���+��H�Hc2��^d; �A�Z��]��l��8�^Ul>$C�wx��)�љ�&�������\)@g>R�S�Q�W�5ґ��нջ\+�ŹQ0�h����i��đ-PW�z��z{�� ćesYC��A�`< 5�y��b*U��6���X�b<:-$��и�=�?�Kq��p��6���&U]L���i�K�7�N��#�.���W��bS�k��I)c���,a̖��́8 �b�զт���e��#�c�W]���Q��l����z���u=�z�Yg%`W������Y��U C�r��WvDu|���/?"��p9^FDB��� �������9Fe9�.��A s��ݰv�G�45{ILRR��gs��-�Eq�zz� �zr�Z����ǁ5}��R��@VU� �Q`^>�� �kP�`韇��j�lL���� �p������� ��&�X��ct+������Ah+�=�����3 ��Y"2x��ٴ��:����D��5��^_�Hf{~�� �v��,�E\$��A4��NTRj��Dd3��=�;���TE�''%F�R�~�ؓ3�������c��#��*��cWy�7Ю U��������H ��C0_1*��Ã�w�� �t�d푎ف;���tı>��zZF��RUj��I�ﲔgG�s�Z��`"(B� C�����Χ~�Ge�5a�_UtU�ၹ*G?G�8,���4���A���4jr`�5a�z�8�+6�hTh"q�lP�6�{�@�� ���E�ye��5����G��DZ�I�������Z�<7J9,:��Y�M�c�Jj&�D��p� �B�,��D/����b�� ��_!=��2C��Խ��Q���H�e&��L´��ER�c�N��I�[P���~π����C��qZ���az6*wu"�5��U�^�ȥݖD)�.>�bO�B��u�k��:E�6jso���#�YͭCd��X��v�"��?j��6��g�Ej�mOD0�����C�=�ŧ7yqu���[NIMZF����Ozy�s���@`c��9�jՊj�X�56e9�D��J�����o���W�XtsPv�t�B47_N���E�&�ě���ޜ�ֹ�q����KZ��l9[���a]������+h��iV2/�F0�!�yāVM >���s0�M��φ ��҄�@{]5�t�>���rA�7�e{������a+}7�� Z�4��h�3gۤ��U�:�r���O��k�%H���� ���c�nO�Zҫ�4r,&l�$�|��W9�;�b�^���<�o�M�89��k�6Y����j�l[s�Gh�J����� -� $��E-�4[�uZ����� ������mC⩗�l0�$�����;�ڔ�%��1E�|�_�1(�M����%��LR=��2"4��d�Jt��ۋY�QԴ'STWF���Y�#rIv����S=�����_@l��h$����!�Nw,�a���P�A[=���;(:����b���`UI��6���^���d$s�� �Z@��^�ȵe bzvb!-X�i/�Z�ǻ��5km����|/����%n�*ۇaː����_*7!]ކn�r�s��l��G��;�x=��,�gc���r��ú-�BI�*�j��q����vi� ���wcW"�QI���+�YT���GC���A5��c�� ���#o�T_�Hew����f�zDa�C���v��I%,�Y�`?\R���۠V�� -���!� ߊ�H ݃�������BS�}��S��T��H���~pIj�b�(ל٨]_�0���]14d�}$�S!�7+�!�E�9A�R��!7mݸ��� �H�AҺb���OJ���IҊvf%`h�'5Ls�qp醏���-��4���97�f��'�~��Fy�� >Iz�>�<9��ϰi�itQ@�}1D4d)0Z$(i���1��"��;�U������Ü�����n#R�|j��w�����35���{/�D�N��E��W�"KD�cє����b��,�?�[�"3|,�ʩT��Q�2S����X?]���(�Ɗ���.�5�y u-c\�q,.�������V���x�[�L�����W��f��;���� a���8o"�bp����}�E��8͞dOa�A��������/���͟��5l�N���]�m�G|jn�]��(���]Pj^Nȃ�&U���晬f5��(�ۃ� ���M]����>�d�M�p+�6w�X���!PD9!�5���G��� nf|�V���cX���~Y����K|~ԯ���+>�[���J�C��|F!�l� E���+�I���� ��K<,�"c�t�MxK���S��� �l�0 ����� �XI�������i^�Ec8B�5= #�=�IV�$O㙱K�ΫV��^ZlKHe�� �s����V��>g�l��x�`���&"s5u`"��AV���*����������V���)���S9gR����n��~��#�n������4Z2�&�vn}!� P�^ˌ����1�?��R�J8���D�L�A&yР���Lu����W%=�"'Jʹ���,��� <DG����!������>7��y�M����j�`�V�E/Q f\@0#����0�mh�7�G�i�ù�����.�ce�L�ޑ4���������v�d��Kk�[�u;R� ���q�<�eog�&�\I�տ��lv�2��d�4�4屺�$�]]���A� ���n���%ŞE=if���8i]<�pA�Q�o�9�?-k�}����+�\��z�e�"2v�j+)���7ҵBZ�h�r�350��W~���B���N}��l�g���i���F���̅�R���Pϧ0�����|�Z��AY��<&W����o_e��`%+���T�h�af:ap����4\�K����$�$��.�"Z�#?hw��x�wl�s9L����E��A�N�(�[����Na�7ML$��&ހ��#@�DP�d�&0����/��|X�Qn���z��ԚR��`�����J`��[����걲y0ߣ����DnƗ�歄�$�=�
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.MalwareX-gen.15198.13018.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.MalwareX-gen.15198.13018.exe
Resource
win10v2004-20231215-en
General
-
Target
SecuriteInfo.com.Win32.MalwareX-gen.15198.13018.exe
-
Size
5.9MB
-
MD5
000255007fd86a8177f0960870e5245e
-
SHA1
49f9086e22bb0f5a3a41aab95d51fd47bcf58f0d
-
SHA256
5f0faa1e30e0a1e6d0edd916152ad7602a01fac5b61d16babb86f50b6f45bfd8
-
SHA512
a4453070ab39b3890d564f8dcc034033dbfadf77a879301f49edbc00a025518992daccb41c62454eb3ecc9d9ec60bdeb3a0479deec7c1b1eda5fef57f0dacc3b
-
SSDEEP
98304:fHoz60q4r1Vgvwdjo6ExOg9Yw9LqexRfzAh9mOjHkdmVFOheDJMmUn23HyL38bwT:wz60q4pSvwdjo8g9YwtxRfm9mOE0D+rh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.Win32.MalwareX-gen.15198.13018.exe
Files
-
SecuriteInfo.com.Win32.MalwareX-gen.15198.13018.exe.exe windows:5 windows x86 arch:x86
a9f526617cf661431e6b5984b2cfe00c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
gethostbyname
winmm
mixerGetLineInfoA
version
GetFileVersionInfoA
comctl32
ImageList_Create
psapi
GetModuleBaseNameA
wininet
InternetOpenA
kernel32
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBeep
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetPixel
comdlg32
CommDlgExtendedError
advapi32
RegDeleteKeyA
shell32
DragQueryPoint
ole32
OleInitialize
oleaut32
SafeArrayGetLBound
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 604KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xep0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xep1 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 252KB - Virtual size: 251KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ