ʖ�����uvO��m?��vq��K��ʸx���}�a�J���2*��/֟�d)��P���s��2/V�FK ���<��:�ό\F�h������Y:T{�/�v�^+��/1{J7�/7�\G�(������gn�x��^��'Y�Һ��zr���E�EӍ࣪�,��0SX�`���M@>�X�~��p&���%y�m �%��Fq"�Ɗj�q����fM��br����?Ï4$!N�]�lj��p8�/��eu*Ǻ�F�a5���`�u�]�Ba`#�P�]ߤ����� �IIy�p{Ќ���GFh��H����Ò���t��>���o�. =aA:C�6�S������3�N���u�A���~����VgTnݵИB�����tM,A���(&d@��+��f�J� ;�0��w+e�ט�<;� pTP<��R:~�%����ȳ��<g��ŏ��d�&�4,��d��u{w��2�� +���p�5)%�Q�AL�B�ϽC��*뱂����|{װ/k�w��ߤz/S���.�+j�� :��F?c�Z|���u)Z1<���)A�ۊ`��ބ�-�9l�F�}�̨�����l�� 4�m9Q�����\��%�.�����j2�N�j.���dT��#����0�A��x.�,/��ti:R���)&�w�|����q�����_�D���>Kh�="ա��n܌cfE>�2�aH�I��*#<���_A �-"{��D������2zK��8��ilRZ��TX9���v����O�~?HR��8��<E}��oa������өB��'upe�Ժ��h%���� _��^|X�1��"������4�;Pr�4�\|��Ḟ�����v�!��#���Ӯ�_nɋ\ ���c4϶闅8A���)���v��Ȅ�TE����{����8ĞU�}�|n�=�J�z�b�B�Y�:��TN�i�Ą�u��B'�Nu��Xs�*�m��d�aO��S���$o˟3o!7��W�j�:�Cb��L�Ī��OD~{n���i����bIR��;��80���Nآf�X$1����p���;]e��X���Ω����'_ӱ�gfIFE��>2��3����i�i�-�51� �����g�x�5�2v�`i9�0_�����A�rA~�6r~��&;�ş��<�̀N_��,��5�����P�([&�A�;t��o���gM:c�H����V�m�6����.Q土�I��@` CbʜBwA��_�����+�Ф�9��W�<3������҇c�U�쟩q7��R��VU͗"]�$��\`tD;>�����gRw��ߧ� x��`��P��#��a\������\� �Ϫc�_����5�xd=|8T���MxR=�)�D�������|u�L���Hz��i#�c͆�i�{��;o�ހL�ۆ^e��j�ю��I�D9f)s�`�!�X�-]wui���B�S����t��@������?������ �j��×�;������@���5�=����ړPˈ%JX�����Q���A03���%l��|�p1hOF��d�p���f~�T��T��]��}�5�����;�`���1`�!@�o2�m�p�p��LB�X>��j-���ז�꫶��u�o,!ZP$o���A.�jr�{4��yP��� v҉�,�MraΔ�i�+��3p������D�1g���#�E���m��h<���na���W�-b�j] � e'���8���ڰ��D��<l�,l�_US�Nw�&ݮpؘ�.��������'��f�DU����ժ&��d3U�08�*��m�i6.N�����V�d[���-D�U�8�9����l*ɹ+Z�q��AK�!Q��T����6���x�����g������h'Q�ƳFc���/��P~'�0�(�������{�d8v4?g���1�E�ӫX�c?�B�A(�� Uvf<\�z�^RBWOR f�-%�n����ok U�O B�587@xhZ`�ۜ���|>(,6o)Zf�rt�Wp]3O��+�g�Ӈ�1���!;�����/jt"�]8����#[�筰V�n������ꓴt<���N��ZOd�El���F���أ����D�"'�1�Lxa�WLx��Ͷw^�=Ɖ٬��yDyi ���>���3�Ԉ���%r�|������s����-�p���v~�+��~d�Z������Q�tK�'_t9�>j!�n�:i�>I&��+|lж��S� ��:pr}u�"m[�C�"�3�������Z����D���`��B�B���e��ڝg����x��U��<��g����~f�~���k���'�,q�� gJ�yUc��hY<dd�����}� ~���ˆ~�h�fU_�3����B��i�[a�/`��Y����Ģ�q�G�I^Uc�j-�_��I��Ĺ�ڔ�^�G#+�#/�~���yG��0{����̨��Vc(��� �9Ocݵ�U��Y!x��JD3���]���Ɓ{��"(f\�PRH����n㺼�5�m�k��!h��Ӷ0�j�&�dR*;=~£W\Db��t�g6��SGǬP�?&ɔ��l���V\ ��G[p��+��oYf.�f+������AK�Lob���4�1@M۞&��U��o"�ٗ�� mx��q�"T��3�͌�{\z~.'�n��)vN�u��!p�pw�W�jj�o��um�xE�h��u��/��qUI�bkH�0'�����f�,����������%��3�uڐ-I1ԦXs`������ТMo�[��� �z_��";��"vpc<Ӷ�J F~�4=�tpeqa�4����VC���W�~���d7���!�6������j�7��u��qz}G��O�4�l `��s�4A86�%��@��^r������7�kr�������pYl������~�]��.�;j�<��AXʹ���o��L&Q����ij�JVy��>�BA�D0�e����Ea��lҭ���(lE��e�+�n�_�!D�h�/�����I�w�i��CBK������Q0z?�N]��D���#z�F��}��e���;Ҥ��Q��~��zG���Y
Static task
static1
Behavioral task
behavioral1
Sample
70bafd5faede6a7e23b7f770c30c3d95.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
70bafd5faede6a7e23b7f770c30c3d95.exe
Resource
win10v2004-20231222-en
General
-
Target
70bafd5faede6a7e23b7f770c30c3d95
-
Size
17.2MB
-
MD5
70bafd5faede6a7e23b7f770c30c3d95
-
SHA1
10801faeaa607f2b98341fe1bb80971d0f8e26fa
-
SHA256
7db44e30d78e047b6197de8fc5b2031224f6b9b38a01a07f8e18df1c787f52a9
-
SHA512
f9992ae394b7806a8108f17e257c53aa15bf8ca186bc54452da1997e5fc73854b9874ed4e0ed0d226b62579b22bed09c5971d6f07bee5e6eed6a6726ac756ae7
-
SSDEEP
393216:GMJv1hrPS66nHf55bJBAYPOFXto95/MGZAEqtI9PBzpB:GWvLrq66n/55b3OFqHBAEqGFpB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 70bafd5faede6a7e23b7f770c30c3d95
Files
-
70bafd5faede6a7e23b7f770c30c3d95.exe windows:6 windows x86 arch:x86
65a83bddf5da4fd0bf6c323df9a0acf4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteCriticalSection
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DispatchMessageA
CharUpperBuffW
gdi32
SetBkColor
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
winhttp
WinHttpSetTimeouts
shlwapi
PathFileExistsA
urlmon
URLDownloadToFileA
rstrtmgr
RmEndSession
Exports
Exports
Sections
.text Size: - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT0 Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT1 Size: 15.4MB - Virtual size: 15.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ