<K�����쏟rO��20�ܙ�4��ZH�Iz*E���qjwC��<ަ��w��u�(rkL�:G������X����'����i�K�I�A��g%q����k�wRV��l��o_j���1;�9�]Zk��<�v<C�mG����3���mw���w�D}>h!������<s�S l���/l����*����W߸���#Z��3X��i�`V� R����/��>�-f����T.0Er���>�5:�0@�g�s��x3�e:��ߴ{Ɏ"�z������!����t*�������Y���)iT|~� "���5�rUP;�8���ʟDϝ�z��:9��-w[D�,;M�Ս�V_���U �A�k���p�/�7<�,�����b�����X.C�Yz��vW�Ԫ�,^FT��Zq����+��B[�_'���ՋWliGF z��˓9iK�yڍ������+�F�*�5�Y ��E4$+��k��\СŀJ]��4L^4\.���n��h����|�r�O���go�D�������#��$K�-b��Ypv���r!Pz.�H��ߟ �BIl�Bl5?�1�g�|����NJ6_e)�f܉A2���ܯn���*`��hef2�U��� �cK)!���Ƀ���������\�^�����͖�^mbV��9����2ChL$���K���knU��&ڛe�ܡ D�Ew��@7w�r�V5��'�+��ȍ{_3L �A[���XJ.Gׯ0�E^��ȄA�,�p4y"V���>_�����<8Y�%lv�X�����Zc ��8k��X�/@�&=K�n�æ���7���Z�OLd�k�$�m����MǮJG��OFFQ�� ��[�B���}?��c�;��l����������SC�i���X��*�;gV^u��d���'i���O�>��2�!ĨV��8��h6_�������P+TX)�PkɌ�9��.�z���A�h<>*��l�v4M��:9Z �t0�k`F5��f�����.�H�g���ڣhJ���\j۴iх� m q��bn��i���uxz�V����w;�-������{�9�o���UU )�Z$ˍ����Z,msY�S�����[| ��t��_P =��?��1�Bo��q_1�������f�T�� �4l���r��Ǥ�Qr�m�ͦY��@5���Ge�Y��ǖ3�r`�uI��j�8����N��LH���!��J=�VH�������%1b?_�Vz�0q�v�xW����� �=Jn�|�#7�E���:mI�f^��9G��z������f#d!����ݲt�����pW��8��䈒G�����@bM��(-T���S'Q��������̂�����+�\Z���+����� ��gݔ��ꦄ�\���������{3��y ��k�-K������W��:������n������:���JS��� ^1η�X�SE�����4�� ��;��1Z�N�(<����(�]�/�`��D����;kG�Lɔ�{���%D6V^�D����U ��j��f��.��+�Y��ߺ��������O[���v���m�+�a2�O�D���Z�:}>�M�BL��T���{�0C�C+����k�o˟�!�n��R��8ٮ��H�R�X��BD�}O#a�_RX��?����>���+�]2_4�q��yo�\׳+�`�{P������y ȋ(+gX��2>�cEӿ���\�Ur�d+]D/6��ѻ9�Jv�*�Q�������ikW�K�D����Db�hi0;���@�;Y�˭H�S&q|լ>zs͏�=g@^���vh ږvI�8�lZT}t�F��qX�P�� -������T>�,U s�dq�� �5-�I�� ݢ�������J)�I���9lw�/�B�3�N�k�j��������_�<(��]"vz���ݛ�WcG����'����G-bY�V3t�������太�'G#T֨�P"��2����y�e[_��}��'R�ԓZC��>�yX�1��5R�\|c)��0e\��q�N��35uF��:���>G�|䪴;s���'���Ǭ5Kg|� at�/d{�3�T?Vp� au�h�� &{I��>oyi�2sm��:�$��K�'?Eؚ4��&P��t(�����fG�$�1��B ]f��f��E�]P�+�,����߿���姏=R��6-��80�r����RS&'�aY��}N$�֘���W"�DŽ]�Jg���hA��-�!�� 4�P� �Vd�����g"�SIƖ�`���G�s��~���S~LoӏVv[�\�~I�稶Ӆ���T4��a;��f�x$����`�E6hq� ��)Bi�&FӔ�x����O �Ge����� 9�'�hD�x;��G���Z4�!�9��݊a����;?_R�l�u���SK���I@'���X3�ev�o�s��,�Ev��o�lj���BB;�s����l k�.l��k�R�Un�}�e����D��O����w�&ao�DnDkg�p����Ѡ�+��JO�[cG���D���t~o�IN�ဧ��\�B�7 ��ph��&�b>���1�;$m�bP�5��x@9oԠ3NM��=h�"y>��+���@����c����f��C0 �c$6:�<��|=d `�G�8ōY�>Y���*���`J���~ӷp8k ]^hf�(*R�럪r��r��FI�i��:Hdb�;uM�P{�4�h��k!�M���S��r���#���p\F����_��Ri���PR!�y]:sбdJ��Ma��t����/1O�s���j�(�� h���3x�~�SB%l��S��.B���5=��ju�=ؚ���k�>���d�ۧŹ�$���>�^� ��Х���7'U��gt�F܅g�1��]�uH9��'H���{���<�����?�4�X8ߒ�P���q;7~�>Y�F�]�=�����C�� 0� ;Se�e��0�ׇ6�ض��w��O@����y#,��5`&3P=�M](�F\�Ƶ�3��Gjx���ƿ]W�i#a��$���8�q�4�X_��hv���qpU 0Z;2zfE˼pz���A
Behavioral task
behavioral1
Sample
ba243e6dc442f5fa0f9fce74e2218dd5.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ba243e6dc442f5fa0f9fce74e2218dd5.exe
Resource
win10v2004-20240226-en
General
-
Target
ba243e6dc442f5fa0f9fce74e2218dd5
-
Size
1.1MB
-
MD5
ba243e6dc442f5fa0f9fce74e2218dd5
-
SHA1
a536fb3d0eef0774660b172cf2804a38ad331451
-
SHA256
ca81891e0f9c92bafa02b7c0f94c4bbeccf6e22b6e6a7eecc4c6ab4a631350af
-
SHA512
6adb0dfca5225e019b1b45285cb11bb84ade4fdd73a0683d46a9333fc385301c4471614e2f0289d878bc12a985593c84cbb3ef3f941ad8a94275ec9e5c5bad90
-
SSDEEP
24576:IIB40Hf5nOQ7HwxKlv2zP0W37xFbvtmzDWsZrk:IIxBnOQ7HJJ9W37xFBUqKr
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ba243e6dc442f5fa0f9fce74e2218dd5
Files
-
ba243e6dc442f5fa0f9fce74e2218dd5.exe windows:4 windows x86 arch:x86
9db67b105425547d7920bd16dfdfcc68
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetActiveWindow
MessageBoxA
advapi32
RegOpenKeyExA
oleaut32
SysFreeString
version
GetFileVersionInfoA
gdi32
CloseEnhMetaFile
ole32
RegisterDragDrop
comctl32
ImageList_Destroy
shell32
SHGetSpecialFolderLocation
wininet
InternetConnectA
urlmon
URLDownloadToFileA
shlwapi
SHAutoComplete
Exports
Exports
Sections
CODE Size: - Virtual size: 738KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 738KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ