C�^���:�M�x��GЎ���88Rr9��n��0R\ĝ�U��;�M��L"Tؑէ��5:f}�I�����vQK�&5�Ͻ���V���^�g�m�$~\��y��>�yM���#�"2nrn����̦�:)��^��};�-����O?�j��ܸ(��wOЄ�Wb7g�1�����jb��i���N�P��:���뽟<2˙���UkB;x$���=4�1�y�&,�)�ڡT�jIM2�|�1"�X#���"qF =z#�7+MAN���ߡ�:������C-zQ)2Ds*{3��5�>Je�<�$��e��H/҄��DPak>9[3�E��`��b�w��?�>b�>+�<n՜�<��B.'j�\�q����@ܥ��V��R{�d1�}�+��c�ǘ?+gh� |?�ɭp�/��!'��U�}��D�ǝ������Y�k�B���s��{.��x7dl�)�41��J�%k����`*>7�a1n܋D�!ɍ�Go�!�,���NE���� L��y��9v��ݎ��o�Y����E��y��k�Gx�\$�U����� S}J��*�����a$����߆�a�lQJo��SΏ��S"�m��&����L˨IG|~���s#����We����3f��������M�kT}��5.f?څ�Ν�PLl�d\��y��Y��������-�$�\��m�p���3[2b�����2��9�Gzu�� ����^r��q��D��ѳ_^hW��ZC�s|��'����n�t�E5��{y{:E��%���Ц[���`��W�噿<Xb��.|�b��K�:���7�+��Q�2ۆ7{��5�.wGTD���U�9�S�n�b2�F;�|C�H�n�Y����\��X��*��M�C>����.$|m"�j�l�zv=W�3�D�x�|�M�Z�H+�N��w�j�!��1siuߴ���6���?a�ZK�"��5Í���C��*a�9�>�lRQ�Ew6/���|�z�T�v���/��f7���������), �A̷��C�RV���2�"�g���w`�3s*���"o�&����ҨC@�nI��X'����c �el8��R��T���������ݫW���_��Ĵ$�L^���� 6[�3�ᄠ�Mz6�~A��.�Up������#w�s��sW�f{q��4#D^��٭#�U1�dVAD��x��X��ـ>�E�/[ 7���̎{���ipʅ�{R�mS�x�������c����dI�R#M���A�BYȺ���%�!#&w�Q�P�(J3�Y-�$r��Fr�/[ػ���e� �0mϮ'!�;;��Iv'���� �О%��)����Kш��]��g�v�^����;�E�:�JtyK�J���ןG�}��*/rT�Wn6�x��G�9J����o��% 8'0??i[�^6���/h�LJ~�$˕��)�2=�u��X�|���ce��"��8����[5��/����S Zh� ���[���;o���+I�̭=/��.�sx�S���Д#�P���Z��{aʋ�4�L@�ϾZ��]�$;S��o�1b[e�.��{�}��9δ�<��-�#~�l���-~*�_�B�{$�p����1V(J2Q��� t�q+iv����*�|�'zW�i}�x,�Vt�:<�Ү<�D�n��$�^��X�c|C��Uf#"wրf���A����z�_���4'"��M֨ޢ1����jg2��ƛ�1s$j ���=�&�ܖ{�]�1M�(�V�ts6-��a*����Q��:��"���+D���Z8[Yһ�=��|X̟Y� ƎLU��TV���)������K�":$�b�B�u�t�r� &���C���|T r0��[�b�������J��8N�?������V��l���'ۅq�5"�Ƃ� ��X�k g�wv@��I�=�<���s���#�V���P?���?�x$�e�iPU��q�{���#ݶw�����|�&�0d���q��ͽi0�Y�n���'�z϶4�iT�;L��Q;q�����ovNLάX�h"��Cj�\3�*�aKpt���c�dz�c/F�x�f�I_��s�@<az���#X�@z3 �E�CR�iJ�9�gOT�0��F|H����v�S�$�����[�i̗��.��-�f�^���є�EK�����$p�O�����͏j�᭴2.�Cs;k���G�~�|DAYVC�_���.DFV��'�Kb�� �(b��)D�Y�}6*t=�b �̭D��&�$��UǗ/KCK�U�2����,�uMD �������|HXz 5�r����ɦ�)�y aJ^�w��#c���{vs��嘄�p�#G���J����|o��v�ܬ��q�0�[ '=]�ksk\��dS�M H�[�<(*�4Y��U���I�� p���t�+ z��mz��Hk�EwIM&�'nZ��`I�䖎ƫ��5-��!���#c��1*Ϙ�L�C+��ժ0�`!@�Җ �UsQy4.&��C���|0cw��~G�K��q�3��̻�T�B©K�` kt���uC˸��+t:��+����lBt�*�C�u��y��ǫ��ly���M�n�j7�I߶m���Z��O9A*,;�WVO6������/���ɱu�(~zP�۞��:��+�[X�c�f����.2�� K����B�����-�$�,� ��/�a�*��\V�L�Z<( ~�*X�@��CA�M�����E3�Nb��p(����W~kW���^��G_����%� Qn�^H�ᷤ���2��7��J��*��^���I�� {�B���y/�:)���O�o�5���8Qm?V�]<J�;�h�����ʮsT��ߠ_F�C&\4wA7� 5,d��f�Ɗ�3�B�����W=H�@Cn!y-���;%�α�`�!_�k�]Cܙg��1&�x��]��)�_x>�����eT�6:uYO��!c�Q��Z�L�����Μ�����Q�#oϺ_�L+WҌ�{)x� GWBz�����_.�ՌT����Ɨ\փ9�;}S�E�I;lUz�($�^}9�2<T����^"�Vd���'����ߓρ�@���D��
Static task
static1
Behavioral task
behavioral1
Sample
85e734c60ad77614a162d04e257f1974.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
85e734c60ad77614a162d04e257f1974.exe
Resource
win10v2004-20231215-en
General
-
Target
85e734c60ad77614a162d04e257f1974
-
Size
970KB
-
MD5
85e734c60ad77614a162d04e257f1974
-
SHA1
0bb5f2e99ac73fa4b98fb87b7a0d1e4c7f505b68
-
SHA256
9aef6b81023ebebc1ac361e67f3a2d936d83f5d0bb0ff3443a83a3c5d3bf35d6
-
SHA512
d88d6f0b74609ba1c2e33b556f8061f9b8e0a4a5d38bbabbc93b0a5056d49bc35f291c72638bb0148f5ab46920113e6d6b10ee0a281342810ee90b781f317594
-
SSDEEP
24576:Y9HBpHfd1HpugiRJb0PUleELUnwS3asaLP/lei1jzGAj9:QHvHFxgzRN0PdTwS3as4ei1jzr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 85e734c60ad77614a162d04e257f1974
Files
-
85e734c60ad77614a162d04e257f1974.exe windows:5 windows x86 arch:x86
8b33b22084bdf9b01700227dcddf75c2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
GetFileAttributesA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SetClipboardData
MessageBoxA
gdi32
SetTextColor
winmm
waveOutUnprepareHeader
winspool.drv
OpenPrinterA
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
StgOpenStorageOnILockBytes
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
oledlg
ord8
ws2_32
WSAAsyncSelect
wininet
InternetCanonicalizeUrlA
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 538KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 919KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 179KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 959KB - Virtual size: 958KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ