�� ���`LI���`֠�D��լ��g9ไ��y̿��t�]b�3��0lF��C�[���楍�r�N%��dzz�0����nF0������u%ϙ�YlJ���` oh��%�l�I�1�x�W3bP5A҈���b�M$9�%#-�&>Ǥ�e@�3H�p�bw(��Rd;�2�dv�I��\L�e5~��:l*.�����//��U��H7 �Q��~��g�3t����*��N�VPo�ʃ�b�I�q�$�w��n+S�o�G�[{�a#a��#?D���p*{O~'+��j=��i���������r������@�W`�RC>7���hK���?§��e��O�:ۡ�9��*�!�p�V 5�^�ey]��MuQ�d{C��w��u#E������Sc������\�͑~��>�"SҮ5��fϰ�� )+=8�:WL2���Ck\����"-e��l�"�`���psO�>aY���s�����"�I��ԇ" �z��ҭJ� ��e��:�0ReP0Uu)��G����ɾ;C��ޕ]*�))~[W�q�>5����-%1�����Gಾ��q'q���/t�����X��� ����S�� ѓ�ϐ����4Z���>DI�|��7�� \^F����^/T w��·�Ux�.��ɴp�r���ҝ�9\���M(��eY���y�;('\�:=P<4��`�y���,�~ ��-�&�$�`�� ���E,WU�`p��;��Q*��EtQU�'W��a��r���z0}n]�����tϳ��)2���MC�" -7����Ko��>.|K1�8D��=�ZX��PE���a�� ߍ 3Ry �3�g��B��'�O���c��-�����Gk���hz�&�6�Y���"c�VT��yWqB�����g/x�� ���zs?������s(�6�*�ha×=vi�.O�2 EE�Mj��+-�Ǽ�6��|ˌ*�-�&��4� �4�8%�X;��}����:Wժ`�o_�&Xa� '�*ۓg�\�g���2��h�I�m}��6�d<��Bx��[a�j��_ӽn ^�`�b&��e~ērBzJu>]B _v���j�u<��������73�5���pl�)��Qc��t����C2q_�u��]�,���N���3_�R�7� �����O"�4�&Ο� �}Ŀ�fc���6RWX!7y��� U��QnE?pp2�~?�uӆ�6R�vc��N�ds����D>4�kC8";T ¬�9�s�&:�H�_ӌ���~>������Y��2b���r��T��5�%�����*[Un�����߈�����!�F�u���T�|}�։ C�&�R�}��oq���gi�X��R�<��V�zjx��'~�c&���y:8�M;R���җ�D�4C绔��@K"5&�A�{���:;��l�e&_(�v�euqn�y�ĭF���Cf5�U�B��{�81�`�BB.�GM���0����l[tt0�x�E�i=`P�I�P�:/�t]���J�dp51����������"*N�e��-�P@RT�<l�$�a��?�#�O07�� ���V�]��WQGzIς�>�<f��|hX@-���O�h����:i��y!cωIG���/N���/�����Ż�;�_ �:�=�3|�qu-��dW �ň%������~M--��=��b�'����-$�}�<��JFX`b>@-�:�����cT���Tu^uӳ�Ă��@̡��<+3ue�-V�n0�,�{�#jg�pT� ?��7�̏���l�~"�w�^di\K��� ?n���ib �8ٜiV����t�q,�]���] ��s�7��)b� ����"N��Z��=��gv�� }O1->VkO�Ӻ��G�Z�"�,`D)�9���}�7-e�R8m�S�9̥��z�q��存S��?��+�w!�e�XC� /�Y�B�2����D���#�iߕ ^}-`?O��l�@ND�;z�"�Lá}hΉ$���k����Ao���t�>k����mj&�^�t?��q��ݞb�/{벑��_�[���\�4q���ك�����;+Id�H]Ϲ���f���@)�����e7��̩�i��M���J�Y�n�F��yBY����,�[�B� }�$��;Ο�%:�A@òY����^ʃZ�֍j��2�7+���6%������7ā���Zܬ��Fl jo���]cA0�J������'�t�R�S&�6��f�i g� ����w�\و��� /X6k��Hyѽf�v�����^>����C�Ī���ɺ7�ƕ�Ih�'VL ��Fq*��r�IL�˭@"��\��x�$ݹ!�QCZ^ _���� �0�2������J� C}1�^�L`d�� ��=L��S�)_*+��!ӝr�U._��HPk����^m�$пw�.����ڍ�����3�C� j.D��n�b�����͇�z���9�w:���2�����K��u:~^�lB��:)����yA���0�x�_�ף~��|HYg�2g��o��/�3���!)�)��U��io�OL��"�~�����[�Y���fŬ�T��Ko���lC�m���*hkF��k�.�HN��Ԕ�dsr6��\_�3�\4��^'$��(� W?X�7:�`J>�3���1��P&E>�\*w�m��j�D=B;�Mϖ��7S�� ;��t�r&L����CA�Ϩku'�7rb�vd)8����o_�����7i ��0{^���q��+N]�k�$R����N8z���Q�b�� ��M8չʛ��������ƚ�[1#��Z��k�A�t�=���-A�V@���C��Sb�;�H�挰Y�ْ����p�9�����+E�O�D �#�,������Ս��ȧor�[ �.۔KÆpCXqh��}G�8�4L�H�@@UvӐ���n�Yw��۰y6�(������O���\ճ������,�\(�'�n����;����C�'��b�% ��sw���9�r�W�Q�R=�+� FY��o>R����i�ӥ\����R{
Static task
static1
Behavioral task
behavioral1
Sample
a3ba6d018cfead1995e454ee3d81e7a56aa51c59836e47def8849f8f7ce40c35.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a3ba6d018cfead1995e454ee3d81e7a56aa51c59836e47def8849f8f7ce40c35.exe
Resource
win10v2004-20231215-en
General
-
Target
a3ba6d018cfead1995e454ee3d81e7a56aa51c59836e47def8849f8f7ce40c35
-
Size
15.1MB
-
MD5
cb044588a319df2d2e0eff2e6857b922
-
SHA1
5f921c0604f43a6594296fd30a799591732d9da2
-
SHA256
a3ba6d018cfead1995e454ee3d81e7a56aa51c59836e47def8849f8f7ce40c35
-
SHA512
536812d42d00a1a0548e4143c32104e40323b00b9cc5a089b888c792e2810ba399ccae36e357f197a48a6f80e1d3c9320c8522878fb22646df8e907c7b916d87
-
SSDEEP
393216:ssfhTeAMxPTlnCRoTnzRaJ6d2hXD/rOyHhLUQl3CO9:ssfJeAMxgRo3MJ42UyBH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a3ba6d018cfead1995e454ee3d81e7a56aa51c59836e47def8849f8f7ce40c35
Files
-
a3ba6d018cfead1995e454ee3d81e7a56aa51c59836e47def8849f8f7ce40c35.exe windows:6 windows x64 arch:x64
8a2cccf4f72df4b2e9a72274d470a1e1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
version
VerQueryValueW
ws2_32
recvfrom
kernel32
GetVersionExW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FrameRect
CharUpperBuffW
gdi32
GetTextFaceW
msimg32
TransparentBlt
winspool.drv
ClosePrinter
advapi32
CryptEncrypt
shell32
DragFinish
comctl32
ImageList_GetImageInfo
shlwapi
PathFindFileNameW
uxtheme
GetWindowTheme
ole32
CreateILockBytesOnHGlobal
oleaut32
OleCreateFontIndirect
oledlg
OleUIBusyW
gdiplus
GdipCreateStringFormat
fltlib
FilterGetMessage
wintrust
CryptCATAdminCalcHashFromFileHandle
crypt32
CryptMsgClose
oleacc
CreateStdAccessibleObject
imm32
ImmReleaseContext
winmm
PlaySoundW
wldap32
ord32
Exports
Exports
Sections
.text Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 593KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
._s. Size: - Virtual size: 12.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.1gw Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Qh) Size: 15.1MB - Virtual size: 15.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ