7\<�Yz ���R�N�r��n�n<��m�#T���(�影&>�=R��%3��KA`b#�7��yh;�7�&-�٣gކa*L�16(�}� �C��.�� �e1Q��&������s@�mTW�ytb/�f}"(����Q����$U��[��áp�!����o��I>�m�l�3F �=���+���/%��+uɝ�C����j@�oa�b�������EM� �L5�D�#���́le�i�$�'4Cϓ�صvr�!��;��P�B� ���Y���%�1π�P̖y�$a�� _���a�p�������0�«�����ЫVA-�����3�+�)~<0.� %#Ȓfft��Ee�u�rlGӗq��#�Da�����8���F/Y2pK>jz��?岻��Ȩ��n0���_d,�"m�S8���9T7:ˡ��1O��O�5�)1�����7 ���(.�m$��F_hf��m�f �g����#�GKM����#_8�EJlg�����XgH����]O�����BЬ�4蕉����3o�B�G�,�ߺ� Y�eXԹk� M�?��=� �,d�Q��c�ȷc�|�v�ȋ|�]d�S�g�����lj�A�r�o�B�:�i�d��kԇ>��w����I����[+�6섙�r� J��f+�o�`| �H���a�d/�]�?�ʣ(V8B=��лw�H��o�e�2{ �{5���Q�b%�j��E�D��5No�,��0Kr_e�يg��M�\T�p�U������R�Mş���D$x(�N�] 2j�Nd|��`Ti��8���59|�ܤ}������s���73j�T/��Pk�������P�4=����䫖O�Y�O�8�����O(*�̪I�>0t��mHuDz���W^�w[�p���Y��A��� Y(.|�MI�8QC�@`�K1ߺ�h�sH#PN\��[�����J}t��&9�g^�i��`�s��`֔�#džd.���'�z�s�Bx�mC%����V��_�֓J���AF. �F�hX�A�Þ�G�D:驭���Xx��A��A����G�ҥ^>�;"//0�j���J�Z�J�N�UBw��_<��������}�(3I������� ����E����+��!*�l�^���'��P�iY��5�RT���`qK!�4aCW`�B�_脇�D��^�"��L����a�IG@�#?��뙧�tY*Œ[@4���J��#Xֽ���Q��A��&��N(E�1�A���/t�� �5��+�-�I�A����a�T�����������qF�44y�ׅ��}�Z�Uh"�[��-���"ݨh)x4�����������ɏ� �&�a�dI�A�+�A�(�kQ�U����ϯۍ�T>�!�h.N�������v�$�{�6���v�`3���";��M�5^8����7�VVm6���do��AБp���>���:�et����M��ƴA�h��,���$喑|�K[qI���{�O�:4���������<9Hq�z����6 �]�)�$�=�;T5x��%-������H�O���0drs�SU�(�_Y7UT9���4�poa��N �q�\}/��5�ʱ��W�����6��/hIn2�� �Y�I���<��E�.4cZ�P�D��а0�:�X~5���l����͉�`6�cƮ�*+|�>���b���2Q$9m0���H�{\�i���D)�A;� ֪c��$�Jﲦ��ʑ����{��v���㐏��yh}�yFQ�}x��]ÍH��S�ޢ����\��T(�������A��"�"HC�N/���#);[��ζm}���J-�#��c��Tkw�.�D%�W��y�Q�,����΅�y�0�l�r��=�}SԄ�"�\�A����6�.����:����Ҵ���7|��ƥxJ�-<f�ɑc��YZ.H����7�/h�q��Lxtp`�%���.�R�����f�J-�=��ђ*�Qf��i2��l����Xp?���*���d�U�~U���b�9��Qʍ���-=��y�O��Ё51.�;��E�^��y�U��&O��2��w���r�$�AQ�]-FbU�+��\�aT�DT�¸El..�R01^Z��6��8��8_�^�_��!sq�0T�]zE|��~;�V?>A�ﴤ��p����LcY��+�<��GR�s��S9%���|x��b���$x^�%���d I^8R��!��� �ˑ�jц��xOjM�u�|/�P ��e:X��;H�z�{���BG TD�#�~�f$*c@��V���z��a�]�9ti՜����Ӭh�ۋ@Z�~��<U�̘�Qz*���$Ӂ�F'��S�J��z%��5��oFz�3GfLh_*��t���T�&dpw?�1dLJUb���,���|c8�f��O�(�K<�2����Y:+���+ۗr�긁�8�5@���Y��h-��D�d��9��4��'�5?�e�5�˘�� �UF>�5^���2�4�D�qz ��9n���2��ꫢ�%�R{��,K83 ��Z`wlڑ_H`}��~`�&p �Ȇ�o]&����Y�D.�zm�k�TR�v��a��x^������6� D3/��B8�� el�9"UF�T:��v`\ZeX�s),C�^�{pW�^-��/�{k!o&b���Q J�jC��VpG`ZD&�!�)��Wx���n����H�)��v�)8#[�ᾩ\w�m�� {��%��}��x[�� .вHR�>]ʶ�"y��G;���0����}y��f�#w�P}��u��˿�6!����0�����<�]�2�[:�!�L��SY��U��Jϕ�w��\�]�I�������a��kC2l��9MnB��ᩐ��49C�x�Q&H����*n���������`�^���K.�"���:�ؖ�0�S�^�Ȟ\C ��h!�g�C.h��+F���,}�!#ۉ��+�yݴ���B,�1���.@Q����YCAp���m���*�.�T¹ُ@�d&��� �S��h�Y{&���e�T.{�����렅c�͈bB'L?�+���Vizˮ�&q�j,zIʘ��h�OGn@f
Static task
static1
Behavioral task
behavioral1
Sample
bb5c36f878bcbd937bb14717504aa539.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bb5c36f878bcbd937bb14717504aa539.exe
Resource
win10v2004-20240226-en
General
-
Target
bb5c36f878bcbd937bb14717504aa539
-
Size
3.3MB
-
MD5
bb5c36f878bcbd937bb14717504aa539
-
SHA1
8474d61bc08047279880bc203804b4e3518cdae4
-
SHA256
e84abad06abe27593904a9faffe8acd14951a4d33788159af4a23c41d5944ea4
-
SHA512
1a43bdc8cd476e1e73b418715986174aafe944cefadd17bf93a21bdb4ebaad49b0c7f4a2fbdd3e0e4d396e3b018a6085c6491368f5935ca76995aabaae85253e
-
SSDEEP
98304:n/Pg2kgtHIWeX7xATXAY1PtphE5vv/B6h1:nHg2rNeLx0wSPT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bb5c36f878bcbd937bb14717504aa539
Files
-
bb5c36f878bcbd937bb14717504aa539.exe windows:4 windows x86 arch:x86
981f1abab9f129db700f837d5a9a58a7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetLocaleInfoA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CreateMenu
MessageBoxA
advapi32
LookupPrivilegeValueA
oleaut32
SafeArrayPtrOfIndex
version
GetFileVersionInfoSizeA
gdi32
GetTextExtentPointA
ole32
OleSetMenuDescriptor
comctl32
ImageList_Remove
wsock32
ioctlsocket
Exports
Exports
Sections
CODE Size: - Virtual size: 808KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 551KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 380B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ