%� p~��:w�gQ�|������ّZ���� ��Ig,��kcFam����u��i���ߧ8qp�z�Q3�%����{���HVi�"\#I��[PV4��ìJ2�D�yCԟ$�;��R����Z�d[O��0�6R���|��M�LVDj6-H�V�n�|�\hXy���Nig�}�O�H*B抡��`IAz~ �+~c��/��/���\�Gu^��ɋt/Z�,�x�u�ٛ�$z�y�sm��ۘ3n�6bx���ј���'O�s���m��MBr J���a@��3�m����M> O���Ҙ�P����{�xR< �WP&�(1����8B�x5���Ҽ<Z��-��y��Mx�$�T��Y'�%�w�@A����t�Lg��P�P�{Ӄɽ�����`��v-&��$璈�P7P+2�>�lMWx��P9)�o��Du������5��3��6;�&3��ޱ/>qN$5�Ze�V���S2N��������CPk�i�^���m�9��-�h��D��.���38��{+�1Z듐r�z[�(&`�Oq.�/���Dt� {Dw�wҘ�E�X�D8w���%�}}䷶�4�Un��OM� g}����0ڟu�~��O_� �B,��`D&7 y^;�r�<%y��D�Pwb�A����:����F ���L��&t�ڌ�ynM����WmR���+�.V��%� ��걿 ?���=�?�4ŐhA�/ z/���;�m�3�kʱ1#� �#���_J��c+��s$� |F��c��8���"sm's�Ti>Ī�w�!/ :�i��r̅rOJiE�D_̮ �= �o�dy��::T��Ea%X��;9� K�m3氌���wNN���Qkc0�oI��^�S,nv��}�� ��K��$�&_f2k���M�h[s�tJ��ު�:Y���4w�E.S`8�W,�c�M��i.qղs{��;�w!<���56ee�sS����] Lk����#~���&� ����\=�M���'z,s"�9@}~�����1d]`S�]�J;��i��//����g�hpe���@'�[�����* 4�:��כ�ŰB�pC�4B�;�J��?��)4�4����f&ޞ�V��~É��bH�+�������S��� ��E�������u����:��T�g��؞��:�%�4l;UT����(-&.%���<�����Jy!t&+&Ӏe���#���7���L���4T���2/A�[2�%cߕ�I�e���h)^^/�G� �ʜ"W�ZV[�mQ�2�����+����=SJU�T鋚{#;���5������M�ZQB0�y�T&rKQus¡� ק��)�8k�L2"{��,���u3s(@ֵ=TeR� �>�[��ǽ�>W�2�q˦�m�-vچ���o7�6-����:�}ٟg���ڥr�Z��8�B��HKZzA��� O���Ue� ���xsH���uG�:� #%������ॆ��X�c�-UYS����n%��(����f��F���/7��t���Y��<0��ݫC����j��ժ�/ջ(<#7��q������MX�jOf<�4���� }|����-C�l \�2?zy))b�~r�U&�����Lc.� ���iC"�'�:/D� �Ƈ��uv?1�nj��%H^��O�d3��'Q�������+��l*�=��H4Z���-1���R��@>ޤ�(�2J��D�-sħ��Вf=��t|��0#��|�G:�6,�g��ʙ���MC��X��RO>��I�M��M�~a��Cpr���ՀF;��Ɲ�P��Z�Yʮ2]=(|q�r��Z���R�� ;�b�aDŽke���h��Zd��Cbt��x���I���v�����~��+ʯ�Y~�T��[~��ì��{�n�G4�ڡ��Y}]�֒JW�z^�b����{�%������x&�}�Л�N8������xm��H^W�������U)�CY�hZ�:�1���?K����T���=�U��W�I{����\W_$�n�;����1 �nlAtu��;�a~��hao�`e�qX��{�PWS���ـ�(ah�c�ƅ�T�{�DX85�("lW�������\l���MG����a� ���WȊ���S9�Hr��c�p�=�^1|�����Q�Fk|�Ұ��gZS�ʠG1�m�����<*�ͣ��|o]2!_�4���4�V�s���ZH����D�ꂥf�Y��-��r�i�o8F_��eR#�0w.rv!L�iI��;��X�T��G-܍�T8h���$��^j$�o���LŬ�t��������<Ir�)>y���@f�S�|8��*�%�R�I�����qq;�&��&%���$�T[Sׇ|�o=��k�ҹp��7�q�30!�S�)uvU�\Ew����£;dzE�h����w�"O�+%sθ�!kb�8G����Y�l��aK��Z�H��JF�.�L/EO�b�]�9��@��ĥ��0ӯ���a�r�`wJ�⏱�^��$�*��0ND��[�qUBGJ�E��m�nƿ1o~/��� �@��2�&?��X�6�; s�v������a<���{�'�z��v�o���ް��d� �f�<�*\F��:��r�r�߀��V.$������{͉����[� �V����U}��b�4����Y�������v�P�����i�[���������;z~1�W�[%� �MA#^�oX�:'�{d��Ɨ,�OOx��q�T�'$�"�X�S��1����6`=Ho]�2~�"����_tq�^��.MQ5<� �BB�Ӯ����U*H�W3hɌ�\*E��s�K�O�w��t?��q�{���Üy`�*��$m r�_�t�-�(~�ŴXz�c8�M�T �y�+��Ϯ� ��[�T���1"�۪�|r},���~����'��+�:#���g>�<��Wk�)W���=d�B-���3,���_�}�;�oG�p�s>�f��Z���O��d������|�V0�J���qF\&���f�����I2q�W���8�[F��[��M9��0;�Ȉ�4, Ov��;�l����y`9�
Static task
static1
Behavioral task
behavioral1
Sample
b3b551ee50d8755a9a5de175fcd84925c33b979e0ab71f204a2abc4e95d43740.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b3b551ee50d8755a9a5de175fcd84925c33b979e0ab71f204a2abc4e95d43740.exe
Resource
win10v2004-20240226-en
General
-
Target
b3b551ee50d8755a9a5de175fcd84925c33b979e0ab71f204a2abc4e95d43740
-
Size
6.0MB
-
MD5
6c1ece434d6c8a1087274f64cb34e904
-
SHA1
a27168d4c2390ba9abd8bc48bdd61f6afd8af62c
-
SHA256
b3b551ee50d8755a9a5de175fcd84925c33b979e0ab71f204a2abc4e95d43740
-
SHA512
761dd5ca51aac59d03ddb6114702b4f90fe12aa9ba153401b7bb7fc339622bfc7f02c7445cb7c293847f9d3848e102cc661508b7fb764f8ffbed94e01bf776f8
-
SSDEEP
196608:sHUiSxzINvdJQVdrD5CVb+ZZt1GKbCmnpb3sTA5:sHUiSxggPrDXZP5CGjR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b3b551ee50d8755a9a5de175fcd84925c33b979e0ab71f204a2abc4e95d43740
Files
-
b3b551ee50d8755a9a5de175fcd84925c33b979e0ab71f204a2abc4e95d43740.exe windows:5 windows x64 arch:x64
50da240f1b9f63a6025e7ed0d223d358
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wsock32
gethostbyname
winmm
mixerGetLineInfoW
version
GetFileVersionInfoW
comctl32
ImageList_Create
psapi
GetProcessImageFileNameW
wininet
InternetOpenW
kernel32
GetVersionExW
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetDlgItem
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetPixel
comdlg32
CommDlgExtendedError
advapi32
RegDeleteKeyW
shell32
DragQueryPoint
ole32
OleInitialize
oleaut32
SafeArrayGetLBound
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 888KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
data Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bak0 Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bak1 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ