ɥ6y���-��#Y.�6�n� 8�'����p=�H3!�/Nz��v�@����� 7�`QM�6@6�!N���A��ʩ�E�[^}>H�^�q&���`I��������@�c�<��, -*�b�CG;�MB�~�͌ͱT��1���D����������}��45���k��4��Jۮ�}��3�ya��Ɓ�� J��6O|��� 3���#7 �/�� �)3^��ג+zZs��ch��; �k�,�o}#�YX�xK��7�]�g>�/��>��͓����9��3������¾ ���1���zx{P�XW�j�O���z7T��])�x?L�rYR�M#X��y1�۠�%�J>4뫺����b��{q�q�I��܋��Kx�S����J�ךؐE��I��\!�%�A��ז'B��Z �c �|�$?���t�$]"{�2"�^Z�ĕZ0;���qL�'�C��]i禋>�P��ix3{��2���I��Qm�a����ݭX�CC��R�� ǝ_���V�4��NWN0:�������j�i�r/�s��'�HC�"��U�� )�E�]-���z ��6�(f����KG3� ?�d��хu1y���9bġ���+�Xb�]��9Z�k��0� � [_溓崪O�J�'� P}���W��#:�5Λ��s���8>�B':�G{p�2ʐ�c�w�TL����$�<�ۺ �rRD�bUO��� �����z�<��(��8oF��������l���w�r-�6b��,5ɛɊ���߇�� �f|=����$)��X'����`'���ط����U�G=&�U�*|�b6=$Y>\$��ˆ����v(��䔲��j2,/������K73����d�Q��Q��/-�z���4!|g�V9GB���#���b�A������{����.��u�d�P'�SW���BˎE/�.����n�]����_��������#��\�%G��� g�B��v=1�_+����<�"��Q0��C���n�8���"fֱ�|�������v\>ە����7yBZ��'7����:�u��������x��_��{ѧ�J��.�nZ�ާob��������/�+/��V �5�-��;&��E��v�x��S���L��ڍ_��yIM�����h��ا�� hw�Z1��1.��� �)�*�Eا � J�{Om� �L���&өzP5g��oH�qR�R��9��=$���dIڕ�B�`��<D��4`�dR�h���Řg�3<�����A��?�u����8���Y�0���n�� `*�B��1*�8��p��-��*�PN�Z��H�nT.V�8V��r d�K �c t�t�12��-�U&a\��O\O�W��G��Z�T�D2R��#�T�
Static task
static1
Behavioral task
behavioral1
Sample
e59e2344bb5f2e9a8f4e69247d20cb6501687a0d6b85ef89571b8082f4a3801a.exe
Resource
win7-20231129-en
General
-
Target
e59e2344bb5f2e9a8f4e69247d20cb6501687a0d6b85ef89571b8082f4a3801a
-
Size
4.3MB
-
MD5
e69f75c4add5562c23c24e8b199b4d25
-
SHA1
569a6e7f4f4595653bc1bf7e93b1d2c358b0ef77
-
SHA256
e59e2344bb5f2e9a8f4e69247d20cb6501687a0d6b85ef89571b8082f4a3801a
-
SHA512
ad9062028c9de45a17e0138bda92992048dba232a5e165c64060a99715a29fa96c3c3c0b4ebb7eed4fea6eea3a3483516f9f2516a9325b9c4e2e2dc022770d29
-
SSDEEP
98304:CLSs9c4yYZIVSEa02Qh/dgrGz4tuMPBRwJkWuO1RGOjYc4+kulZ:w9crVSEu2dgrztuMPjSWOP6KlZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e59e2344bb5f2e9a8f4e69247d20cb6501687a0d6b85ef89571b8082f4a3801a
Files
-
e59e2344bb5f2e9a8f4e69247d20cb6501687a0d6b85ef89571b8082f4a3801a.exe windows:5 windows x86 arch:x86
2bccb541d4e626d779623bc6779f2e8d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
GetFileType
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PtInRect
shell32
ShellExecuteW
ws2_32
closesocket
shlwapi
PathIsDirectoryW
ole32
OleUninitialize
atl
ord47
gdi32
ExtTextOutA
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyExA
comctl32
ord17
oledlg
ord8
oleaut32
VariantCopy
Exports
Exports
Sections
.text Size: - Virtual size: 287KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata0 Size: - Virtual size: 716KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata1 Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE