��Z)�!�ͤ�>���⼡8��'��?wP�턾L&A#h�Z�� 4�����W!paQdp�*� �j1%���@Q�+U���W�o�~"��*�0lw�,5ۜ'G�p�0Y�D1���1�G��\���0+�����)���/�gP����-���ԫ��m� _�דr7~�� η2�&��s���F�A��[��0/d�)��Fx#ԇ�S���Pڷ������.�/�&;~�9Fw�V��yzP5��6Q�Jt��� ��pQ���Jg�l�4�L��ĵ�}���cy�"ֿRE;z&�f����Pw�#���A��o��h��ʰ'oJ6��L7����ˬ�~S�v����R\2���|�*��Y����&w�~x� W�CQ�=F���� ��~1�������4M�R�n�Je�5fD� ��l4�{V[�oV;MmXH�6J"V:,(�V~�'j�(�K3<z�gj'[ 5p�Z���d���K(���E����D��drJ��/M�"��������̀&Izձ������������ȥ#V���V�E+���E�=`4�$���� ���Ȣ�UWb�S��:�ƥ��T?X�_��������������ׁ���J`�*3ǩ�:^ә��C|��]�,�V�3�b3�OTz�§����~X��H ��ҹ�w�'��y2�Brn�����©��e����6���{>� 9!�2���,W$,�-M��־(��y� ��y�+��5�J�;�X��S@�O�G"�&>�����Ny��-8�X6�۪�p�����||�Q|���]�w��ɛd��yko��|��K���A�y��&_.�=[�!U����+;�@� ���� ��1Z�� |��n ��g:� .3�/���4�/���v�0)�3��H|3Z��9 �$�NG���hz�)���0;�vfN*G���߹��}e�,>E���LHt.m�iU��p�����c/�8��� ?{��*7b���u~Bt��0��~��$N����[���t��zg�yҤ?������0o���b��b��'�d��2T�U;$'�d�쭎��o�`�J��~�$;����*���ekT��t,���r��$��`�#4s�]g�������7��Y4��5�~ 7�(-='\z7��imX����b�,�q(L�w{G7�U�h[aƎ������|����H�ʬl�����,��K����4t;��G�=G[6���F�����u�݉S�Κ� ����ʥP�Ze� �f��/�r7�j�(u8�j=Vq�#]X�eNxP���J���M������_Z��Ä�ҙ��- ��L2�8�2ûV�î��G/��;�yu�s�T�v�B�� �4��1���G�R�0����M�z1�U���I���Ҭ4O��s������bD��p;���C\�f �/�~�Dί;}p��9O�4\�� 0[��w��-z��wxG��꾃� u�c���+2��7W6��)���+I���K)lv��,��a�W�䟘����`�%Q#̝� o�R&�]���7�yCF�u�sc,6�K������A�����W;rA�X���&@������a*�Bln�lJ%���������IQ��,k<��TXi�����\ʚ������>D!!y]'t >US��,��^q��?ZMQ�_푆F�k�*�%O�xNP����3��cX���:��4|�u�3��-)�����7�����d�]�����J�Sl�&�g���ܯ����6@��s��T�|�K��{���WN}�9�]�x��Y��S�Gd[� ��3�5�2��of�~�-�7\���}D����tƄn�ti�3�q|(%f�K��h���3�W#�%ᕲ��Pצ$}FO�ٯfiį�Ϊ�ew|�/K�eOMu��n���]�~^�G'���q8h��ʖ[j�#^;t)Yf{��`���d#�7���< ���]-�p�`��|9����='J��8�,�+��V}��� �V�1!w�3⛹d��KD������T`IF1t��%z�Z'�O<�z�k2Ƿ�%k�prY��%���#j��{ϥtK�*8��@6�C@��v�M���p� ��}@XuȤ�_虶D�6�D#e�����0�<4��:4J�����-�p�Q�ɱ�y�u�t�3�3C/H8�����"�>������2l��x�� �]�����X�{�1L|yq�a�4o1��q�!}:��o�f�xy�����y&�n�+T��_,(kU� .���Lv�}�����v:YC�4Z�V�-�H�?���$����qv E�]�Y��/�����"D����ہ�cPʑU�^��~�'�H�~K- �CL�?]:�_1<�?�A�ƛ1���&<����hw�jR�KLdJ3�h��tz�����pX�d���H���η��~�I�D,��j�/zV}5�j�;В��J}���m��|!j�F*[���3/�=�Cw#��V'e ���~/�8$�]b�"(%4���\:+�����=��w��{b!�s���kg�m����&p(# ��2q�]�#Q�/J����~�N�������wt�= �>A+/���9xl�������1�ϐ5���VT����2b�O^U�w���_��E�7k%A�k,�|�/&̌�����Az�o`�,ڞ��J��)/�kd�=��g�龁��� �sED �� %.��ڼ����0��$#>����H�g?/aR��G#`ϱ�#�� ��<L.r�.�7Ñ���3�<�Q[��1�\�p��p�u��b�a�L�/*nj�����(T<;v*Ԅ�]T�������w�GD+%�v��#;���3oK&dr:�Е&�����x~����S��}R&��]�sQ��gW�H80f�f�<r�8+��m)|@tt���G`�s��;MoD����E�Z/�@u�E�@���NYdW�.���>x�Z]�,��J��m4�*�b<:��L�x�F"G�[�p:揳�U��};�jc����H]��JTNl�Q>=FE�Q>-��O��]���h�Y��p ^Wb�n�uՀqv<_L�?a��^-��r����]%oa��Ä�$��b�\��
Static task
static1
Behavioral task
behavioral1
Sample
ac751e32186bc6d827d22a8fc9504316.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ac751e32186bc6d827d22a8fc9504316.exe
Resource
win10v2004-20240226-en
General
-
Target
ac751e32186bc6d827d22a8fc9504316
-
Size
1.3MB
-
MD5
ac751e32186bc6d827d22a8fc9504316
-
SHA1
c39426540dbf2731b8f5842e7d321dcc8c097585
-
SHA256
cde8b26411f4e163a2e52458ab72cda7c47c6fe24107acc94e007170c76d510f
-
SHA512
568d29a168f30d7f26d439a06ef08cb55b26bdbfe934e56f9381883123bec6149b46acd1a0f2becab7f07c63596be61991ea6af063908756328390a5c00849e5
-
SSDEEP
24576:nantPLl8QFwXUWSkjwBKbnkKoCpfNMKG4Vjo4Ssie7aAtgCHACX5OfFQI:GXFNpkuKbkfCplMKGmIVAKCgmI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ac751e32186bc6d827d22a8fc9504316
Files
-
ac751e32186bc6d827d22a8fc9504316.exe windows:4 windows x86 arch:x86
4bc4f97cfa24d294c3a9b59f13a58fcf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersion
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowTextA
advapi32
OpenServiceA
oleaut32
SafeArrayPtrOfIndex
version
GetFileVersionInfoA
gdi32
CreateEnhMetaFileA
ole32
CoInitialize
comctl32
ImageList_Create
wininet
InternetOpenA
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
CODE Size: - Virtual size: 781KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ms0 Size: - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ms1 Size: 102KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ms2 Size: - Virtual size: 539KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ms3 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ