u���� s������a��J5jd"mD<��Jm���m��n\���b�����ů�Dk��6��c~强(+҂a�B����h�"�a/���7������fD!��^L��E�� F���Obzb|��b�x8G ?:��k40_O����s��4�{:��( &��DU0*��M���H���vcI��05SD�x +ͦ�2�c����w�B� �٧�������ۙ�9�%iN��o�k�Vud�� .��[�����t����|���L}�h�$؎a���K?Yz`������EI��BO�"X̄����PSwٞ��?%vo��B <Ӎ��E7�ҿ�48���m�%U��:��up������-ED}����� {h�О�N ���CЉ��b��eE͎[��X�C��~X�fhg� J���a��|@�,���4|�p7�jdp�A�m� X��C�*� =����1�����}�c�F_��s�OH�fC�!��-�j�R���0N�o�`�s�p�Pu[a���r[*�Q����(b���d@1X$��Aq���Wmw��V�ճ�V�VS�������±������噅� <H��X��T'9ۄ�juƼ��HT���z�%�N�B�T�ʪe�1 Yl)�N]�^��C�3�)��g����V���*?e���n�]a$�&����P�!6Ըf@��$�^dϪ�K�7�/���ڭ�@��IhIg��d2��D�$t�.~�\O\���U.�^�Hz�f��MH���JF���� ����ܳs�h3q�Ҽ�0z�� {�� ����p���?���1��B>�Wo����}��[g\n�"c�$�^M���}�GB�j1��BŸv�P,����!����N̪�hv"�j�pu��� |��i���7�(ti>��#�8�u�a=�%�����[q�En1�R�YQ4�5t� E� ��|�����ъ�$6�- ���+ ��'�����F)�xL�7�6�<�3m̚L@��.�K Nѝ����'6 �A��^�{Il��R�/և�9�d�1g��{Ⰱ:�&Bz[?�1jΖ�l�&b� Kc~��!�㴐vfO ��]�����Z!PL*H"E* �6m�7���#=Xfdt>�p*�Z����v�H�^@��]���lV(_�e��� fh����j����gD���o���6��aɽ��%)�e/�ƣ��Z��,� ͼ�E�:0�k�p�~��ع&Tm���Bz�/�C5��D �[���(����(v:�$�@8��l�)����f�LUp;����N�=�����gL�<� qm@q 6:�ql�D���l�n�+��;���t $������b�s���fI���2�\{f�j���$cJ�q�3K��Sh s���H2�j;#�`�7oJñ�q���1/��|\����N��� y�K�6a�����T҆M��2L�&�u�l��t�+A����^��FVTs��ʾm��s�E��������㻾v�m��^�K�ZN�vA�ė�˖O����!3;��oR�a?�:�x���Tإ�l33.���\��;���K=xO�+�t�qH�w�tY%#��W��#o�5�c2�H��bŅv �:���m���<�-�v�70�����I��|0"L�?��N�c ���8 ?��5! �\��<�*W�;�@��`�āXz(f��W�2�?C�*I�7\�l>���(�'B�=�sC_��wA߇��O"?�k �2K����ʲ��F�e�Qp 0jb�����T��\�7 m�=l�A�G���������2�sW�ڤ%F��lF�����f�m�;׃}����䪞m��DS��� �G{k�Uk'O�^S���`hHf�n����,�0�^�3�����4M7�S�?�/6!�Bµ�g? ��n��Râ"tr*ˡ�+t�Vd�d�����IT����#(G!���7.+q�*E� :v�y�C�-:l <��]-[ȋ�R]����ջA��2췤/#���UKk�0���0#��c@Y����<1Gn:���z��ɪo�)a`H�Γ��������us�/z,D���ж�.�i ���x�-Iݭ��"�b�!�����twA���S������^�&pj54�$���A* �A��ɔ+(�[ u�k�s�ZAc3�=R+�S���pU�a��1���0�G�����s�u\���FY�����.Pj�oK�HM[�x*�*���=ѬO��c��w��A��P�/�.;� FI�c|�tX���B�+!K�^t���VFm}�e,U��E���,U!!?����"yH��c�n�� ����o��A#�3�n�����-�$>6bź�7�Z�HU`�{RTv[!p>�F����vR�%��N����O��� �:(���y��Z�{��o����*�9=�'��`�*}7�x�����Ƌjq���i�i�,_ ��Nz��-|?L2���^h] �:Ssjw�����Y!�Z�fI��W���q����3n��k=�lj�a�@���ߐ�eV:�"���u0h����o]�j|����2!�Е�����bƍ���y�t�m�����.7fZV>3�:<��Yx0���h����%B�H��Ԭy �,��1���\���O&$��o�x�`�`m�%� N�D��{�>�K�s�O;�U��uc�>�%�Hvd�QH�RJ�Q�I�BV�{M]����0�D��J}|Ku�|"��8�I|����2�;\YZ �cXZيߊu��U<��}X�u*��۰���n����J�'&�=���)Ͳ�j���8�6�ƭ��������%O�"�Q�O�]B�� ���Pdb�繁��c@O^C���涬�eȒ���o�;��~��ŋN�X��r�g�2��d�>5�ڭ�����C4� B�qp����m�ѩ4��D�;����h�u������g��"4A�6h�'�{��XY={�� =��y�-���6M6JCe�,�k�����H+��Q�ntP�w�=� B
Behavioral task
behavioral1
Sample
728d358a296afe5e40d8e76a4613466a.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
728d358a296afe5e40d8e76a4613466a.exe
Resource
win10v2004-20231215-en
General
-
Target
728d358a296afe5e40d8e76a4613466a
-
Size
348KB
-
MD5
728d358a296afe5e40d8e76a4613466a
-
SHA1
cf2052e30ae2fab11606ef96b320800932702b92
-
SHA256
db787bf62c9220f0853047be2de9e38a63ecc2cfb025fb0060d6d554db2f4de1
-
SHA512
4ad85ac410e9d1ec7587780f1fbdcc1016eab07f0b7750c7c9f1a784ba15a9255d148c7e24168e6da9873e860d03eb0c1718b25ed3e0a2a42401866dcd97c111
-
SSDEEP
6144:XW5tzQR2xLMxPzOhf2ihPjtAFjf1nTMwHCygTIr2LpCdroYvk6jk8:Gk2xyPzIf2i7s6svmCdr1Dk
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 728d358a296afe5e40d8e76a4613466a
Files
-
728d358a296afe5e40d8e76a4613466a.exe windows:4 windows x86 arch:x86
dfafd4df7fa12889cdf29f4820aba616
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIsin
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 303KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 328KB - Virtual size: 328KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE