�&~'��8�#��,5�XE�{�aOpm���N}x��K�2>���Y��ܙ��SJH`�8��u�x�!q���%�oD�����+�s#}}\��Ql>�v4���4��Zt&�B�f�N����� �c �]�RE�\,�0������;`&p��\#�K���;W�{���]t��@�i6o�}� �nޒts��¯ %��2�a�w��V�vl#!�;z0����I���wQ�dOP-��(.B,d����=*�Zb�K��+���`�qvY��� g����K��]-�Q����9�9I��W���.:g��X0-�� ��Hv�~ P,�e�� �D�d�H��?İ:��$6+�WM��M�0Q�ۈI����⑧G9Lw��(���Lz��e@�$�����Ҡk`h��Cd�=���;�ڮM�� +�����]ȏ_�E0��9\y8i�,�5A��)������^�,p�I���RP�Jm����;��٣�R6x�J����~�А[2��k�9\U���;�1��l� /����#����=� ������Χ���Ș��%M�� ������HX&�lAp%q�K�8���x�r�:�5����,kb�HZ8�@���#��2�1 ��#u%ן�O��SbXUL�����#!0'\���ѯ|-�'�]un(����Ӏ���D�apQe�� ��;�Ҿ�ƻy���C�� K���^zC��:й�%P������9_���D�_��E��>�:�||A�s��X�jԂM�E[�O�R�)Xş7������*X7߭��c�R��;C^f$zN���-�����;Gߣ�Q؋��x�a ����a- ��h�)���rtw1��b�|6m`.@��&KV���]�J���a����q�<���;�Jұ,��oԽ�/�fZ-��n�t�Ι�ri�/7U���EI �Q�X(u���*�#ӈ� J� �T�����V*D�,��K�I{�?�|��2l�ܛ�"9��uGw���I=���Tr��0��߶嶞W',f%�ȳr�^m� �a�!S�^�q@/���1����WaZF��6#Yo0���9k�ՄgLr`1�}s�8���b�o��j��O��#��@�S���<���^�о�V���B�Ih[���u�����}�>��B��"/�3�',7.Y����m;�d~�h���[*����ZPAD�җpdzۉ��5��IV��'S�P��&x���LPsf��6����C������`�,�w�,��s�!k�u���e&�½-�v��Ҁ�En����� ��4�j�h w�μ�=3��Q�mZN�Вř���e���>���=b2����%�]Rc�Rw��{�O���h��c��&�X�*g�\P��(:Mi ����|T�*'+�u�RS���-ytaDh����:�� ���ݨM϶��@��:vj�5!O�76��+���I�|_�Ъ���F�����ם�:nL��������}�-t8��v����!�H҇��3�>q1/akKT�Ӷ�g%E����ܯ��ʊ8���!��� Йe�����~��O^��S���L�[�����mmd*m�-��k'8�xct�b�,�P����'���NuEa(-��w��=�kϫ�_ԇ��<�MWx2T��Zi�Ϻ��!Ԍ,����ֲ��-�{qB1F��d�ݮK�]�����V� ��|"��y�]^|ջM��"�ʌ/a���|�Z��jI�d�F.�H���C�zXv@��&b�����y ��`��L�dY�Y����u�7O�ܔgdM�P���i�vDY�/�u��ϱN�6�4IdI����L�=8���E�l���^�-6�����d���peE�������!˴�^��R�ua�L?G����4s����5ۇ�.U�⨒;���2�����L'�4��t�wr���9Su��ؓ>�#Q���R!���4L����U�i�Owz��m���O��;��!\Q��5�X��$�N�M� q���X*]/݈~�)��)1�'W��:�*��+e�R���P'�~��R���vON�{w�[�9�K��X�@.�b����@N0�d+�cE�m8#PQ�P��a���mB�j�2|��adڛ"�D��-0�,Ƈ�@��Ꙃ��|���15���ތ�S�3�Ѐ ��B�~���5R5_�+�0����l�����mS{�R�<�f��R�IGu�M4Y�l��Z��/~�$����&��娫�y:�!)��6Lx>c.V����!�9�</�\��Z������g2J3O�4��俥�(H�b�d�2~�n����q��q@cD(z��,���y LX����<��VG@W���ba��<�O�ˆKc�jV$=�pl��g�i��:.�R� sW��ĝ��4c|�+�����X$%Z<,;��jn?���Y�A�D��a(Gy�d���u_�Ea�i����g$��o��h1��d�.��G�x�ފnH5!�nC\��s�%�~�a1@˲�#�ƪ�����w_��l0TP7xr"���"�Џ@������Yw����K�K�+���V�H�T�F����n��iQU������_���E�&���͗.�!��3���@Bj�(έ��b��;����� �:\�E�s���;�('l���[.-���ܻVb���Л� pvv�.I����hqB8�>i�N�'��O�S�)�^)�]��X2�Gσbr��kō��e��7X'aE�_{v��£xI�ǘ��ך�Ƒ�E#<�^�fI�C�6ID;QB�29{�� ���cP~�t�+���fұ�}mDf��!v��Q��U�GVv�GT�[i� ��$� rR����y,�w�9zQL���!�����G���Eק�ᐫ3��$��O҅+v��~y"c�%i�MRiU�0i����84[����s)��y�*��Fk�Q WgO^��A��S��K��3VO�xޭb6��R��.A�y�O6a�g�(N�i�-�g�:*�&5ө��<R!�6k���E�<�Ph�����Җ\ao�!P����=��c�T�Tb�S=�_j��n�m�����Ut��~����Ơ
Static task
static1
Behavioral task
behavioral1
Sample
4ec5669ca7d21c81666d860dbba47837132b6f0883971dc4dc82388ae9204357.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4ec5669ca7d21c81666d860dbba47837132b6f0883971dc4dc82388ae9204357.exe
Resource
win10v2004-20231215-en
General
-
Target
4ec5669ca7d21c81666d860dbba47837132b6f0883971dc4dc82388ae9204357
-
Size
12.9MB
-
MD5
e2de81d0232bd37f42f485ac76b2472b
-
SHA1
8f9d63cc2ceb414d43aaded85f942dc044a1a122
-
SHA256
4ec5669ca7d21c81666d860dbba47837132b6f0883971dc4dc82388ae9204357
-
SHA512
97aa3c0f2554937cbaf79a08df96273c5f44e1e6529a6462e2c40e9f5898e3d35716998dd1ac23b9e46af17560cffa1eaea1a00eafb4550cd4e66c83bfdd0cf6
-
SSDEEP
196608:0SEm931OqXQAX1cXdRFzRsrqgz0vzuAFL6mUb4VcJvz6xo0eER3BTejB:1EuP71ERUrI9FL6P4V0vAeEFBTi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4ec5669ca7d21c81666d860dbba47837132b6f0883971dc4dc82388ae9204357
Files
-
4ec5669ca7d21c81666d860dbba47837132b6f0883971dc4dc82388ae9204357.exe windows:5 windows x86 arch:x86
abd3882438fc0dad2e5f742ab88184c6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
winmm
midiOutReset
ws2_32
gethostname
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadStringA
GetProcessWindowStation
GetProcessWindowStation
CharUpperBuffW
gdi32
RoundRect
winspool.drv
OpenPrinterA
comdlg32
ChooseColorA
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
LoadTypeLi
comctl32
ord17
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 615KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 303KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: - Virtual size: 7.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.genshin Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.genshin Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.genshin Size: 12.9MB - Virtual size: 12.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ