4 H�)�Oqf�4}^up!%_���t!��L�� R��d4�߫%=����a}���$fн@��T���<L���*�$����6L�lX�����ʌ��@l�ML�O>������ 6�\q��W|4,�u����% ɠ�{�C3����D�C?q��p�B�g�>��yX:�����n���:/;� ��\fz/�% �H��m�2<�E�ۭ Z-QJ���a��R;=������HU ��Q���3r#l=ow��.:�|����A�3Ф^Ii�D%��/1'f�����k`���'4��V��&����nd���Q���g�'Z����r�\+ ���j��P�c�dݝm6��:��7�+��/%�h�W�IG���;�C>) �9�����Ki�H��s�W��%�%�u��0n�p���%\���Nn���'`�N �v�8�"�R(+^u�!����9"����u!�/�;/��<�i�����՟'4+�o��Y�֚�,��Ԏ`��Ƞ%�@^SN�h���ƻ(HQ:�4�d������>���w��N�6�D���ܓ�����X)�\����3��6Np���0{T���i7�����&n�$H��6Td]�cU�郄|�-) �zC0L��� i!Th�wq�ζ�z������o=�����Ƨ6��g:�gn2�x�&D/����A�p���R�Q9y�ad�b3�э7����@Dj�$�e�\�킪*!�Ұ�b/I0�N�א�]p7���F^���B��r����� ��)������ʗ�DŽ��T��up���C������XT��r�x�� 5��pܻ�8�o5�� Α��8�f��v~| ����}_?��#4���΅�xV=<�vj�<��5����UbH�ݸ�̊|sD\^��T��E�b�=���b9(I_�T��gb���$���W�Ь��l���8��X�J7MC���i�.� �3)8Q/+O @|/���n7 k{�X��p�"R� ��g�IB%:�Dy������7c.�~n��9�����L|T��MC�W�����=�'}a�$���z��� 鮘��oa�����'Z�ji������R+Hf�]���#h"~/��Ro���Sa+�����4-�&2�*��]~�3 m��f�(9$H?v�^����@���l�㻃���+��gy �)�(�L����OQ���������Vh>��h�dD'd�����#�M��L�������&N�Q���z4zZ�F0{%'�$ sֽ�^����*l�_�����2��N�V.��CE����Mk�X�ܷE�YϦ���g ��"��P�/#�8�����dX4�WqR�s4c�K*�����>3�-�M�� � �F�B ��*��X;�Lr��yeX��� ��d6 �e�$��ԧީ�>ŕ��\#�v�3��"�ߛ9��!K�L�7r�9�F�ko7rϽ�_#(��莶�"67j,�⣢���]o�D��I������G�|ķ��a_���iC;�5�L]AE���N�#)�Hdp�"�g P�]B�;O�\����P����n"�$����VŲ��IՀ�N��jV����_K�!`_Os�+�~҆@>IP��k��+���}U��[��Lj�'�<Mw>�u�#�v�n�L5��JMB�+��ʓB�l.���я-)S����-����{_������.^���cw�3�������ѻ��>��Dc):�,�k?z�2��q�8"z=3�gq�����b"�ٙߑks D����s��b�d�D�4w�A���G{{x���F�꺠��H���K�!V̯ʬ�;�at��.�)Z2w1q��N��J�1�}=<`�M����#�ML@Ԇ�W;4?�+O]ne~���)A8��J�vvY�DMi_��n,_�u��ق�tM'�3�t���Y4��|^�Lϳ�F�����|;P}�y��#U�e /�`)�.��#��j��G�p.Z��"�cY�d� uCP�<zL]�$��*UȨO�{4w~ aB{!~�oz�����-~��(�M���εv�A!�ڮ}�7ĠjC�-�t|�3O&��w;TUGm�ӟ��LmX��^:Ў�y2~P&�; ��t���F%C�������r�i�:�����c�ۏ��菦�}��}�l�E�����%�tх���Y�-A��#��$c�����$ɾ��GO�U/�^��ƿ"'קz�s [S~p����cZ����P�k�F ]����ԅҡT��3��n�a�'���:B�b-lƄ(���n�n��q)l4G��:PG�~����R��L�k�nV����wح��,��2�#Q�}�=�����է���ڞ�c�����%�<��S>~o�*���W�m&��euP.�_�*���lʽ�*��`'�l�"�~v�����R�h����+f���}�u� �d�����܄ʊC�@�8�������1���e��H]ܵ�7z6s_�!?{�Е�F\���PP�Чt�$u=u�����l�!��tD��F��_q �&��b��G�6J��G�b_��e��9 �9��M͝-��yӦ�mf1q���ӆ|)��V,s\�#:�{����BÃs�A�*v�!��H��x��w��^T��2�s��:���]z���Z�������mg+w5��arȬ�� !7ǃ�H <(�=���F�B���싽U����l̟�`����������JӂE�p�c��L�R�[���� g���=�r���L.�f*3�=6@�ſ��^��6����O\����w���7h���"�P�/�D21I{U&����[�ZKTH��4N�*{[1_�)n���:�|ز�1Dޭ8�Id�'n�t�,�0�VL��|w�W��x��6�\5�z�$Q��a�֍���� Əon���m�;Mw�tدú�.X���dt�oT���{P��s)6n>l�#�7�#�3�|PTZ�lJ�'��M�n����v5?EN���$m�W��o5��eӲ�#C�`��r@F�Kb��b%P� ���xA��U�Z����LN 4�ka;��!�
Static task
static1
Behavioral task
behavioral1
Sample
971822944a6bfd4c91202d901c9fd04f.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
971822944a6bfd4c91202d901c9fd04f.exe
Resource
win10v2004-20231222-en
General
-
Target
971822944a6bfd4c91202d901c9fd04f
-
Size
2.8MB
-
MD5
971822944a6bfd4c91202d901c9fd04f
-
SHA1
d0e88d1db577f75a5f788d9284fdbfe4471c0324
-
SHA256
3c244ced156622abc40be783ee13fd8546758495ed3528f1f7f306afec59f6e3
-
SHA512
f86aae26b4e2fcc802b3ee702d73473e19e372cc46fb5769112406644ff5ee2fb1f6ce767aecb0a17581c88ebfd646c16cee87ac510c1e436d51799809340ad7
-
SSDEEP
49152:pI5D8RFgk8Mvlj6sK1SWlStj3KFnY86Hu1nmHTf6F6eoFxXqKLQaNcpUw1jbFl0C:pieFgk8Mvd6sglS9n86O1nEr6kdqI1N2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 971822944a6bfd4c91202d901c9fd04f
Files
-
971822944a6bfd4c91202d901c9fd04f.exe windows:4 windows x86 arch:x86
1877264cc20fd9a62f55c56c82fb8c48
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SetErrorInfo
advapi32
RegQueryValueExA
user32
GetMenu
MessageBoxA
kernel32
OpenProcess
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
gdi32
CreateBitmap
version
GetFileVersionInfoA
ole32
CoTaskMemFree
comctl32
ImageList_Replace
shell32
SHBrowseForFolderA
winmm
timeGetTime
ws2_32
ntohs
iphlpapi
GetAdaptersInfo
ntdll
RtlTimeToTimeFields
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 91KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.upx0 Size: - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 187KB - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx2 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx3 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 235KB - Virtual size: 235KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ