�̺Y�6l�!��;�\o%��i�=�=Vl���t?,E�j��2Lˤ�u�I����|,���i�sK>�՜`�d<F~�5-�,H��^��p��cF��}s�.���;��%e�I&EN�V��[��`���p#�^B�}��L��gؕ&��h������|J2�6ӊ�EEn<_�D|} {�t��#���F����H�Q��M�T�>C3��_��jؔ��9Yl����d;qc;z��"ų��AF��;L���T�F���dǓRs;A`}*C��%�j��w� ����M��sohg��~�Z�䡍%&>�R�6����\X:Vz`��\ih�^����q�̺=�g�h ��rfLs��|�������G|2pؒ�m�7]k������-�2��x� 7O`��]�� 8^N��hE�ۡ$��f(�95qd�{���.uL=^��X�o�f+�N��!.����'����a�9�l�:�N��W�g,�i��uo::�����_�e��5�x�>]�Kg�I?s�]��!ڍ���F�6�'<�����#������M6-,�x�d�:, �KyaC5P� a�b�E�&�7q,`=�x��~& T���F�>Y�3˨�� �((Hbaq�����S��h�S写?d1�z��$h��e��_&�*� ���s)D,4}(o��K�W�օ%f˚�Y�@[1/�����fY��+�.��/��KR����m��3�g-S/��|�V�����ܦ���B���]�g��v�B_�o� 嚜�uyfGkP���y�~rp�����6� S��g����si`�N��w#S��IL���E .n>OV5�RW?X�M�LSI��]lH|X���P��_-f��[�=�4����K,�庮@�T�e�ke$�G1jW��DIԕ�t����V��y���(�6��9�,�"a,����}HYR��p�dXAɤ�ɵ~3.ߐS �z�$�)u(s�i���:r-g��T���RO��h�0�Z��\�?A{�"�M"���AO�c���feM�P�ڳP��N�6�c\X��5�T�z�oг���*mQ���]F;�&�����ͯ.S�e�V�WU����A�������E��C�����$ �ͬ�ł(��VR $t�XԠ����m�U��RH���e�� �G��|�l�ʄ9���&�������Lrڭ X6ܳ� ��XS֩5-�eA��t�F�)\���}po�Ѐg �my�n;r�[x� V��emj���>Š���F ҟ�D%1���.-�È1]oS�������Xj�y+5��ˑ-�C�)�C�WZ�$:�\4M|���z�%V�F�ї�;�:9�둮��~���ݥd@(�����?$Wګ�0�Z\�,�_Q��w���'(�RiQzwa����W�l,�K �hL5�KQ��3���Z��E��BE��:_������S,a4 x�,#k%���h�M��h�1�ϔv`-�� ����������Z�L���t��%�5��x����d<��j�̳��Ow��]�Q#��#?���T|.[�If�K9tϮ��e'gp9�K��$/D�$�� "-K����>�>��\I;���OS���6n����A@�!�X:+Ԅ<��g�)Jl0u@3^O[��Q^I��N^9�눕H���o��2���{ko+j� �9��������=�4�m�@�4ygc�����sN�|���zl�Ӭ|�C�#�ÿ����+��9ʙ�\����N��ڊ�-Ni5l��^]��� |�?"\u��X;zH~p�[N9�`A��`�#�o��G&�$?�A�lI���E�g���\H��d$g����Bs���07�Ԑj2$r�Q�A38� o�,��U��-h��4�&1'4����'�]�ܢ[Hͨ���,�-�Qj�n�YA�WȽ �Ax A��F��)�HT)+&j���6@�� |���9�ޔv)���f[~��a��I�հX��B3?�����(�^�������:ol�nKT>ds����2~ՖGePn�v���!�H�X ���[{���N���S���� ]���u�uewb�>����Ot!z�0Z��M��8ڑ�TR}f_��C��e�t�d+N�Wt��3b�ԶC����X\W���I���]"��jbPIŌ�6 rd��7n����XQ6XO��Pek��c�L������$Ed������i�����b ���xLά���P�"8xS���i��b������2Gc��B����w���+l���U���uM�9�) �Ɓz�5�E!�j �_�^�i�w���������L��)?W�vзd"��.�5�L����ڳd�>3������9� 7���lZ�������Tʼn����p��� �CH��$U>������' ������q?�������>��%�%?t��f��x����_݅Z��S�LDvĠ���U�Y6���l�B��{?��`ЫC��zM��/ܣ�¦��0j����e�F]�Ճy_�l<ۣ�a݈�N����֯�ZI���v\�0h�C1{y�e�5W���|�A��i�a���$�s��\�D���%����,��qiv�T�Bi� 칵�Λ[�"�Đ�/F���J�ί�[������{vh�����M��=*��Jt�dw�����^��; 9l��*����|9C��W8�E��W�����i�_ۮH�k��E�u����� Bh�Xٯ7=^��WH+���G�R�(�Tvho�8:�\��1�2a�:�#�G���IL�}�n�3�{Мu1.E4�|���l1�2��V@��W�j���*C�u���?�����S6�����Wm��TIU�*�����NE{\���P꒲�����Z����ʵj�U$������.L�y,%t����Y�a�@Y�\��uca�B���Q�%����W����!ո1uA\�R-`�����p���#蜅:�A��w&�"��c�����C�39�IzH�:�v�~$(�� 9���b7�x~u�X���������El�4ǎ�D{O�D/��5(3�N�F<u}g̡���s-��Y}�E��ձ�Q;�!8��q����@��N�(<_��Ga��
Static task
static1
Behavioral task
behavioral1
Sample
b7f3d078436ebc6c2154ac4ac46c6862.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
b7f3d078436ebc6c2154ac4ac46c6862.exe
Resource
win10v2004-20240226-en
General
-
Target
b7f3d078436ebc6c2154ac4ac46c6862
-
Size
1.1MB
-
MD5
b7f3d078436ebc6c2154ac4ac46c6862
-
SHA1
85f53c1f6742645433471a6540bd493ad10970a9
-
SHA256
58cf70a2c2ab037bf2df00b9edf72f070cc067b4fd857e8e8e1f6d9cb1ae2429
-
SHA512
0d699e5f6ce5f158d09fd2c916fead52ed10b6d280a82ad53df53f52b22b88c00b26be72a312cc9b9892fbf8024ad4223a5646a872fbd1e230becacb28c81f73
-
SSDEEP
24576:HKi2mPl4Ix93ClmZ9hHdrzDm6hRRWj1Hx9:J2nIulmZNTmEux9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b7f3d078436ebc6c2154ac4ac46c6862
Files
-
b7f3d078436ebc6c2154ac4ac46c6862.exe windows:4 windows x86 arch:x86
791e5b1d54cf339f10bcdf5b01588640
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
winmm
midiStreamProperty
ws2_32
connect
kernel32
TerminateProcess
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PtInRect
MessageBoxA
gdi32
SaveDC
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
OleUninitialize
oleaut32
UnRegisterTypeLi
comctl32
ord17
wininet
InternetCrackUrlA
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 824KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 303KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 419KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SQuest0 Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.SQuest1 Size: - Virtual size: 303KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SQuest2 Size: 916KB - Virtual size: 914KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 120KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ