��n�ǽz�<������d�;��[�58�zy�O��ʣ�5ԒGR�q0i�JU�M����S��.:m��ν��]�6�.�^V�8*�[� �e��2#�����. ��lk��ۓ���hi78��l1���3��U1����8�ѕi~�bԈ����0V�uݛӖj?����GC�L�34�&^�fM^��{nœ��1�f��c�����ޛu�C�i��נ�t�u��DSڋ��I�U2lcnw|�"���lW�@O�֒l{ $�������@�\W�l��?v5֭ O�O�gF$��x���3^�������#��A ^�u ����dꉯe�>���p���������7LYiF��RJ�kt�bUIb�nF�/��B����%�-��`�/�gt:RZ���o��W�P�3��Τn�\�x�3އ$O�8��jio�d��Ŋ������l��ꊃ��������������bM�j�U�z��1�Ӣ�g:�E����4�ĩ�t�R�-��#Aq�e+���"܉��z���C±��Z@Wb�@����1��4X #��o~I�n�r� .�Ѣ��(�7��K�;�@�-s �܊��������}�D�d%M�W�-_� ����-D��~����XByt�p�ފ 9�h�Eڰ*��F�zr˦X��/%��يo�a �9�n<�.ӡ̀Υ/B��N����wA�hnו���2�+�z�rq�H�gr��� ���3Hޚ�g�0�tp�γ��(H�����kq^�X���W����W��%���߽��Z�(q��{z��3�ED�Q�=�|��ʦs� �������?R��N��y6 g��*'�a���oڶ&��9ض�~��>�N��D�? �Ϣ&RbS%����:(�����_B��S�w4l��o��_'T�;�21^�y �G���9~��Ϳ��gy������#��c���s1N��f��t�xF�Mv J �ԁ2�0o^e�X�)vQ q@���w���ul���\2�JH�ڎ�h�!D��݊��7�Â�Y�~����d>�ex�no�D��Z.�x��\��t �a��.LV�un+Xl���F��!�f�x�l*�ϛ��f���>]��G|�v��页k��7�^t���{��V$BG|�"AY�����o$p"��6�|G���?P(�a��Z�Y��Ι�A]��cZk��� y�Y�����c�j�1��i�EmA4���2{�����7"�P��{�1ί!�����=:T�NghN8���_�(j�T� X;Pղ�Qr�LL� 4ݴ2c�n�&��J��=��2Hhj~�`���������v���UR2�K����5�ʱ���B?��]�ٝ�R|S(��/zS�a|� �����(�:J�Wp��Vf����4/*{���J�nM����MW�^�U�ǢO,7ih� ;8��� .��F������*�\)�Y`yj���e�VQ�ٵ�1S�I��G��K���kbd��xa$&����9���DE m��*H{pk����W>��S��!U3����K�[�N��u���Y��JV3˰@A7�Ɓ�ZHqջb�������?��k~-dx���1�6Ք����M��%���ZX����m�F�M��i+���I?����&��f��� x�z'�20�&t\��I@?�y�p��������\]�.��j��s$A��ԒO����<�����j�Jʼ� ~k����J�T~�\ �Ӊ������I����--���:^�/r�R��P�-�Uߙ�5%��8�K-PJ�WzS ��?ur|n�A�V�b�!|;!Ū��˂���{��3Fw$���1Kʇy��ȓ������$ �5yK���(g��gIV�`�]{z���+�8����%!�i ����eqS�pJ�*8����*8ƞ���f��3<�3Y��� ,��AUE���\����|�R��V�����נ��}��2"+�: ���'�����T�< �#-Zm�r���`���@Zݝ��$�|���M�?f/�t�e�]���U�?�`nH���R Y/�d�@U���ԍ��,����ꃌmŒγ�mU�Su��y�·phX���4��פ pb'��W�����ʃݕP�&o�d~�y|����|͗����9_(��q���p�u����y�I"�KArv�+�\�)��|:9���mu�7��]������V���#Vq��㥆���u��O�ncz(-F�H2�ս��gݻӛ�x^b�l������+reZvg��D�P�1��G��H.��خ�_��fHʠ����d�!��>��'��������~���&فu���+�R��?וL��u8�屝F +�M[���7��5*Hmސ R���VA z,�9[�)�3-���k�0��=ҀA�)��"'G6dڨR~�P����<�Z|�.�U��� ��mE@�<���O�S��%�X��� �z���r�"���G�!-|�� ��"��8q�g��G�"������ �<o��m��\V�dž��A��l��ɶ�*��˨�>�0�mM��+9����˙Ĉm ��R<I� b����c~�Y�2 ���:0�).k�Q����Y�����&������ѥp��H.���������d/)^6���6/�?�֗��Gu��ݧ�.�~�WKy���.��B�%�뙭) ��Rc�_C���n� >�� 7QVӤ���RP�q�w���肮v�gl��O7��?�����pII��1��հg�gw�)�Õ�����Uj��l7�|J�ϱ�}emR�2�/�M�r��W"w�]9��1��*��J^/�BL���6,�o;ܸ?����#1���+ON�'w�`�j�JɌEoj��vz9��\"^|Y&pкǿ���cx�[at:Okg��@nX�P�k�>�&r�ɣ�|��y�:@x��E"������|1��횞(�Q��o�|)���̋HA��7i¬��O�����;�}�re,)�2�Ņ�<V���z����U�-���J�Yo��uU��мe5�����v���v+<�\�k�ڈ��,�� ���
Static task
static1
Behavioral task
behavioral1
Sample
b95ac5d7ab6139d178e1a5087edc3e2668f5e631df19341813e1a7bf7b6d251a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
b95ac5d7ab6139d178e1a5087edc3e2668f5e631df19341813e1a7bf7b6d251a.exe
Resource
win10v2004-20231215-en
General
-
Target
b95ac5d7ab6139d178e1a5087edc3e2668f5e631df19341813e1a7bf7b6d251a
-
Size
7.6MB
-
MD5
06b84f8b015c538cd1efbe1e49de8c17
-
SHA1
c7d6a043f59ebb17ce0951fc76115f31891ea673
-
SHA256
b95ac5d7ab6139d178e1a5087edc3e2668f5e631df19341813e1a7bf7b6d251a
-
SHA512
b526112ba2ebf46cf84311efc92e8adc7dbf5aed0f070c9fa2aa55e90882b14dcbcbd03356325209d97a7350821f02f4d87c2566141784c8c7feb5f99b2728ac
-
SSDEEP
196608:07RGHv/WLWUxgAuEJL9BtuaKtSrfkyP1k6eCoQO:07RTaUpPJ8aKtSrfkiedn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b95ac5d7ab6139d178e1a5087edc3e2668f5e631df19341813e1a7bf7b6d251a
Files
-
b95ac5d7ab6139d178e1a5087edc3e2668f5e631df19341813e1a7bf7b6d251a.exe windows:5 windows x86 arch:x86
568ddb42c25b6302cb11ab7b3325a00d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
VariantInit
advapi32
OpenSCManagerA
user32
MsgWaitForMultipleObjectsEx
kernel32
GetCurrentThreadId
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
PatBlt
version
VerQueryValueA
mpr
WNetGetConnectionA
ole32
IsAccelerator
comctl32
ImageList_DragShowNolock
urlmon
URLDownloadToFileA
shell32
SHBrowseForFolderA
comdlg32
GetOpenFileNameA
wsock32
ntohs
winmm
timeGetTime
netapi32
Netbios
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 50KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 472B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ