G�{�{o������s�O�p|���V�֏p��0�6��crC� ��/a�yQ�A�)��y�]�a��-�Wxq@]�uV�]A��-q϶U�b6�^�0��&���Nv,��i2�UG�#�s��s�J�*�eK�= �1 ������ �G̹l��6��c����)�([���wMLjs�W���P��<��{r"v��I�]� pf���z�ǂ�U5���ROT��r�}�|��3m+��'g'�x�o����)c��� Λn�f���������]pSpx`%��D��pt��@�,Y��j{��7x�e���eV�V��vͬ�g<��Q'�p#{�yAk��M�v�*�7L�|�f�>��e��X�s�6�o��&�����0ޢ��~h��%�����Q�!e���m����&آ}vs�?��wZ & ��h(�l���y��w�~�5�q���OU���g)���?WO�ϧYDيۛ�\$�@i����`[M�r!�#%����|��7�d�u�5E.%]o�(شX~j�d�0Г>�,P<�"s\Sȝ-t�;���@�@@�e\��CpI��D&����E�� 5�i�"��k��R O-5 �=֭~��{d�s�0��z"�j��Jv��'Ѩ����b}ͪ}m�~�uѰ:�&�Lg���)oN�s��S�*V�͜��U����|�G�?����j.զw�2L�%�Fq��RQ���KI$)v&QD%'�* B@�z��E6!R�LS�=�/��N�s�C�]x�_z��# Uǥp�Y�o���xbW�x�F�����+݉�� oT�6ʄȦn���� �����Կ�����ߑ�.�g(��ܘ#�'š:����`���P��f%��� ����^qI���RL��δ4�x�yN��c���1�k�s��V?��2���7�V��(�9��n��L�J�Y�W���hi:��5�}@*�t�����/z�;�@�f��E�E89�sU����fu-��]+�l��i�������~o���e�J��E�ʻ�w�>�wƮ����8�6:s=��Ϣ۷�+;���ɢ�<pp˖堞{Z�ցVx� C���5�3f �ʲ3>���`�o���:�ۇ���Mdfh�R��ǟ��Q��K�?�D��X*�S`���;)d�zR�� B3@�w.��$j&�.w�_I����5�>\2"��9��55k���L����l�·�;�ӫ�=����>*־5�%���:+[{j�������G�=��\Z39����R�g+���&��]�<E��'�U#;��Y��*nN�ۙ�&���co��L��:�N����ӎ��:��o��Ue�R(m���F"$�7�U��,JJ�����L��}By/�=l��q�D�m ��l����WV S�u�ϪN�O�v�mL�K^۬a��y�$y�����x�Y,I���_NY�R=�oI' EY�X@w7 @�]�a��S络դM�6}�y�څ�M��p���m\y�s����g��&��ԣ=��>�?Gd�mۘ� ��b�u�YY��4R~�6o��ܩ}�N��o �륺i��Ȉ�k2#��Xh���jqI�-����(��m ��E�e��0и֞�OM��-=Z{�h���R< %��ÙM��������`�F����E������GG}�8������]�_�����O�*E��kȁ�2��E��=�o�)�, n��E���$���}�������V�����&�B�`�a�3{�\�%��ѣ��Oظ� ��&�=B��A����k�lu2��&i��f-s��7�st��k`�$�� �ڱUg�[�� �\��Ѽ(P�R�bx�F�6���'\������ .�:��fT{�z_�YgS�DFz�/wN?�rv�!u�[Ҁ�b�#}.Ə*�M?�6��&�)/���� ��x9���8��F�2��M�s���}\%�iJ�u�<���2�;���z�0+�l챟���r2�3C��sa��������'����-$g S� �s(�_��{,������.`ف?����`nq�5���9ϼ^Gu��f{��J�ܜe*I��|��K��˱�s�B��H�/&�<�S��+�j��xx���������@C�:�ғ���m�Qa7�G?�&$� �O�`L�0H���� �:� �i����CY�+ixH&·T��:����!��R�~.��|�xK~�@U��'Nė�ەĀ ���䊊���S�����Z��;�"�%�@�|��%v�|$�7=]o�.�^<6�\�p�a�y�I�~{U��!D#ۑ/ڽ�~��#t�����`�b��]�Qh?Z�}�R�������ڻ���l4d�i�g���-X\u��3�O�jb�Ej�eCV�f@���;�"#�C(�dգ���}��0nέ��������TZ�Π�g��Z��������s��3�L�o�μ��G+�(���y�K�B��V�"F2������qc`*���r��u�AǤ�;� ��DLP�d�v��#R�a�#A{�L+qc;J��r�uï��?�/>��o.&o��m��pix����Z+e����}U����l�3:�eUj������Z]3OqD�Mi&k� ���� +� #X�ȑ:��.I�)� �^��:L�P1�{�]�魓������O�k�O�xuz��~�Ͷ݈�(���Za�)p���NYh&�&N��b�)T�B&<��D�j��,#��FTu�W,ۿ�ۊ�%)z>��[�,���J���U�fC���2W��r9gEJ��d��{���4�$OQ�M4\0{'v/�F��$bjhY+�R2a-�aF5}T�06M7�T�&������Y�j�>`��2_��`[r �~�a��0E.^�K��g��� �q ��,�����Q�7(#�J���tFV��-bXs�EjK��o� 3�n���z��?n���~��HD�������x��ўʹ�5�Y����8_ԛ�3�5V����s�S��Zhy�jl���X�8LV�I["���R�ꎣ��9���@fB��I�?����0�*nTp�S�����/��SN��}@�:���y��A
Static task
static1
Behavioral task
behavioral1
Sample
8bea56307c4a7874caeef8f12b302e0f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8bea56307c4a7874caeef8f12b302e0f.exe
Resource
win10v2004-20231215-en
General
-
Target
8bea56307c4a7874caeef8f12b302e0f
-
Size
1.4MB
-
MD5
8bea56307c4a7874caeef8f12b302e0f
-
SHA1
ac7c2021d09991b22855374610f9853d4460eaae
-
SHA256
8a39d656089e8a74c9d64dd2b2c1cfe7c09532a12aa611564769e3fc29b672c7
-
SHA512
1c5f979e0ef623da23f155f28f23cdfe00b449a1e8d5acad96277213c58ea2f0d5773842479ba00eea78262c4f1fd5fc5948cb734ed1360574c0d2094a10f16f
-
SSDEEP
24576:JyokPXkwFzLxNag7hnOgX1Klofn90v698wNQKZcZbqKfffhv:1wFPl7tf1ZeS98wN+ZbdnJv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8bea56307c4a7874caeef8f12b302e0f
Files
-
8bea56307c4a7874caeef8f12b302e0f.exe windows:4 windows x86 arch:x86
4ba19b57bc85f3e7098e192b864d4bc9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetDriveTypeA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSysColorBrush
MessageBoxW
advapi32
RegFlushKey
oleaut32
VariantChangeType
mpr
WNetOpenEnumA
version
GetFileVersionInfoA
gdi32
PlayEnhMetaFile
ole32
StringFromCLSID
comctl32
ImageList_GetImageCount
winspool.drv
ClosePrinter
shell32
ShellExecuteA
wininet
HttpSendRequestA
setupapi
SetupDiGetClassDevsA
Exports
Exports
Sections
CODE Size: - Virtual size: 907KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 8KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 24KB - Virtual size: 227KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 733KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 424B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ