3��$_�����`�u�W�����.j���W�TZ�ܯBӋ7'��0~��O��L�r�\�VX���~L;b�ż@E,8H�D& �i��h���5�Rn]<Y��f���^�=8��H��(��g���)�Z���l'71��#��u� �L33�E@��7��U�R��/~�'�,�P pf�At��������X`��p��C�٥������g��s���E���g��&����g ���+���ᗳ��X]��#g���Ԯ�_j��ᨺ��:����|��j>yB�Q���v��=q�)&>�P�!EX��(@��1m���O�����t0 �ԍ�������"��U����������Mp�>�~ F�LY�����g��D������n�S�%d@�t���yjT���6�>R!�Q�$�[��l��ĵ��b�� �Ym�f= �<M?5�: ��]$�c:T���}m؟. �2øw��?+N��q0b��vJ]]ip� 8�������1��P��nu�>u��V���l��E��]>�"�&�(�{E ��s����Z���s�}�=��?�q)&o��Y�6bA�v3����^9�:}��]���*^����vySȀ�ޚ���$QݩVt�va�:>�f�Z"m�7��$�:q��z�Ȁ+b����"��:�_Y��$X�&F���E ��%.����7y)�;S1I����4/C���\�!`w��q�olֹ��03_=^�".e1^k��I���z�+�9ШSD��]wT���#Ga����"�'�@��a�νř�[<�l�.�ͷ���C�2���x�3� 4~9%[e^o$2�d�ډ�䥼�zXtHu�GM���(SMzC��i�� �ZQ��D����Ȯc����h�K� �-�N92CD�. ���UI{k�w6�]J��F�B��i����w��7�������Q�,�5-K��.�;�#S�3�y��p��z�/�<ϐ�_6d]�ܼZ�}��U�V.���qK$�moW���P��p+�D-���u[XNf~k���������l_�Eр������A��=�/Y><�z�g*:Y��8�~�N���ۨ��_D���8�C�t\C�"r���n��H�6B� BRo)U7$ڡ��s�1�h~o�LG0�$�ci@y��O��ya��� ��U� �Xl=� *��]гx�[�����)T=�T9b� ��6E��|���� ����$J {r,:\<uR�GQw$Q��5�|�-�Xi ���Nݱ"��Nd��� �y�W���/�`;\�i��r��tr<6�������Ӡ�W�oG���wq�\��^T�t618:���~9 ��VF�wJ+�����JջY_%����g������ip1֕=�/��84��d�Q�Z��o����|?c���q#�cny�/?8O�m /U�Cl��6)yU8>�1*ٯe�ѓv����!�'�χ�� �X������g֦��/�w���Y`6eΰ !�%�q�B�c�Gd�6��0t_���0{�+�[[�©��2�`�|GI��l�W���J �k(�g���M�����i�-��@���E�X"�T�xӑQ��b�Fu��'t��}�7�z{L�iG�,n7-���1g�����%ߴ`�[u�*�Zkw�K���uh���s7�q���vL�Ls9n����_�cX���3� 9�?�K�&���v����4&�^�K�u��ߗ�%����:�Ը%l��� �T�J��m6z��n�r�� ��Vֈ���y|�x"r���t�����RA$<O����Y��fc;�b��JlE�D`����+�_E�_���MM�:������Ծx@QvAp|DL��JC�N<y൹�z?ES��-����q`�h��]9�`n�wL/T)�[fs�N����dL���������od5��W�ٶu[\IGM� <�+�}dχ�r�������d|X�K_(B��[Y�F{�i��̮�$Wg��8�u'��Fv"0}�YBC[��f F�z˂���F}!��.�D/ �5\m�0%�R���2�tnjv?V.�J��#ZY��B����c?U�;�$DA����y���t'ğdT�걪C��f�W)�꠶͇��Wfi_T�:���8=3�&��2�+~{��S�,2��DB�� |i6��PtC�i�L�&��[&~�W4 Qš��P��K�qdQ2�T$�Ȓ�˭�`�x�3�Jm����'*��9�&����;S��߭�2?q��t���e`I��f����U٬���E�Y��"c[�<痜�M#��3�)�#)�v�X���n� `$�kz�b@ �,������>�#�O�������-�L�g��Mj���.�#���d+��g��wJ�&�[ɵq����2��DD5C6�"(��~�~�(�_G�N�at���1,��(�,j�{&7PO��}���E�@���hQZd��&2�T��� #d N���(P�"VR�U���ܱq �=����I�ś����}��� ?S.~QGw!�1��݉�+"���W�C������ȑq�A���������_�z���L����4h�O'�d��BW�L]�㪔eV�oWOa�jw��+R^\��J��{�s�0��H䪤ؼ�m���|R�vO ���b�>��8�0�H����6�x.� ��Q�Cx�Q��Som��l���#�Ƈ3����� �?�S�:u��u'j��__+M���N��ӫg�h� �PA�O&��=�~��~?�hIt�G�E��R�� �c���ܝzgK6!{� 0��A��J��)h�'�P� 9h��ެ��6��_gD��4Gwצ�[�x�D��aM�@"H�D L01 솭�` =��<�cHqZ���gf4fLjm�̣�"���<4�OviL*A�j�0E$�O��BF_�.J <b��*z:Y����Y(y���5�b�5Z'��0P��蠰�p�L��އ����T?��`IhFF�T��̀��� 10.��Wt:b}�՞�Ԭ���$n�s�����VB!�b�9)F�M��+Dn���B��C�$uw��Ѷ>���TyO'�}�]��F><�9��Gƚ=f��mGd��B�ף
Static task
static1
Behavioral task
behavioral1
Sample
0990be37a1be8a49f94cf1b4c18f85c364abc007a07edf43d651ecd4f999ed38.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0990be37a1be8a49f94cf1b4c18f85c364abc007a07edf43d651ecd4f999ed38.exe
Resource
win10v2004-20240226-en
General
-
Target
0990be37a1be8a49f94cf1b4c18f85c364abc007a07edf43d651ecd4f999ed38
-
Size
4.6MB
-
MD5
4d8ea29b87a918726498d5597962ac96
-
SHA1
c15c92250d32bd7603cac005b60fa75def03d05b
-
SHA256
0990be37a1be8a49f94cf1b4c18f85c364abc007a07edf43d651ecd4f999ed38
-
SHA512
79a3f8c00a961039a7dbb1b868bcf115a2aab4c6cedc3cf11bf53f8ea1dd2c10c7c6288f6dd1bac8eee70e536af337388b186f67194ea0256395d26786495329
-
SSDEEP
98304:IXHRCbeJixhgqHJPNdXx9qUA0tdRa0fHdigSW7xM/M98BcZud7peHAo3Ku:2obeagAFngR0tdRfHd59i/M9qcZud7AL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0990be37a1be8a49f94cf1b4c18f85c364abc007a07edf43d651ecd4f999ed38
Files
-
0990be37a1be8a49f94cf1b4c18f85c364abc007a07edf43d651ecd4f999ed38.exe windows:5 windows x86 arch:x86
1946a62d5a88eddae8f89a545e9020d5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetExtendedTcpTable
shlwapi
PathFileExistsA
ws2_32
inet_ntoa
kernel32
GlobalAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsDialogMessageA
gdi32
SaveDC
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
CoFreeUnusedLibraries
gdiplus
GdipImageSelectActiveFrame
oleaut32
SafeArrayDestroy
psapi
GetProcessImageFileNameW
imm32
ImmInstallIMEA
atl
ord47
oledlg
ord8
winspool.drv
ClosePrinter
comctl32
ord17
Exports
Exports
Sections
.text Size: - Virtual size: 675KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 4.5MB - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 164KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE