�F�r��Z�AL�Y�����:i}����1�п�̶+;H�b������w�i���}����ǵ@Y�&��UP`�.)���bn*�:Ň���z��*��LZ�P�x���J�Ӯ�d��c] �v�Y�/�P��Ы�0�HP�2e:���g�Ĝ��}۶yN����K{�ď�����ϯ�r�V=�(��#�w�ԗ�|�| ����s��.C��m�Y��X�nxΦ(�fHƪziϡVy�4ˇ*���젱�Ѫ�QlZ��Q�(ˮ0 ���%��]�J��ւ�:d�P�\��Q�= ��W���C#�;8�r���c���@ڒ��Q�¾�>�2Q��dx�-��D��>���_�+�ձ�#�}#�4t�r�Y�t�j ���쩽5.ێq��js'���M��#)ؔ�z̎j�X����PP�T�N0R#�Q�j�/�e�Y�e��L��y�{Bf)t���2ڞ��G������r�^*��&i��>|����u5ދ�W�o�ïbh$YD��t�U�Ibd�2W!bH�*�uj}æw[_�� �6i��)W�7#��&��Q�6��}A���H���<86�Q�t�zXh٥H�=V�9!�L��m�J��~�����v;eo��Hұm�����PYa�@g#�����t�F�W���R��ޅyz����q�FH���+�.�S��ȆOL���4�d�R��|l&��]^��2��#m�s�$ۺ������j��D#�v_��ʊ���%N�"�������jN| �{.I�<e����ۖ�mX�7��{�8��b ���J�*�7pK"�x��V�����>��Lㆧqnqi�X[��P�t�����~ iNqRH�d���Mp�h�C��Y!���\�I��}�I��������@<ˣ_��j�["u鈪���d89*�]�M�9j?�b��4�z�������ƥ���*6���N�0Xw���t���O\7C�K�J��<����� �7i��%Kd�q�[��z�[�:�z�CZ��!�m��(�ə�f�ܐ�6���S�[A��w�/�@ß-"��/�@�q�O4���j�o�[a$�h���#�2٤7��Y zry�=��Ͷ8�;��P�9���Y�,�L�I�ØYZԃ~`ٮ��y�LB�Y�]0�4� q/eB2�4�9tZ�z�l��[l+N�x��|��������Y�ʀ?���������$gʐ�xjy���.����Y+�.!�Ȫ�/�3�T�Td%����|r�t��3���w��%>/���f�8��=��z�O��qS��}�������T��j�ZU�7��%2R>T�Ј��TmA~�d��o����V(�/��/����͆|#�}8����\k�Rgy�yTݯ�}�,Üe #��"�}r���l�S���t"� j��s}��:Yّ���4�Pn��1�v�{D�ךXy�H��H��-t��B��|��;�pL��2g��(˥�01��u�����+�zP����y�&t�\�K(l4|���y�2A� P��k/C�;���p�'i���Md<�C��@T\�a s�/�=���z���\�GPd o֗ھ�`aêb��e!&�:��s�ɾ�h7�M%̨���VmS�j�\���%ե�o�xwU,�N:���ϵ�źv��D<�(4Q��X�Ք��zt����vk,QRx��J�2�/�RMiwJ�1Mu��F��s�4O#y��H�-�+&x��{��/�x�X�J�n j×���=�al�K4'9��z� <(?��u#, �fX��d��CCU%.���~����x�b�����è�,�lDrl��*^�C��3n�7����� ���ni֬ߩ�v��RBw,TX�>'<���]��TQ� �Z�������1����w������ʗn!J@�ӽ�ſ �����v��$Lx�CN��Z7�Ğv?.���d� �03 :����Wqur C�� �G@�K�z#k�ucC�������0Hp 1��:&�_����!q�K�!{h8��c��������E"�iA�7H����j��2�����ˠ^�X,;��fw��#Sd a���*�V�9%�8�1�w��[x?��� ��͑��dW� ���yK���i-:������lO-t�?Y&����(٣�RΟ̑�8�����rp�� ��*�1 Q���?���QC�n@-Sm�O���_}Bԕ t�kL3=o���3�!X�z;*X���������y'��\��˂��K���j �Q0���*C"������Y�4�]�X�LZ�֟k��( ��R��믠�̮u��������,`cM����� ���Ě���m���˵���-t��3?���P/W�����m��]���@��`��A���Ð��9X�,�,���d�,��8�A�[0O�t�-����6���� :���K�ݫ�ƫ���v)m!�мn>���҉�@��^OG;T ��Z]d�|��1d�#�����ˮ!���}���Gb�p��cL$��LU�l�*F�����ɕ�5Z9@������;\B+�@��,��lz Ҝp��ͪ�6/;���� u�K[�INB,<l����7u���n�o? �������a{FT��L�ƩmŜ���>IJt����x��44<z|9�Z�[ƾ?ƣ���ܑ�O��^��� �������Iߌu\PJ�������*=��̓|Y��j��l�����htD�ؑ���)4��x�%R�ˏ�͐Kd�%�O�����ot)=�D�6���7@3�K�S�k��\��_�#���c�ݹ���.R��L�Y��)-�Q�&d�c�%y���ѤE{���=_ZR��Qə���0AY\��пy�2B��mǛ�UT��6=�^\e��n����2�|9d��];j��a��� ���~څ99�%4q�c��E�X��7R��t��]�!��M��=���{|���D�z��> ���>���/�|�7C��i5�Z�!��q���rlE�:�M���4��y� !�PF9ؗ
Static task
static1
Behavioral task
behavioral1
Sample
b84f63243fc42763fe691a84cd8775801de61621eadfc4667f1dfd9f9c791e23.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b84f63243fc42763fe691a84cd8775801de61621eadfc4667f1dfd9f9c791e23.exe
Resource
win10v2004-20240412-en
General
-
Target
b84f63243fc42763fe691a84cd8775801de61621eadfc4667f1dfd9f9c791e23
-
Size
604KB
-
MD5
9ea525da45e74ee7c07bfc559e1ccbad
-
SHA1
281a6d8ceed0e7e1500161c1b38e2d9f255e09f6
-
SHA256
b84f63243fc42763fe691a84cd8775801de61621eadfc4667f1dfd9f9c791e23
-
SHA512
1db19c933d2886be5a509b135375f08d222fdc5062d6b9397c1d7897612b6a952f58cc58c53511d03cbe4a733fabc4fd58e722d23b6409aa5876b70e63ce884b
-
SSDEEP
12288:Lw9XX8BsaH5oyaaHVSxd2UggWqriplQtexaSSQb58CWMC6f7ga/E0Pzc6jn6fjqu:LwyBsaGmFUggWUiAtewQb5+HcTPzv6Wu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b84f63243fc42763fe691a84cd8775801de61621eadfc4667f1dfd9f9c791e23
Files
-
b84f63243fc42763fe691a84cd8775801de61621eadfc4667f1dfd9f9c791e23.exe windows:5 windows x86 arch:x86
4dcc25be15e84dd9c0c99f0189db42cf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord537
kernel32
EnumResourceLanguagesA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text0 Size: - Virtual size: 531KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text1 Size: 592KB - Virtual size: 590KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ