�Я9���)}�d�dG��W�em�[�Fֵ�ߦxd��������;��T�cn��= /ԱW�<�БfM�˒s�#ECt:NЁ��n+k>j��$|����#|F���#��/���;�_�o};���)Ð�1w���X����5VйS����g�/E�3�s����������w+�gSH���I1������ k9�=/4��vğ�x{J���3���b���͎ɦ�i����F�,VKI�:����9���1��NGz)��vg��_z���[6�Q_���r�d.O�b��7�n�ڻ9`?Țsu���3U,\�����865�n{���;j�X������X��NЊkL�:;`�1�:���J��S\ ϕ�L��P�E5"�|`w1�6%��t�ݨ�9�xU !5ɐ��aP�nb�J�� [�H�c���� �W���Z��/�4�R�4�t��OyͩL?��#�[�xr?%b1���n�I�4i�7>(W;}b�Bm0��+I�����I�������d���ӿ�X}`%">�=��qۗ�%f��D�^� \�o�-e��������J�q1#3�0�����i����OibR�$���-8�P�e����ӧ�S�����"�z\�Pt"r̢mE��M��̑�l��ȴ9�� -�{��d!�?!���Ӿ���@�1��+;6k�x*Ȉ��ʛB��J0Ǧ�}Ѵ�T���<@s��y~?�w'?�f����f�>aQ�������r�<ފBO��9�kFw�������&��8����A N-�i�iհ�mF��;�� ˢ8�,�&X��j��Z�����B��S�L�bUN$��ˢ��e��Ȩv��;w��O�>��x<љlW~a����Z7=M�����-�ӱ���N7eQbJ��ޕ�Qd"��E�đ7N%���q:�-�.�K0�{����]*H*B��E=�~RC�9�=}[��Y7��2o:����O.��c�GQ&�Ň��^�۱���ҽ��B���]�W�>�\���g�@�\��X�Sa��L�@L�`ܜx���m����_X�$E^�������3�3��t��u �2K�� �5y���@�G�4j?�GU�b�6e$%;sHV����i������Gj����毻=���_!�OP@�Y{����â�+3�A$oד�N��D߁u*Pu�H�w��O���Pf,��S���x�^�#� ����r���e�6���2Tt�Q�����r�x_Nu`�Kߥ�i��]�w�ߊ�]��ec�1�+�F���[At�����ˈ�b���X��1@+�[)�x� ����_�r��E�� (h�^ʏ�Z��7V��;�畋���|gD˖��F���P3��AF�do���Ɓ�^� z#9i�7���݀�GU$oI����6m��y@'�a���I��p�:͉R7�YA�36�.���lE(�ꨳ�d� Z��E����j�m��/����,����e�3��4��YR�������\��nկ߁�C�<�����m�U��S̳�5'9I�V�9����;Rޯ۶>�!D���gLI���t���dn��!k-^�-��k��I ��]� ��{���[��al�{I�4}���t�*5����<�jq�������Q�� 7^����c�e���)<�*���;j�|���r>Pj��co��4�|���e�'lS����.���\?���:��;E�h�u�2D������1���"�~�"�X5ޠ&j�-���(�����_v��Ifc,�\�ݏi���/�����_+�\��C*�!�e���������ɛ�vu����Z��Wl�2�akNp#r�)٠�>G��ɷ��K6g��+�_;�R&�s�� ��o0�l�k�ss��5̽!uܐ����H�������8j:����w V��ʃC�����D}���tr�8ś���7/��m��j�3�<v<G�T壟&�,���ߖem����al�EH��Ѓ!����:���SΡmBJΓ��͕� �;[�gEm{j{�a<y���= TZL�4�@�����_-d�w G�@�� �����W���) #�`� !����X�K��n���h��.����&�T��->��-��j�ӝ+����g�Ő<8 ��bP�<�����Ӎ�@�#sm`lT5��*�E>�ۑ@�#V����?��pm�������!x���#[3$�\���W�� �����$��qCZؕc����;0�b"����ػ�&��(yG+�;�c����Y����z1zT�ޓb���K�I�m�����隻V�U���*?#���p����iW����?k�_��V�ۥ� ���"��������(y ���Xh�9��O�����|�N\rsaj�T�XQۤ��o_E ��D���u$t)�n�7���O,���qZ���:������{���M�����HH;��)L)6�QB��s�4�HG��|����f���.�������۠L4�AR����W��@��S�i�a�ߴ8覾~���ڛi��8ԯ��M5~�Q2�͙��BcH}���U3�AQ���Q�@��sx�@����Uǀ<��}�V�/"�*w�ߪM�za|t�L��0��qDOP#��Jۈ+��z�E|AȻ���E��uÎ?������y_I��3c����b�S�iPLZ�����#k|�j&,��D�א�Ӷ��.���Z͆(&]tK����_i���} \������[�����5�4)�K��bt���s݃��tPaȄ�m�~�<��������Q�џ�6E�e �h��N/g�5@Ǐ?%D�r�l�3.,��wj�Vx*�1�O���Ⱦ�u�$�F�-���c����jR����o�����d�ٲ��c��~&��zB�ͱ�>Z<�$��� "�{�� ��P�MM�d���ٲ��H�Z�P��� �~� ��i�0/�.EI�����*��b.O��F�kiO�y����.4Nx���u�=��b��V�܍��x��� �3�á@62�I��ψ���.�N5X1̆�����e
Static task
static1
Behavioral task
behavioral1
Sample
8d3628be7f83d6928db8c594e7830e2870cd35e54cf6d896f05321e31a310af8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8d3628be7f83d6928db8c594e7830e2870cd35e54cf6d896f05321e31a310af8.exe
Resource
win10v2004-20240226-en
General
-
Target
8d3628be7f83d6928db8c594e7830e2870cd35e54cf6d896f05321e31a310af8
-
Size
8.4MB
-
MD5
c45ecf80bbf52f09b77dade6a9974475
-
SHA1
0490fbce68d757c727e397c2816822cf36e75520
-
SHA256
8d3628be7f83d6928db8c594e7830e2870cd35e54cf6d896f05321e31a310af8
-
SHA512
9fd794f74d38eb99ea66733aa2b81672d185fa9e4ca39b38a7238af818d09e85c37631bbdd914132b40e3fc1c1050b1a7f20de2f425371e8f1e2981590c589c0
-
SSDEEP
196608:y90I/XWEu11gGkMJTjAjXm5VO5vOPHpkQtKBiu:yWI/mEuvgGTJTjAmwOPJkQtK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8d3628be7f83d6928db8c594e7830e2870cd35e54cf6d896f05321e31a310af8
Files
-
8d3628be7f83d6928db8c594e7830e2870cd35e54cf6d896f05321e31a310af8.exe windows:5 windows x86 arch:x86
c388dc8c6f3e178e6f524baeb775bece
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadIconA
CharUpperBuffW
gdi32
TextOutA
winmm
waveOutUnprepareHeader
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
UnRegisterTypeLi
comctl32
ord17
ws2_32
inet_ntoa
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 552KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 959KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
XuanWu0 Size: - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
XuanWu1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
XuanWu2 Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ