?�>���}7�2���Ҩ�B���������O_�\�M��� ,���m���l#�|��:�zu�U�z�JAb(q�_%i˕1Y}?�c���RAj�zK�)��`�M:'�@p��\�6��iU6���~��V�=���$���uY�{C[nڹ�#� �b�����'����8O;_�����y&�6�^�k`�������h�mUrxw����)��?�V���˼����g4ߐϖ�e22]t�Q��*U�ᥭls�m��puhPCi�K`�SⅈYO4�L\�;���}��ke$G���Q��8��/�&�� �s�Rs���r���@nӪ�[�D�5jp�85�@T�eq��qa7t�=)qyo��GIY)8�����ܔGc���6`ʷgCPk�/��k�ͧЈ��l]6�������ql���(�k��H1@� ��_��՚9.�F���߄rf+1,��ގ�=�=�kl�ܣ����b5�X,�г-���E��@�Pt0E.��Yw��"�H�?�{�j@���=,��H����� �b�O�nv|�+�|�7G�=В�C"�<��3�=��r?w_�k��3~�`Lr�b� '�\��L6H.�f,�a1^�f̩��:5;��z�z�JU1$\f&<����:��4WUF��6��:�V'����%dO ��H&o���m��w�պ%*���������x�!<7���ba��ʶ*E����?�}#s3��FE�nؓ #�Q`1���FG��yS�x,� �� ��G�-�GP��-,;�=kR��;@��I���{�&�� ��bng��0bO���r�wL��B8�{��6�˛�6�w'.xN���b�da� �Z!_��6������[����έF�H�W+�覹� Rl���}���,8�ɭ�?���/z�M%���%�Yb�cw����7&�LF"DAV"�m��s,z�x(yS��0��lj>[w�5I[�~�QWtV��֣Ȭ��Q��JxyJ��F��;�[����n��§��_�(�:�H��a� �d���2�%�w����}7'���6����m�+�T9��`[��9ڝ]����62�G��L����ᴣ����1�WgX��d�?�h������O��[p����AXGќ�%�晜�u�Cv��=#�]�X>v>������J/��.�V{4N302��k�Q�#D�*��9�f$�5������9o��#�Բr2��!���x���8���E�F 5�h��uqZ S� ���� k3��d(����5��s���] �(G�~zk���BKkγ��ҟ�ŤmY �n���Y�Y��f�v��ʿ��x�*� �������$2U�a`���1aR�I ����;��d���L]�N+@���"�v����a�c���'F�Z��o����Y���E��t�CqG�ot�1m*vw��T9�L�;O3�!NbV�f�2Ff��V���D�|ʑ�y�>�_L�t��/ԃ\xZ^�����3J���I���v���\����8�8ԣ�0��ZL(=��w����{�(Y�1Zߡ@�q���T�<3M� � V�Uˈ����F�''-�=���a�*�3ta���0����@�+�i��H��F�TV�����pHp�#������Z�)�/�����c���.9�.D�֮ݰB(1��iQ� ��?!�T�KG+��'[N�0?�WM^K C�����jK��X�[$����*�]��/��� ��mJo�y��� �FW��i#]X+��Ah�� v�?�N}�̑�S��,R��&Is9Y���XA���6��9���jo�X>e�\(/R��o�?�������'��DL���]J<��W[L�of9� �{�i���!�a�C�_+R����������P�0ջ�J*e�����\$�����+�<�]��<��rǃ@C�G>��r����8'�����tR�)ػ�_]w('�����֡�OT������G�y� "��vw�U���c�]0���ۘ����6�ش�yBP�[��n[� �8Y�E��2t>�#IV"��䴏D��;WC:pSSxo/G��*��z�x��n�ƕiB6.*���r���a"ݝ�C��C�>�ل�b6�k����ۄN��o�J,ٞM��3���4��q)8�D�6�J��si�ma'� {w�g{0�_)ʉN��9M��Of�[����B�v�B{��jz����wkOW��{�'���]K���-��qD��g����@-#�T}�Xm�����p�rz��cvG n�i$d��X����8�co��E��m���~E?�:�҆�ɦR��W�=]@>;\���/��p1B�B���Ա�!W�q<0|�ɫٮ�Xe�#�F����4F�h!�� �%Q�[ �*�L.���Ӻ�bܘ��%Xc�H������#��t-琳�?,��@ �0��]EÜuaB�vmp��L^�^I�9[/��[�%�\�P^V@%Y�e��u:��;��̔�ȏen҉O�Hf��"�އnb�ĞԚ���ym���[�N��c��d�v?�T ��fa�~ߎ���Od1�S��d*�@�2Su3��.��LNk|m����¶�Ŗ�ḵ��Y�N��p�g�Q����k"�jD�S����:�e���!+���^�\'�5�شD��� >�Yj/�B���������F����R@��$š��`�+*�:swu��"*9�?�w��t��4ߣ����� ��e��~�0s�۟���k�ӱ(Ռ�)8��LA��J�9F��ޒ��$�O�ۭ���Eы5�e�a��;���}\�8��;ܭxj�'[bˏ��lw�3{fnv�uWs�i*Cd����|�e U���=Y,�jb���f�,`��_���l�wG��p�� ��<A��6 Ǖ:R1�rob����E����S�:ǩQxO���w�{���g�q��|�n�}@���G�{n*����gMˇc��^7'��K��ڔ Z)�-J<AA�@S^�pZZ��1��!�Տ"���� ��ӿ��Wlv��V�F`hw��T,� �ܢ<��y�6��tr{��ƛ9P���on�"���L�2x�p@����F�&8���W��
Static task
static1
Behavioral task
behavioral1
Sample
3cb00307050857670d552acb871890261d1b9fbfdb50c17d39298e689cbc1359.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3cb00307050857670d552acb871890261d1b9fbfdb50c17d39298e689cbc1359.exe
Resource
win10v2004-20240426-en
General
-
Target
3cb00307050857670d552acb871890261d1b9fbfdb50c17d39298e689cbc1359
-
Size
11.9MB
-
MD5
0c3f481041a04079fb82ca810447e5e2
-
SHA1
3738b2f1547d83ee83a749221b9bee928fc1a0d0
-
SHA256
3cb00307050857670d552acb871890261d1b9fbfdb50c17d39298e689cbc1359
-
SHA512
660c6002c9bdf147dd6de9af6e0f3fddd70b2968bb9bb6132820a4f0ad3cbc39d8b3de417805bc64e3f9a858035a6d4808d640880d92914f83dd7a2dabd620d2
-
SSDEEP
196608:H+01OAlFiojG4qj+wCJjwvBbDc/dGq6AZOs16ld59A2lLy1sW8ilJE2ST2:e01OAlw2G4oGjWAZq1W2hb2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3cb00307050857670d552acb871890261d1b9fbfdb50c17d39298e689cbc1359
Files
-
3cb00307050857670d552acb871890261d1b9fbfdb50c17d39298e689cbc1359.exe windows:6 windows x86 arch:x86
a638b5555ae4d288e2ef8122799fdba7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetLastError
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SendInput
CharUpperBuffW
gdi32
CreateDIBSection
ole32
CoCreateInstance
oleaut32
SysAllocString
comctl32
ImageList_Destroy
zlibtoolx86
GZipTool_delete
hid
HidP_GetCaps
setupapi
SetupDiGetClassDevsW
winmm
timeSetEvent
ws2_32
WSACleanup
gdiplus
GdipGetImageGraphicsContext
Exports
Exports
Sections
.text Size: - Virtual size: 338KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vY0 Size: - Virtual size: 8.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.fS' Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UAB Size: 11.9MB - Virtual size: 11.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ