���<�s��ҌN�,����\���_�h>܊��pTD���.�0�"ha2 w��x��8��m�ף��|�� ��y����/a�LR�6�*aөe�YjޭO�{����W�R�/��W:�ɵ����if3�%9�Q��������1�q��*s�����2�C�]U�z��2������$����&�.)�����7���'v�<e����!����G�3εmB���̟k��|u, ��]w���d#�^!i���{�h������h=��j��o2���t�h^��G�WĻt���*�5uؘ����R>�D�� ϛ*jKA�{�i/�,�S}�?VӬ2p���J�NES��0!�B�J�7�L�:�()p�_8�b ٟ q���x�����-6��[Ô������>��ִ5̲�����$KҐ�DÕ� �nB]�Dri��q~���9ѝ�;an�>��bj" (z���7{�\��m Ϊ"셆�?:�q�[!e˧0Q3bUU:�L'�CɁ��F�%������3=���8�?>��� V�7�=$�Q�@Ot��N*����K�gѾ�� <R�[O��1!λ,m�n�,50��2MO淨�r�I��f�����w)8������4:Nd�_����:�Vc7��դTir�K��I�T ���HĄ�x���\,�q�x7oc.�h����F���Xд�k�ON& >�P�ޥ3��V�"/RʚN�F���� '�?�ײޙ���@����'�R���6a�Ң���q����4��z�]�Ƽ��EǛɒG���j�Dly��E\8�i��b ��j�cLD�� ì=��p ��P(�,��β�Rթ3)��Mn�"��+[rJ4�����6-�??^���e�R��*Q�+�@�����VZI�7=�Y���H^8qV�X���,x0W"˼)6��~��1u���@� 1��/��jLH��9��8<�����$��-���je�^��ƘOK��Zr~ײ�����@/C��S3hr7��%e?�S�QD5��(�����6yP#�|,��f1�zNzT#c�"-�s�+��9������X�ZW��<B�\{��<���%W��FѺ��yw8�`Dʌe ԭf �eC�d͕�)��4���:>/`,Sp3���!��7�aScܛn%�H=@;�>hma��,U5햔�*7k.�I���B6��<��:H�Or��@�(J�����:FW�� -沍�H�i9�E�웞�����Fh� ����}&�c�^y���$����O��R����^wvE�Iw@e[*�ֳ���ue���ugĕQ���ρ�X�,/QL0SJ�\|&��oh����>o��q�-��;�2 :?�|�&��;���%�l��!����/�{�S ���h-d��Qf���>� �c)�0 �&n�m��=�ߣ�q,;8Q��0�5��������v��Y�r�q��}�������vl}����%�S�;����,�BU�����-���b�Cy^z�,���.x? pyv��)7~�٤�hi; ��4 �Rb�3��w?u�~ןȍŀ���7����K� �F�J$<7;"��f�GslF�Dh��5ʪ$~��/�_��Kn���O�~����w��>������>��L�v��< �Z�H>/�UKzN�=� ¦���z�<�2��f��l.2�:e��-�~���֩9�� �͌@��D�F趌eT�Z�����ao����̿*�)��p���\�$Z��i��1��#@h���#��t �7>����r��A';���=�W�7�zk;%m�������_�i{�����B��v��g��p��I�` #��{k����0�6��\���q��W����5����=Rp̶0AW���6���n&�`��q�M?w��8�9jyS�m�ZJ�\Z(bsIn��u^2��ō�����5XIJvflw�A&/Ⲣ��W},K���E|�3�5A!�v��m:�yʣW3��4N��.������"��#� h�.�>� �xA ���� I�w2.�Sp����w� ݿ�!}�cWY}ɇ�gg+�2�F4����dN���S�c؆�;V��T�\a�0�ے6y=�k)�&<y�uoѱ]M�rs�ni��1������<YV���o�6���>�H*��/���D��оA�ө:��/���/�9iT��ԃ�2f��/ˆ���`8E�� ���2�M�R>5�P�f9��Jr�������ׄ�¤p=G�Q� �>ķCUE[n���[��n��Q�D0��|�w�m�#���z�P5 Cض�琮�n��e�l���ɴ� ;bo�js��;s�s�0��� �y��Lk?�����3v��ƽ��b�!��^ۚ�C�C���L�ь I@��v���w���-ip����nМ��O�S��V��7>��0�t&�_>�)7�j=[Ö*,ݰ��A�FK����^�>vA�tRYT��#�\�r�\��ּY_��c����[��Yim/��䰢��Jho�˝h�O U�9�'��uS�{<bƏ�䉕��=�Fo~'�8E��'�ۢ�!�3UF�,�ts� ����Mu�p&z�82+z<D���}~CnD@��s����0�\@���J"VhX~s ߚ�0��}JWm�>��y���Ԇ�t��q�6w���}�p�py��i��1��(� �> �~�M�� p:���֏2�WR��M_Cc��f'+]���_s������ƟKB��X��d&bǪ�V�Y��f�ωf���R(h�ӽyh��E�@��}�֖�a��u�-�!=\�?�c�(�ZW�D��*ɝ����%\'@�I��H����A��.&ߟ���z�^�����3�vi�C9��U8�fCOt%��WJp���[�t�������ٶ��<YO�V:��M C��`�'p���=�bBW�<�g��R7O�4�D�\��Ibͣ|NW�6�o� � :�}�����'��Ğ�=,|�ȟR�KD�^�z |8���b���/�X��n_���6�et�M�d�#}��1a���R8���S��YK��Ǚ�kriߚZ ���$j)���
Static task
static1
Behavioral task
behavioral1
Sample
98b5f291e8245c14b14741d7a72214c2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
98b5f291e8245c14b14741d7a72214c2.exe
Resource
win10v2004-20231215-en
General
-
Target
98b5f291e8245c14b14741d7a72214c2
-
Size
1012KB
-
MD5
98b5f291e8245c14b14741d7a72214c2
-
SHA1
79c0c9c819bf1e243049c240693a812f3a66c9e8
-
SHA256
20e2f0a3ffd4a13b115e1e75004b03abe4e3e19b66e60d4be9cba545207f4485
-
SHA512
0b148a2603a5d16992e2bd3edfce03de15d4716e190fa8f5993d0cda30466d184ffb1caf2fc8d3ed614b5dc435b39d3e7fe9ea2c78005bc2ccf8e1b4ce5120ec
-
SSDEEP
24576:fYTD1E5cmnq0Lq4flPjQrpr8b4t92qrmT1HQEmolOy:QTDC2mq0ewlrgr8bc92LQEI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 98b5f291e8245c14b14741d7a72214c2
Files
-
98b5f291e8245c14b14741d7a72214c2.exe windows:4 windows x86 arch:x86
2ad32e85244e5ba2171081dd59f45493
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileAttributesA
GetFileTime
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RtlUnwind
RaiseException
HeapSize
Sleep
HeapDestroy
HeapCreate
VirtualFree
SetHandleCount
GetStdHandle
GetACP
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoW
SetEnvironmentVariableA
FileTimeToLocalFileTime
SetErrorMode
FileTimeToSystemTime
GetFullPathNameA
GetVolumeInformationA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
GetOEMCP
GetCPInfo
GlobalFlags
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
FormatMessageA
LocalFree
MulDiv
InterlockedDecrement
GetModuleFileNameW
GetCurrentProcessId
GlobalUnlock
WritePrivateProfileStringA
GlobalFree
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
GlobalLock
lstrcmpA
GlobalAlloc
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
FreeLibrary
SetLastError
lstrcmpW
GetVersionExA
GetThreadLocale
InterlockedIncrement
GetVersion
CompareStringA
InterlockedExchange
MultiByteToWideChar
CompareStringW
lstrlenA
ReleaseMutex
GetTickCount
GetModuleHandleA
LockResource
WideCharToMultiByte
GetLastError
CreateMutexA
WriteFile
SizeofResource
LoadResource
FindResourceA
CreateFileA
FindFirstFileA
CloseHandle
GetSystemDirectoryA
GetProcAddress
LoadLibraryA
OpenProcess
ExitProcess
GetFileType
GetModuleFileNameA
CreateFileW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PostThreadMessageA
MoveWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
SetFocus
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
DestroyMenu
IsWindowVisible
UpdateWindow
GetMenu
PostMessageA
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
EqualRect
DefWindowProcA
CallWindowProcA
SetWindowLongA
IntersectRect
SystemParametersInfoA
GetWindowPlacement
IsWindow
GetDlgItem
GetParent
OffsetRect
PtInRect
CopyRect
GetDlgCtrlID
GetWindow
CharNextA
CharUpperA
KillTimer
SetWindowPos
SetForegroundWindow
ShowWindow
GetWindowRect
DrawIcon
GetClientRect
GetSystemMetrics
SendMessageA
IsIconic
SetTimer
EnumWindows
wsprintfA
GetWindowTextA
GetWindowLongA
LoadIconA
RegisterClipboardFormatA
UnregisterClassA
MessageBeep
MessageBoxA
EnableWindow
GetNextDlgGroupItem
LoadCursorA
GetSysColorBrush
ReleaseCapture
SetCapture
InvalidateRgn
InvalidateRect
SetRect
IsRectEmpty
CopyAcceleratorTableA
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetWindowThreadProcessId
SetCursor
GetMessageA
TranslateMessage
GetCursorPos
ValidateRect
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
SetWindowContextHelpId
IsWindowEnabled
PostQuitMessage
GetKeyState
MapDialogRect
gdi32
DeleteObject
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
SetMapMode
ExtSelectClipRgn
DeleteDC
CreateRectRgnIndirect
GetRgnBox
GetMapMode
RestoreDC
SaveDC
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
GetTextColor
GetBkColor
GetDeviceCaps
GetStockObject
GetObjectA
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
OpenPrinterA
ClosePrinter
advapi32
RegSetValueExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
CryptAcquireContextA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptGetHashParam
CryptHashData
CryptCreateHash
shell32
ShellExecuteA
comctl32
InitCommonControlsEx
shlwapi
PathFindExtensionA
PathFindFileNameA
PathStripToRootA
StrStrIA
PathIsUNCA
oledlg
ord8
ole32
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoRevokeClassObject
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoTaskMemAlloc
oleaut32
VariantClear
SysAllocStringLen
VariantChangeType
VariantInit
SysFreeString
SysStringLen
SysAllocStringByteLen
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
SysAllocString
VariantCopy
OleCreateFontIndirect
psapi
GetModuleFileNameExA
EnumProcessModules
EnumProcesses
Exports
Exports
Sections
.text Size: 248KB - Virtual size: 244KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 576KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bfz0 Size: 56KB - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bfz1 Size: 52KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE