C��olLl�nzR�������g�Ѐ����ʩa�b��_Tگi�����f#=�����H+�Í�]"��xYO�L�� &R1�"�O���T��X�p���N��8kZ�L��1�$e;k�(�q�ѫ�}pz+�-d~�o�s�� %w���G�l��B�����[ q��6�6��F�a�/|S�U#not�,���Z�q��tӠ��k/op��ۮK�����͋���*g��)6B�o����:�/�$��!C��̶[�^���-�������;������~���J\b#Р�an��a������^f:E���������2��`n�s�Չ*��RT��^UU��y�������O�����+jML�=%C��ۢ�E$A8��+�o8��A/V=�}#�?jV� �٤Ʌ_�f`���2V��j��N��Z<y�G�}H�Wa"�\�_^Ϸ�Hi<f�Ϣ`�z�Q�2<�"�B��-Di@�y<��ɹ�쓗rp1C��/��8^I��al��A��]Ovu����E��P���W�bxƮ �t��5ә-��~��< ����L~f�oҥ�P��s��#�Y�ٛ�{(�l�%�|&8��>W����N<xe�l��B���9t'K6Y�=�z�[�>����]y�Ȣa�'��^! l�ػfz�)l�%�����*�p=�ǣ��~ܝ�jx��\��w���!�����1�8r� Y];Z#�8��;�x��@�����z�WHO���6{�k�C+q� �?�8�j�B�����D1x��^�����w�6��1�ŏ뛹�qe.?��k�#X�8yP�@� ���E_&�ڏH0J)Z�8�� �|"���!'п�+��;�m�)l{�NҧZ��B)������E�s�p�ۘx��w���t�FFbJ�����!�%jN���DR'kgJz8��%�[�J�6�Lm;���ޞ�uV� 6���ڕ��V�oD[W���,����"�B���&|�& 2i{����x����t���}����{���d2kᤌ29=�N���L����3�BGC�YO%�mPr�h{�*�<Fyh������Bsb䶞�} 1_�.`�XF��I��qj@a�!E��<���*W��2(�Q/,��1��{����|ƶ��~�HDG/%���+>R��R ��R5��; ���D�Bla�(���f��0�柌E ͼBIwQ����O#�F���&�WE�������^�9�WJћ_�R�����С����-�� �l��=��b����Z�1��OJ�i�N�*�?f�C���v_k�����!~��k�$e�l�Z��+ڌ� ��z�a������݈Q����ZK��-u��q��?ރ�y?��9sCs���o)8��O��9|���G� ����_�8:�8^s�4:���%�O��'r�T��V�C�lc�s��51rE?��5iw��x�䨋��RrF��y2gϾ���F5* ��nj �/���ϪQt˳܂'E�5-��� c쑢|���N-_��'�O�R�����N$�k~�h� ���=�-P~VYKtp����lV!��=�'��4>�� ��)�˴�`�'�O�h�|l��t��G�(�������X:�:"���#��M��(�������6�'�;�ɢ#��2��c�Dr�0���2N���k>{i�؏!��Ī�+к����m@��N�E��:��L���|a�訟6pI���Hke�/S��`V����n�(6d��SL��"��5ņ��&��Kt�M�0��%�β��Y>�=�}��Z����+�o>�-#_s��$\8߄����9�a+%��s�X��&��Jb͠&'n`�@�5��������=#O�cwNwl���֞�U�N5�P�U�-0*�F,���m�L�8�����]ۏ�.����S�PN���w+��C�E��Fk�VϒPH`����EEi����T{fZ��h��� �)����U�i��ZC�0���ǻ�0��;BY��@+.�W"i��f��<8��� �S$g����6N!iWT��j���Rao@�d�U��H�=��f����P�ș]���BT�1��j�)_�miTˋG�V����.-�)_9�����s����krlZ���&��Hw.��5\ȅ���r��q���j>��G�m+0>��&�~�&��<�r����W�8�t�=r=p�����Y^����n�D]���2�I�����=���.�HJBA�s�n:{�euw�i�p���\���<�h��B ��������]��?���^;E"X�%��*��t���}C9�+�B�x�9��7����x�����<;DTҿLc��~` ���hW��E�1gm�]U�l`ҩc�"S�H��m��)h�`k�� ޒ��m�O��^�RC�Η�!���-ӛH��"Yc����y�XndxPlR?���ˋD*�R֭C��W)�x)�2�^���2.e�[�%+�@�;ݡDɕ�/�,�&K���I�����/�){U�Ϩܸg�y@ҍ[0��`��3v�ֈ`��u�7D[��Q��3��bs�e����9�m��9��F[�F�{�vi���n�ɲ#;"P��y�h�ᩓc���Ą>�Cg���7�5T8˅3�k�_d�4��S8�� ��𱁔���l()�}���gh�����x ��ZWx�܈�K�� �W<�� �f��_�q��v'�u�Yu(�5;_�)] ���8q��?_×�_B���|?�0��Y�$����3Dt���Xh_e�r*�Y������J�n>l�T�tPe�@�l(����4Qu��}@q�����I|mIh9����E�^!8��?�Ƙ6����d�����^��;�H�X�P�ø'ԡ��{����#�f�ZA���U7&��K�FY��`ye���DP@�;ُ�>��A��z��ʃ�;�6(q�]A�Y�kO2�Aɪ���������{ݽ�|�M;��yT�B���'p ������#��֦m��e� �������zb'�5��ڣ��Q=�|b����$�&P]�`�e{45b�,Z( �N����xcE�h���֩J��f�;&���
Static task
static1
Behavioral task
behavioral1
Sample
630ac479dedd0871d0ddab0413c56a3c8da26a3047f983ad62494861db730b36.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
630ac479dedd0871d0ddab0413c56a3c8da26a3047f983ad62494861db730b36.exe
Resource
win10v2004-20240226-en
General
-
Target
630ac479dedd0871d0ddab0413c56a3c8da26a3047f983ad62494861db730b36
-
Size
5.8MB
-
MD5
90105e3e63a2593029d65a8a6014383f
-
SHA1
eec7d0d8e711af7595ca612a3ffa57261b4495ef
-
SHA256
630ac479dedd0871d0ddab0413c56a3c8da26a3047f983ad62494861db730b36
-
SHA512
6032bf3782ae91f1d21ac0892480350dd83d6cf2d7c2b5de3cbf9dd915bedaf68736b378921eaba46a59bb4e7d0f365523c6382707112f4c0e461df6b3923a2c
-
SSDEEP
98304:sMuTbzoAF5cDXgSYEKACrghsIffPuCAsXf2fYDgKfEJDyPmqlG:sMuJ+JlCkhsIHvXXfjfk+Pmo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 630ac479dedd0871d0ddab0413c56a3c8da26a3047f983ad62494861db730b36
Files
-
630ac479dedd0871d0ddab0413c56a3c8da26a3047f983ad62494861db730b36.exe windows:5 windows x86 arch:x86
dda846ebe23e11e43f78767a2ab18168
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostThreadMessageA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
ScaleWindowExtEx
msimg32
AlphaBlend
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
shlwapi
PathFindFileNameA
oledlg
ord8
ole32
CLSIDFromString
oleaut32
SysFreeString
ws2_32
listen
wininet
InternetOpenA
gdiplus
GdiplusShutdown
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 510KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.4606460 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.4606460 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ