�$L:i ��k� e���y+���d��$E��� E6� �̫�p��?�0#�/A�5pl&� '֙c����_���$�uI���ץ�Q���u�p!2a����M�o�2����H+��2�� 뀴݊��8[���������n�RmǮM���#I����L�@I��O>�0{�I@��$�Fk��Pi���r.R�B�Q�Ʀ��̍0���ޛ����%�C%��U��OX��v�Z\M����#����[� � $J!�IC��m1�*p\�6Y���PlMz���"dC��Z���O�'{Ɲ,{&�%C �E�m�%]��.�����5n�N���>����tl��{�9�.RPs������������n�pY���T��J¸�(��ۘ��l�a�w��:^2/�22�\[#�C&�w}ژv0����h����'ɎueȌ=�;WU�PS�}<WFG26��D�V�!v�Rl(����rt��I7e��7�Τ���0��e*�7]T1�t��'�]�Z�UF-:���6.��.�ϛCH�D����(����&����\b��`4 K>�E�������D��7�n^���W�i4�X�7���fݾX�r�(� �����@LE�H�J��?�/���$�m��+�Wzw����-xM4_� P�� 9M��<�����H#ŀ|��M�,���5�W���Y�L�!3hW�_)n~�|k�ǡ��R��9h3qb*A�>��] �G��sy��!�!�R���ے�n��m���f㠀�} ��"?�v[���0�?�J�Z�S`�#��9���A�V�1a R'�XV����` ������jw��Y���y4�7& ��Ɋ]���q���������m��z����I��;+�a�w�}�Cy�l�o;/^��C$�b�pxA�a��P����5I*����zZF�T�3��}�v}������j�$�� K7����G���o+@6i?|�iOӣ�.66�G�WC6�f�;ʕ\���*������c?=mSnjaT��2QQd�V�%3�/���qx�-mr�J�յ7X��/)������$U�g�]�Bl��|@��;�X����ݻ���8��jD{���A�#�.�l���7]�F��d��RRW��g|S���ͤ��(��[�Ta�J�1�n���\8h~���� ��Amf.��E !c&}�G�5���<oې{���VMK����fZ�� ��l4���9_M%����ιo�CX" t��6Bc�M�=@!�?��(�֗J���!��n5��7 &X=Cpڍ�[m,�=��_.c��;U�=������<.?h,N�.B�ۂ�4����Lu6/���e�ǣa�Y�ŶU��{V�;jG�O,��NY��tt2�~���:�L���ߚD�� 厉#�U�W�l:h?N#3r��z,�9z.'4��&�s�Z09t�͝��6��} %���V\�7�>��쮼/����V2 Sa�Ѵ�穾�X��p$ d%�`����'&��������E$t=Tn,�VdR���(T-�$s�g��e�v�\�'Xf���d�c �G�K�����*�� E} )}�����~��nЏ��b�bi�Z���H���e��Mݡ�/eǏ�_B��j�92�!�����[|��օ��b���Wŕ�2T?��\���A{8'w����`�����H�'G�����d�<��2�K�Sy�Z�a. K�n%���"i�tI��)|$k������rH{i���7ɪ�+Y�QI�?�ᾺS����4!����mg��� ���}���!b����.>��>�P���0ݿ�y��0>ND����-�y��?��P髥�ߠ"�8X#Zc�e�Hsf�-\��ei��W>D����sI���L�&W�x@.�6�$�!�#�����BN��&ESNh�QXM�<D��[����5\���~�Vu�^��GC|��� 8I7�Nړnf�=�@}�.o��A�"�f+�jn�3.���%P� �>��?g��T'o��(�O\7V���\�G�e3U�oMA��̾�0��K�&��/�����6?�h��KO��zPLq��q^�R����*J����u�z�BX�~�U�_���oY(����MkF���,���h*O�,_@:Z�ћ�GQ�L��xy�Y�R�A���I�`�''>�n��^�l�.�8�]��Qs����I~P������z��8��8�"�k���@Q��q�~�����7g��Y(��(�% -��v��#C����ܙ�?4 d��7}��ǮO�|���/)���oGP(z� �� Ԏ�s���s�-�z�)��R��@7���� x�B�����f=��$;��/1�zx ��`�w.�4�?3g�{eM�ڿ7O�]�E�&ѱ�PV��T���v(@i,��;��g@2�P-�팙�Y�Fc��t K�Իb��cOd�<����AL«h1��lj��j�A����H��D@Q�{.���Y�+�/͵�,m�F��fHN?g�NX�a*��R�=��E�DKzܴ�����굒��FU��,��`� E��O[akXr�!��F$�e����J~0n�g�;*ß��� �BF�d�g��J���-���Ÿ�7甴�n��#�V���C���&�˼I�PT�>^OR�y��caW���=�*kl�{�����/��$���AoDY�&_}��=���P����0�v]�Âw7.5�^�[5��ò�p�����b} W�~4�D�_��Q��X����G.�ҝ��J���Pd�`�(�NR�g��N1����y��X�7�^&4]�Q#������U����x�p���A�ϳ�%�������j��l��0�jlb}ElϞ;i%�.�_̣����3E�G��S_��2|�����c1������\�DI�6� j���rO�Ёj�t�)�S����|V��ʹ<e�ߞ��3��G�Mq��)��[��´\J6��&@C =9h(OQ�1�Uv�Y�odDE�8�?��(���N[-��3y��(P�� e�� �&>�/���G��:��Џ��#C!I"��l����d����V�Jj�mxj�>M��UJ-1�0��wԄ�
Static task
static1
Behavioral task
behavioral1
Sample
e14b550a779a0ae16e808ad4d672165c.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
e14b550a779a0ae16e808ad4d672165c.exe
Resource
win10v2004-20240226-en
General
-
Target
e14b550a779a0ae16e808ad4d672165c
-
Size
4.6MB
-
MD5
e14b550a779a0ae16e808ad4d672165c
-
SHA1
b0d756170774d57cf2977adab784e6094dc7889f
-
SHA256
23cbe7f1ad8f3a3ae290a61669c5afebac3b7a470d401771402c11416a32ffc9
-
SHA512
7e63edbd21e26228b812e25e0be9f28c7a737fbc818e067efcb0bbda001ed1b991533baa5ec1cdd3f0e97d80926e45a40eb32f4c6bf35847d681d9a1ed5f9cc1
-
SSDEEP
98304:bz5NFGiPdWJAsdrr40wuwex+SdqCq+TjmscTg/9DSOLPQfSBrp+8Esn:bFdsK0wu1xPdqamscTg/9DTeSBrEDsn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e14b550a779a0ae16e808ad4d672165c
Files
-
e14b550a779a0ae16e808ad4d672165c.exe windows:5 windows x86 arch:x86
4ab3714418e20124847963fd74dd3e35
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetThreadLocale
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
InsertMenuItemA
advapi32
GetUserNameA
oleaut32
VariantInit
version
VerQueryValueA
gdi32
GetPixel
ole32
CoInitialize
comctl32
ImageList_Read
shell32
SHGetPathFromIDListA
wininet
InternetCloseHandle
wsock32
inet_ntoa
netapi32
Netbios
Exports
Exports
Sections
CODE Size: - Virtual size: 614KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 57B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.6MB - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 396B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ