?�VG҇(tD$�Ǿ����yH909&7�����PG��=͞�Q��z��3k��Ib.]�� ?��� M� 9J�~�m��Y��6������2h7�����+��=�#~�� �~��@���"I4��pR��9|x�ܔe��]6͘zp ٌy�*�������Z,"��Gl˽�Por�� .�;(-X�f����#����70�C8��Xvխnx��� ��?}#��).�� }���L����T���������]���Te�' -E�vwk��'eʘ("�e�Z�*#��X%z!���z���h`�whs��2��ƌ�w��.�Þ;���p���L �u�}W�[K3]�d�՜��bkqm�)�V�9'/�h �Ù>��H8�Dd��k�М���ݻ�V�Pvݠs�pSH0�=O�Q�.P8�7���;��6�����q��������4�������m�qR\��;(vW�[�| ������Ӓ���a�e6`�%�#�7h��W���`���8V�gk��G� �2����\bz�R ���7p��T�^;Q�߹��уW��D��#Ң;�/��k<���,���S μ,��X�t.�ߧ��Z�8ՠ�Y��C+B���Q��D���5������7��5F8�B� E=�RF���L�Z�����~ݤ~�w��ܸm6��nx�%��Q9��F��*u��,��á��z$��5��Ju�y��y2����t_IVq�o;�Nuvh���-�|�u�뿲 �=HGF����ưK� ��౾D��)ҟ���u��MÂ���!'�S�'X,��5�Vï����e����[��kk#LJ���Q��!�u��)6�N��7�Q��(�����Ėo~����V8:�]ȣ�o[Y��҆髬ù��2t8et��FRsa�q?�Y��+G�;|�0\}]�x>��> YoA{E�Y]\�QEs����E���U�1�P�� (�(������j黐ݏ��>߂8��<�/aei�]��wmY��B��=�f����9��[��nG�t�r)°ӓ�n���.J���&)U�y��fj̿\[�����@�o���}���c���5s��ƽϤ�.�짬-��50ƹ`���k|���&����� �_��p��&�0�Uf��b�-N��3>̋��iT�b��Ź���5������=� �<0G (R��8:���@��̶W(v<��oܵ�ͤ�-���c���OQ��M�^˹b��>��}��>;l���ۂ���|�c���1Qh`J����D��ݍ�ͪ�+� ���c���/��˃l�C��zQG z-��W4U ����N腚�Z���37o�:��3�D��c�QRO)jk�e�y=C�}%�A�ld�/xA����V,�K7:��� K|�-��t�Q:3�6�CDWp�qui;��ck��-�Ka*iD�϶I��o�2a�ay����𤯈��˘�.����}�<rc�y�PU���?� �+�늘�?�0���d� �f����� y�~"�j ��l�ŻR"=��I���A�˦x���r���q�)$�"�J����%-����f�> r�/lAt|X��I<0X@k�����L�ۚ �L#��g3z��E����0D��~�?�̹C�y�\u���d�j�lW�$y<�#,#J�Gh;ۣn�G�[�����0�W�yczP�#1r���p�+1��}V}N��P��K�s)��*��H�u��u�:����F��;>��)�ʭ�,k8���h�@�����==J�]/K�f��E��-bK'b��@��f5� ��w9vg�1@��4�[�9�ˮ�z��q�ͧ��J��M5*?e����qt��C�� 䘕�Җ����Szߏ ����Pz��H���� 0ァ�j����g�=������ϻ�խ��g�;��>���k�M�!���� ���."p���W�L��[IV�vf�y��)��X�ej�tIR��$����E|�TR�<K�B�nj#'a�w�/?ӝK�IT�9$B�7]iR~D`k��m |�f� bF�3�0Ќ),~����9����t��������ZEnya�f��HNS�k�\9��rO��A ��D��\�d$�6j�pyTd����.O|ώv �t ����0e�)������dQ6�{����gDD�K� gN��]m"� �:=t�H ������tʖ �#�(ƋU�����+H�9Y�-c�_�V��ʆG5���ֈ� V,U��?�5ƽ����t.�=RQ����l$q`���2���,`�_ϗyT�!(i�Ur�ͤ^%f��y�W�}������)��b���b+U2N���&�F1�>p�����$&H�D�#L�'�͛��͟���7D����}�۬��7�ᅄϰ˧�$s���J�A�ī�> �1��FA���ʅp�i^X��T/r��� *7'��J�#�튫������@�X_DX���1���q��o�@�i���5��DY�K\��'� �E$q?����ٚ��:�?@< ��T�$��P�Ҧ�����V��,�x��,��@��W0�BE�N�Lr����n�zEM�u�#�=�s�=�{_�L(�������n���W��ĞWR���}��5�U*������;ur7�MIvԟ�"T|[lW�ش�;����61%^���O�VX����<Y�-t�$zpp�o@�s�B"�cmƢa��'����� h+�T�bJ{� 1�S�It�����py&_�G4�k�!�8Q*J~�t�|��H�X�;�����"�U�+G9��A>�6=���f-!�-�NFp�zbg:��5~���'c��}.|_��jkx�G���dS��y0.'��'+R�ҋ��)[����RI���ȯH�/��r�U}Y�\:kwF8�h�ti$�?_��>G��J�~C�� 1� �Jp�j]���N��6zϷY�&yh�:�ǎ�)!U(��ꖞ3õ%����ᔷ����j��w����۽>eeUK_b��;�ذc�<0��!(�𤴪x�|���ٸ�?�ڏN ������
Static task
static1
Behavioral task
behavioral1
Sample
156db6d49a0967edc1b1d010ac3b2a31c6df94fc24239a05868929afb2d258c7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
156db6d49a0967edc1b1d010ac3b2a31c6df94fc24239a05868929afb2d258c7.exe
Resource
win10v2004-20240226-en
General
-
Target
156db6d49a0967edc1b1d010ac3b2a31c6df94fc24239a05868929afb2d258c7
-
Size
4.0MB
-
MD5
b3c06844f466d9721c2547d91815f325
-
SHA1
a43b3b466d52f15ae7b850d52feca037525bd7cb
-
SHA256
156db6d49a0967edc1b1d010ac3b2a31c6df94fc24239a05868929afb2d258c7
-
SHA512
981925bf363bfe14b4e02228a7e25a45568c40ab5b7a5726400e3a2630b5067130bee1ff63592ec3b9443cc78332175efc4b01062a0b24952e261899218fa4c6
-
SSDEEP
98304:AmwdSSsVgisd5baO2+NgOJv8g8cMw9ZqU6eMKILgAxYeIx/TX44AiYKAS:XoYVgisd1D2NIp8zw9ZUeMK+8eW/TXvj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 156db6d49a0967edc1b1d010ac3b2a31c6df94fc24239a05868929afb2d258c7
Files
-
156db6d49a0967edc1b1d010ac3b2a31c6df94fc24239a05868929afb2d258c7.exe windows:5 windows x86 arch:x86
08044dbbe4099ca9740d84e31fd555ad
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
WideCharToMultiByte
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsZoomed
gdi32
BitBlt
advapi32
RegSetValueExA
ole32
DoDragDrop
oleaut32
SystemTimeToVariantTime
msimg32
TransparentBlt
comctl32
ImageList_GetIconSize
shlwapi
PathFindExtensionA
wininet
InternetReadFile
oleacc
CreateStdAccessibleObject
gdiplus
GdipCreateBitmapFromStream
imm32
ImmReleaseContext
winmm
mciSendCommandA
winspool.drv
DocumentPropertiesA
comdlg32
GetFileTitleA
shell32
SHBrowseForFolderA
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Exports
Exports
Sections
.MPRESS1 Size: - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
liuliulu Size: - Virtual size: 760KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
liuliulu Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 579KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
1 Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ