��v�Ct�����mb����/f/k�q��=8��"b��Z`� U��A=و�̯F��B1�sÉ���d�����;�Ĕ��63]�|ɅX7�qQ�9 &� A�]h�����T2����� {U��"o�Z��T� �0�w*����7 [�����w�ۧ��_�M�?ЮfwOT�' �%��5b>�� �S�a�f�5��9�(O��`#��a�O'��%���Hݑ��e�3�3��-d35 ����D����u��c��1*G�o��n��>8�M���ط�plS}]rh�_ ����d+pf�K��tL N���XON�������1��<�����PS=�-������i�az&���$9\�4���O�%�)�� ��\@�����U��g�۵�X|���3I��;������!����o��m~Tu�O��������6*|41,�X�|�[x��N��F dn'/�cߏ���]�}�i��gJ&�B���.ݲ����pі����� q�RK��bQ�j�ܪ�H�h�e����E��w��ԪGB+2���8&]��vv рd��J�b"�����S��A�u��@�V�e�,�@!vmD�W� 9;�G�|3��5��]��μLb+a�ǭ B;?�88A�J�j��u7���AF�������(����tޥlvl�\�$O�1�d���)����s���L۫���TX�3�U(m��dbӣ�)�f�s��Џ%�Ae�)�T�+��'���Ať��(T��͕�)��5�䓾=���0�[�����840��ɖ�%~�U�/�PT�AP�I 4:�Yge"�����I�څ{�50�"���SLO&���V�0m|y���E&����n�{��a��f$����>g_I�e}k̏ �P�W�S� �f�)�}nO�]8\�GPR�u���a���g}b5��2�$�v�@�X;r�a���(�uŏ+B O�w��<+D~�g��B"�(2��?�z�0(�:6If�\�P� �Q1r�ߚ<���Z3�v@�Y`z��P+t�����A�D��x[�D��j�9����_���ڌK(�|O���'���d;�b�͛{אj��E/JX�l��0S=�`�kʁ\�J�n�;�C�����+��=L�C�fh���o�!��6*����çf6��vm>ú7�����F�GH*���<��?OH|oQ{��>2��S�q6�f��ٲ��5��{ ����=<��('�Bǀ��4�Ȝ��[�m�u����I��(����G�`�s����=� f"<��c��c��='�����i�Ȅ%]`�S�q4(פz��k+0=F=l�]c��+��I������v56O]�a��^T�\==�@�!wh����Q�tVx���f��� �~��s�S���FD�r���*�e����ZUv7��& �7���:-�� ��,��y��)�d��P����'�ud�����ڣIܷ�4:&HKdԳ:ꪺ�+�vH��#y���˄��-27�T��@�n��y�����o�LotJ���a"�^�'�q/�\�����7e���iM�>�b����r�!j!���ѯ�n�� NM<��k{�=Y���C�wwB}5���<�{I�5onDr���V3��e�U�`�Hz��@�0�3��Pȏ_���C���{Y�g<����x�vO����GK��j.�G�CT!]P�L���ӖGB˕����5�?�Jz���e����ђ����8� ��`��.��Y�5��-H��~H�)䘨)>��a��Zr���S�{S��@��=S��p�I���J��XK����u �O#o�F+�9fᠢ{I*w�[����ew��`"�� W1s�oy�E�V�s(��q�#S9�5���?��J@�¸���e-T� &���ʸ�����_d�Fe31Z�-r�v{!�6{d��:�\/^�YQ_�M��p짼��ja���E�i�</@��;��i��*d��U��,����Jb����+hAJ�e��K�M���JI8��>T���.W�iܣL�X�N*�N�6�u��?����U�>t�/*OU��h��kp�5+��^?�в$U���d��&�ϿI�Ѧ����=��g$N� ����M�#��r�oo��u'�g/Q�R��2�f��f�C�+kq�)é@8�h�}fʫ^�@T�xe�ۅQ��%^I�u�J� �p}w�ՑD�u{���<�o���#�Bv"ü��,�'b�f��5AϺh47��p����6)"~����bZ{u�*d�{��y���5`�.��c7��.B���#���O��@��P'f�H��V4�68��xmNx<t�;��oQr�sND�\�N���u^�/6�b���r)��J��;���ݫ@�{/�U�/X5�?���Ĝ��w��_� �W�ҫ8'b�]�۽��LM ʿ���]��9*Px���N��f?AΈ��Gue�ߠ&Ł����+p����`�m>�n�k9��T�� �a+ ��>�*�Q{�.�����>v�#)p[#�B{y�� �4O3ek�z)*��]���FU�x ���5����ip1*�1&�e�ѽ/b��:?�Oa��70�9�]���z���4��.�0�v���;_�|~V �s��y�{<���@��-:.��PD�43���ģ�$���m�om�*�Gyg�]�ʩU|��ji�l�j�JF�?��2>6��ˁ�U���y�!��ݕΥ�2���`X+@gY���!yR%��l�ލ�2�}���>���ӣM8Ё:F�����*���p6���3�����b_�I�"���D(����{�������Y�T����4����VK�{�1�7�`������PK@ߩ��tZ.�:�� �joB�+�(��f>�ϧ��<�w#��E�g°$�0"s�*8*���W��U��E�|=ӭ�W��Ŕ�{M�A.c��u��% YQ��)ۼY ���+�v�h��d�)�S6gxt��4� @��c}�������Qk�+���5y|����7�Sz�"�iR�c=�Oc���
Static task
static1
Behavioral task
behavioral1
Sample
H0XqFUGELY2Dx5g4.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
H0XqFUGELY2Dx5g4.exe
Resource
win10v2004-20240419-en
General
-
Target
H0XqFUGELY2Dx5g4.exe
-
Size
17.6MB
-
MD5
72e425a6c62cfdfc665d911fcf8127c9
-
SHA1
e57bc52fb21cae5ab3408352f0f101dc344e2dd4
-
SHA256
c73d09821a5ae824f3256f6cd891bf30052786b53f574170f1b75b7e7fa09069
-
SHA512
3200ccfa648193bd90294540de8614039844e47047b25d5837a684e49a135838bb03d0eccce842049a845984d83dc37d7c130876dcbf5e9775d80cfc56bd3640
-
SSDEEP
393216:7f2p1CuZ/2/t8FuIirzuBJ4zU781Nn9adB5HtaqCqEx7QT:7f2qu52/t8cfzuIzUO9CUx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource H0XqFUGELY2Dx5g4.exe
Files
-
H0XqFUGELY2Dx5g4.exe.exe windows:5 windows x86 arch:x86
b15c610e5b983356413b09ba17ef6473
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFindFileNameA
kernel32
LockResource
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CreateWindowExA
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.0NMZUu3 Size: - Virtual size: 14.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.0NMZUu3 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.0NMZUu3 Size: 17.5MB - Virtual size: 17.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE