�����U�g�<����2,���c�=�x�u���XS����N ����gQ( VjN�TK5�y�\����j�n���@�Vm�s��عn����D.������J�wh��o�`�>�c��q�>,_��$���.���J�T��a�e�h��7A��Z�)�fH(�c���4!|0�<�+�:9��o��wE�q�Ajw��,�O{v��p��2X�4�u��k2��e�J!��ۓe������#���[�m��S�(v�����P�����r��'�m�>�V�j�{@�U0r 8��$m5hGaX��T�D�T�%�fv�P\ŠA�x�cS�m:M`�&�/�~,���*���)S�>K���{4� .�P��z��F�q�@Ymw�͓Ӻ(��to���C��M���U��&R2>Z�0�ƔH�Օ P�lDq��˚'� ��;����յ��^o�UB����~ �s-���O>���^s�eғ�ƈ2>��({�l҇�[WU�V��O����Yz�9z��L���"��t�8�89�w"p����4���/��WO,�gL�K?�jok>�47힟�]ȓԑ�{��w 냰ĀRZs��厨 P�1}GM�on]�w�m�����PA��d����Sã�i�y�w^/�ײ����>P����IA�1�-���qMB�?��2�%��IQd���jq�5��|0��o�V�gd.m����\V�f[F}�v�p��4\�p0 <�w[Қ&Kq�}�� vWX���w^��`�}�ʛ�5j �T�����[�76ȧ:ז��Ӛ_1���ݝ��=��H3������Xy��f��=��%L�o��FL<�4�bq?#x�:��c^:鿺H��r��q{o��D�ft��\Mxatn���"�0�\�J�6����^�Se��@^q�TQ��G��/,�g&��>qkt�j"�g�JGЩ4��j�V��|t�ز��f�,6PӪ����s�bd1���&�n��0I�RX⋖:/����m}t ht��+�I���&�e\�ܡ�^̪`�����o��(��<�}��Є��{[7=���܍�9h �>g�B�Aۧzk��$� L���#����ׇ0u���\W5���<i�.���O/[wh�W���N�%�MMN�J��葉'u�6�x�w��5��M� $a$%b�����������k��������K�.�WJ*�+���3M�?�A��U��xG��_���aO�F5@;�m�����6y{�LR�2��E�lA_P�o�wL��3�(=t��O���E�+Dk����h���$(��?*�g�I~��F�íؔ��8#��2R�� /eZM��u)� �snr�4V������颪���v]�����n(��i72RC��ϺS�~�6Ş��I���.�x�<�F�,UŻ�MGh��lAO��(Y7'ai�ϐ��!>2#��Oq^�0I��]����x썣ͻ�1̯���c�ꑦ� �V��ä���L5*��|�U����IɅ��ϛ��B��SR0��؟�3[�C��u�o%7��.�����_տ�ԯ� �� .�{$ ��.X���'b�� ��S�ڽ���,�н�n>�j����̲�D{�,?4߿?F {��ߍ���m���ha [�\��7}�����n�A[w����Yvg^��Cx= A��2����!G�������;�UZ}��?���j�c`+ �'����y�dL���8kN�R�;�9�{�gc�����;��#5��ɥemn�a�A0y|8���#�\�C3��^h�uajO+��Q��0��������ޖ�?b�b�x.4����S�P]uW2�(���r���$��bGt�8{���Uu��s�h����L����Tt_A�o�ǔS���:���c�_��=�K�dW��m'w#��E�d1x~[2q 9�nҖ�x��̻ �L�o���,/4����Zq^"������r�|�\*�e%~?�;q0r�Y-BeN��J�����R҃�/�����(�va��� |ܨ���< ssXD$6��)pmG���7xXn�o ���0��!_O�zL `��[����_Ђ~�}��P��i �ݻ/�=L��%��,�K!h_杛��-i�]̻�Aeʟ�{�Pc\�����1�7ݥ��~�H.� ɐ��y C�|��4��h+������M=��q�$�X��i0��q�h���&o��,�!��j�P�IUp��e��+m���������S���� �ŻXw7�����[���\��=Y���+z)a�g5& s�_� S��9߽�Ø2z��Сk+VGɏ��بBOq�8�R��&�}��d4���ah Y#v��������mp;���r�'T��c�4�G0�V����8-�6�u�S^�����LЅ�������P�&>\Ӫ�v�c5��?��&��>�ފk���" �tm��SA�F��ʢ^�p�*S�\u�(�Tܭ�(f��p�[�0U�:�B�8?Jw�%�V'���}��&�� �?E��-w���Z9��L3(� ��[3���u}����Z�h�7��d�$��T�T�H���`ʧ��Q����Hk�:������0��|b�.���2d�y�[x�I!��d�L�����NftӼ�D�'D�g����3D$�6H�2�]��@m�ab�Q��)e�x>;1���1���r�d3��W$����# D�~����9��fh��$y���tZ�낪ߠ@|l �}���>��G��Sc��s"����r\��4M$S�1�h|�;��Qd���.�ӥ��烐(���B�PR�bx�hή��OQ��))��znu�VO��K��=��P��D���]Nw��"S��ҫ��$_8�;��[�qA^�����w�9e�-�o�I{u)v.c��aKF���T�����y3�{��l�]�N��)O/�^� �UC���\pr0�(�������/���K4|��Cמ+~zJ��Ù�2e��IE5e�?����@6�����}?H{�o � �v�1f�FËN��p�B�H��j��d���hϧ����t���i���Ň�18ȕ+��x+t�e�����2BB%�P��,]���z��s\�@�^;���!�=G=
Static task
static1
Behavioral task
behavioral1
Sample
0203ee4a4252b78a17796e7e4832dcfb921051b87e4a727eae172ea13d9424cd.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0203ee4a4252b78a17796e7e4832dcfb921051b87e4a727eae172ea13d9424cd.exe
Resource
win10v2004-20240419-en
General
-
Target
0203ee4a4252b78a17796e7e4832dcfb921051b87e4a727eae172ea13d9424cd
-
Size
6.7MB
-
MD5
94bda0c9325b4655f5d422092b7e685f
-
SHA1
5440a1d577194fb53cef821008853eabf77c4b5a
-
SHA256
0203ee4a4252b78a17796e7e4832dcfb921051b87e4a727eae172ea13d9424cd
-
SHA512
5e7bc7414074abec96a43b2bd5d0533491780ccff9303be26bcd3e25c7cb3faf1e05669ccb63c7808f6f7fd69ee90f5d46be770a870bb194b79be5c9b42f3243
-
SSDEEP
196608:Sp460oG0zsP9fCoHMk79G/acvXVTLSNK:W454zswoZG/VTL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0203ee4a4252b78a17796e7e4832dcfb921051b87e4a727eae172ea13d9424cd
Files
-
0203ee4a4252b78a17796e7e4832dcfb921051b87e4a727eae172ea13d9424cd.exe windows:6 windows x86 arch:x86
11ea24073ee65343ee563e3160c77fde
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyWindow
CharUpperBuffW
gdi32
GetObjectW
ole32
CoDecodeProxy
Exports
Exports
Sections
.text Size: - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.;<W Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.-U: Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.o)- Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 464KB - Virtual size: 463KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ