y�|���X�J�!������Y��xz71�Y�$�,{3���%�E��)[Fb�F��`�O���V���B�E#Ƿ�-�-�%�|�O�&E �P�����J�^�ѲK�f�vH�(��sgL:,F����˔d��̮�g�*m,1mg�4失Ƙz{+��@��G���#BD����6Vqa��f�ɪ*��Y�<��N� ��x!�E���1ɓ�����}b�$T�R�T��u@b;#�x�[�Q���O@�_��3�os!��\��t��F䛆L����"��_�:�Y29���*�t��Zd���k���r�eiـS��,j٩� y-4Ѳ�!������?�GR)G2�p�)��<�{z��O�362�_E����Ä��IT�t�����V�Ą�a(�MF[t�K5�����+n��n�kݸ�0g���L���2��3��(4[vxe�]�� Гf8�4ӅG��Ҕ��'����T+��Pn~<�Uj�J��ZC V,�w(�����\�$w�"��y.4�Q��6,�]]��L��T��ʙڜ⇓)��Q����:��|6�"}8�ԨH�so��SmV��L��7���n<EϒƲq<��*�Hhe��-d��U� "Yk/L3�.V�B�ҴY�.��Y`9i�����;�Ε Vܯ��E]Ph�sr��K����H~,�|>NzIKD@�V�4*�U�][h͒�����YHC4�N�7骆|��v th�)� ���t���=[Q���6���dgLg.�K�\�u�� �Cz�A���f�2��d������"�YͰ'|�3հ�h��~1��N�KR���mcx4�GGzb��QѴ���ۈ�ڄ�\��0Sa�}�(�+�r�3]r� Dޚ��wIjȇ:W��lr����'l��t� �#| z��]� �.]���)7����G��}���A��Y�|�����t��;Jw��U������ggbX@�g{�E�Ű����^�IP��� #l���6d���*�ك�_d���L|2,>?'�Ck�RR���� ,�F}j%��d*T��������R�P�nGK|�˸�@RhF �):FU�,H��]4��C�N�m��_�'��RT$-C%͎�����b!G[ݴ�0�<[���ٕ��Ҫu1hQ�tφ1�O@z�h+�9�o�I�7�";r9��E�61��^_�G�%�����6�����4h�$���hխ��I�eQ���#�u�:�"�-1G��-C�@RNT�~k�ʝ#y+��r�����fn/�=�GN�Ds�����g����H��1� &x-6bz��R�Vԑ ��#;���XϺ��I��5C?��*Q��䷳��V�(ו�[��h�����p���|��/t�ϋ��f�{g��.�T)��>nKL�HΑ\��Ma�ҦK�.�$AG˧��J��ib*�2z��1o��ޭ��i��N�S�*|T�L�����d��~U#c�M���-��р��3f���Ki����H�����]j��51Kɥ}�xFG4�_�u_�=�/����R<����<��I���˛��{D������@���~!��2g��R�!JU��!\1JGN$.;G��Fg'�P��b}0����M�k2���q���s��u��r"�!_�iG$J��0'��� ǖ��?�;N�ƐmH<�eNw�*k9����� x��_Y9�yev� ��(6pس�g����(_Jq�l�O"��$V�t��k�Q��Y�;/�� d��)��Ţ�P��9O ��D��~��S��U��I��V��U}4KAO���%��iL�C1����G�͟�s��n�В�@�F+ ����k5�FYŶ�%��c�0c3 1�r0ՆP[�7�Ti���� =���v2��kt�����2���}�Be�ʖ���|��>x�m�#^�뚳 ,U^��"eNSh�yC������ "��oh~��.�Լ�_�����^��p}�w�L-3wƍk��B.�&>�'S�1l�M�|�j���#]_W�FHC���(�pT��YLGe��yJA�������6��c<xm���׳���\�g��$Jk�P`�C��� ��Y� �X3N��zQ�l��#�E�٥���%�[HZ�H����#�o����{w|��&��@k�q{���;���� �2ܸLBS�{50���N�L������� �Հ���������B�jLE��E�) ���c�_��YתϠ��0 E��\�H�����Vgw7�>d�D��L|$��2�J�v���%b�k�aI�/��_�u�Ԭ��}k�ܠ�btx�����o�W6]Rt��o/�{՟���܃):�mV� �fjW��,j_�EsX,��79ܒ��^����R��3q(���)�3����v��͘��"UX2'�7Tר�ݎ]8���͏�pw�x��ps�Z���@���6��)����3�?�f�WEބq���&cV���۪G�Т6��Х�/�$Ӯ�_�>B##�f�$�.ɦ�����)�+ �z���z��dc�H�X,�?�|]�4��l;*�f����'��c{�!���n(��z��ـ*�=S�?��O�^�q�}�]���nm�@X�C�����&6��|wq��ܘ�o~�&�A�w4�r�0��ە}�=T�ϼ�$j�y!6���v�mp0#!]�VK ���9~�.T\m��!Q��R�.4��)���Q߬N�P�_�Џ;��T�$��ӭKđ>��G�Ƨ�@��g�]�����mB^�hA�=<&�|?-� �'��\� ��[�H�ke�� \ ��҈�� ���5��D�y}�&���5(xm���K�����m;[P;wЂ}���(�W=3j!��v���Zꄠ�: B�Vj|T�h�B�|�Myp�[��J��z��F6o�1Å�ic�~��e��A���L�^���X�L��u{��Xt���8U�Qt�O��8���K��aR�1 ���V~)�D�����~JV|nȲ�����(�j�(��a�{���/Ԡ���4d������2/X7-�������L ��P�V�qH=ө�_�L���w=!ׅ��F�_m�*hC{{�ܽA�Lɮw�e����Ϸ�cGxF�����}�I�?.�
Static task
static1
Behavioral task
behavioral1
Sample
685f99f2fb33a5cd7ff43948b3a7710a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
685f99f2fb33a5cd7ff43948b3a7710a.exe
Resource
win10v2004-20231222-en
General
-
Target
685f99f2fb33a5cd7ff43948b3a7710a
-
Size
626KB
-
MD5
685f99f2fb33a5cd7ff43948b3a7710a
-
SHA1
663ed8a92249b367666f508a25b80625f7c63522
-
SHA256
e6ddf7e0c3071171f9cd14cae15326a38e2a7a24781fdc115c33fcb178f33af8
-
SHA512
94568bebf1ad7d4f9dfd5392a532e7eefde004dfb559b87fd67e744cdf0028cfe3063bddd0891ef00dafcae3c7086dbb97bfbc0287ea33267682a4c8d78dbc1c
-
SSDEEP
12288:cJDJxfmErcgRCzmeJ/vA5HEIHY7X7fdZMOhbmeYE5kIcS9aQfAiETzn60J:cJzS8CzfJH50nYXn9a0G3P
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 685f99f2fb33a5cd7ff43948b3a7710a
Files
-
685f99f2fb33a5cd7ff43948b3a7710a.exe windows:5 windows x86 arch:x86
dedbc03c911d850b5a435eaccc4a237c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapCreate
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowRect
gdi32
GetRgnBox
advapi32
RegOpenKeyA
shell32
Shell_NotifyIconA
ole32
CreateILockBytesOnHGlobal
oleaut32
SystemTimeToVariantTime
msimg32
AlphaBlend
comctl32
InitCommonControlsEx
shlwapi
PathIsUNCA
oledlg
ord8
gdiplus
GdipFree
wininet
InternetGetLastResponseInfoA
winmm
sndPlaySoundA
oleacc
LresultFromObject
winspool.drv
DocumentPropertiesA
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 475KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text1 Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text0 Size: - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text2 Size: - Virtual size: 170KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text3 Size: 555KB - Virtual size: 555KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ