0�5|�թ�l��u�{�s�5�M]���0���Ū�A?'R�-O+�V]d�(|U�J�m\�ruڠ�߶\�F��Yz_A�c_*���Ѣ�B01�� �0�����ѢH$l�*5�sB� C�a����l�9����K�,����h����u㱶�ztI��72/��#jPp7�߅q�mr�0=!��zf@]D�I�$�Add�nxDxS��,�A`y�����[�%[/��F��Eǀ����\�f'�+��ͳ�d��ł4��P�<�Y�+��2��i/5�(����@��_�RL���!E�C���\"��nùd.%���P7Ò}��,�t��F;�_�K�<�]���I]���W�:ބ�U��W{�����'�̼SR����,s��3}"e���8�^:�3_��x�̅�v�T@X\�d�A����1ta(����c����U�*@��N�{l��u6�Ύ�p �T��VyG�C�)`(-�}Η�^zeS71�6����x��my����d0�����b��bj��B0�z&�0���l��o ]-ŝFh�"Rs�����dϠ��d����_r��na?�1������2A5���FV{v�B��@m���Y^�b%f߅�\�C#�����.��4A�Fگ�*=֠8c"�T2鹍�cayn�:���&(BE��A/)�8�@��ʩ����}XX��@)@-���j�~��1�TTW�@�o�������))�q�Kop�c�n�7���0IS�u&&5�L�4�th��a��aG�n� l��r����~B�jF�ʐ�e����&�{���}$#ځm������G�܍E�������!�xI�d?���#�K\>���݀5%��w/�g�����(���an�rAUW�q�]��Cr��M*�@K6;_�T�4����vrh@>���Q&ɵ��������t��=�q��Ltڄ뿓7���p�e�� ���7C�U��@���Ba�� )�)�l��8~�bSKO�.Ǘ���YK������Ԍh�s��@�Цk��u��z� ��D��cYUТ�G�@�R�:Iﮝ�FBر��TZ�~��S��NR����O/�X��H�1��w=#����CpP���0�p4�p*�y2S�m���:���i6��+Z}�~2a�m���E�E>�Z�b{�2��}I���,Z���<h���S�a ߅����z�D����E+D�$��ss_m_#fR��!�_��Nj��J^=����`צ�iɝw_#R�&��ac�zc���A�Ge�&l(�v��yJ��=����Hm��� C7��jP�R61� CA��ևށ�s���Œ���P��V�����y��AʗN�b��[�>�����n��zJR�613tl�)[���4��3��p:%�� ��#�,�T�7��)�͕Qo�v��~�t*k3�BJfI���>(J��=�:=ґ\�/3ݣIEC�ދp�]����P��.�'�₡�q�^ł����;2�q9��Ӭ��㛵=$�{��ն6��E��i�������8\+�B�lLo��ba �;�>���\�|�K0~F�jƥ^Z�#(�OF3�7(PF%�C�5��HK@�ƾX�2y]��g��w�yn"�E��L� |��<|>��d��sj��g %�!����k|�"q.���a+��V0�L��z*�%y���9�N���:亥�撼IF��[������#�����/y�3�R�Ta�ވCC�U�����tMUc���|_�M%�k��<V���,L��2���iM����r�ŗh�E�Y�{�B3f�zF�h�Q�/-KH��j�o�>:����,�eП���1�}V��h ���=�nZ�(>�a���r������vݖ����eޭ^C�;���Wh�D$GWҫ*��z��6C2;9��3���J3[_S�FECѤ`���. o���2K;Ob!�e��`�~�����D�*V?H��L}�����zܥ�'�P����mH$]�Oee�ر�TS�KJ��U�V�៓ �:*U��G�~�XTޮ�MBn��F��, >FY���{|�'��w<�3M�h��֕�_���t@��4�{k��]:#H�Ac���/��~p��j/��Ҧ�K,�1}����(���o���I����ֈ�!l�C� ��bӖ⺶c���"K�̈#�:�]�TzwZ�N�"��ʟ�QcײP�%u*_�C����f��Tl(�֡a?�C�¦Dk��o��']�9����t|N��ECDK��V���'3��7�\\�t\�"U_j�����B84E8Z�<:f����pr�C��scG(¢���E)�Y��m�� �к�7�7�+��'�'����J�q$E�n�}�T��~j��2���h0���,.?�����T��=�A���f*}��܇c� ��u���M^�*{��8��iKMrI_���$\��*֡��f�۳�Z"���D]��ʧRZ�ÆB���ͨo�D>B����H�n�� =�5�̎e}������d�l��1�˩�m�J�5h�0(n���e|b{�ќwxؒZKK��rd7�� 7��ݓ(M�0�y�*-���Y:!�=�����<>�ٯ+�( ��b�/��k~D<u���'����p4' �a�`K��s7�k�����ņ�Y� �_'��Ɓ�T�j����a�a~]� �~f����;Nj2�pjf/I��PJ� M��֗!>"�)�S�ś�y+�T�k2�\�ʇji����d�1P ��0&�(Rr�U}�����O�(��a��#���ǜ�B"J1�$(u �w� m��&᧠��4���D��2<�c�`�IVm��ĒV��0�q�1���������d~���_�v�Ȁ2Ic �u �C[_��ITy3�`��D��6�2;ҲD\ҕ�r�( ���C���>C�Z��i}rKs����8� @���Q �ɴ�'��.���k�?ݜdؓw�[Az��D�e�v�Z���@wz @�m55<pz��n1�H�0UU����!�'+��������6�����cP#IR6)e8s3�>!V�e��ͺ�A�I�a˵�&x3�N:e�A��#�ާ�Ƣ-D-
Static task
static1
Behavioral task
behavioral1
Sample
6a8f01cff15846b9ceaa03d222c18bf0e988f3057e57b3aeaa278b05f0fb37d9.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
6a8f01cff15846b9ceaa03d222c18bf0e988f3057e57b3aeaa278b05f0fb37d9.exe
Resource
win10v2004-20240412-en
General
-
Target
6a8f01cff15846b9ceaa03d222c18bf0e988f3057e57b3aeaa278b05f0fb37d9
-
Size
687KB
-
MD5
7a8b58175230d50cbce296cc157c13c8
-
SHA1
e735c3b8f050678cf4d8b43c8a6d1b957cbc776b
-
SHA256
6a8f01cff15846b9ceaa03d222c18bf0e988f3057e57b3aeaa278b05f0fb37d9
-
SHA512
b0a4e9df2713dee398e4f7e48b973a8941ccaed19b14e7e2f920c52d91b824c346f05bbe5ba0366df73430b1543e924221968556efa517ac89823581014b1481
-
SSDEEP
12288:gB8WDBBzWPNXXtiYR1Ip46OgiRb/yqet5EOVZF394lIAzuy5GyU8L:gekzwXg01jVRb/yht5EwZN9ydzuy5g8L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6a8f01cff15846b9ceaa03d222c18bf0e988f3057e57b3aeaa278b05f0fb37d9
Files
-
6a8f01cff15846b9ceaa03d222c18bf0e988f3057e57b3aeaa278b05f0fb37d9.exe windows:6 windows x86 arch:x86
1f87d006f01e5adf895ded481156af17
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ord17
netapi32
Netbios
kernel32
GetVersion
GetVersionExA
GetDriveTypeW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetActiveWindow
comdlg32
GetOpenFileNameA
advapi32
RegEnumValueA
Exports
Exports
Sections
.text Size: - Virtual size: 581KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_TEXT_HA Size: - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
data10 Size: - Virtual size: 343KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
data11 Size: 685KB - Virtual size: 685KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ