���A�HY �3ng�Y5iVd��%���t����֭v2�m��L�.L�ϐB��� Q>��4 �;���_�%���3lۄ�1��{���YcNU�P���E*����=�˖Y8����t�xGYȳ\��mz�0�E%}ȬSVsq��������O�v�/��nρ�������e��1ԡc�N#5��")�Z*@3��ܱ]a�^8[�On����W�ߗ���S6Y"]������{�5�kW�'�GJ�Pуߍ�����{a�i=�Ԫ�T2}��w˙ �䊪��n*g�T �j���c�&~��p������m�|��(�1�k�{5t�1��1�ѱ-b��=�χB�;�6���=�L�i�� ���h<��J�Q��+��ݰ۬+���I�j�v�}���c9<M��udAO6�t�Ԣ��^�����f3�;MB������o1͝�YiaW$�ق�'��dn��I�9�2 �F*�.a��Ϩ˅36�͐�s��X���K5�c�X�~}�������*Zd�~��s� ��ݜ-jZZ��ϙe�#�����{�Lj����ʗ(M�&CJq���:�D̊�������4W�Ȑ�K����)w��PKI��V��^ HةhDhҴ��|��h��k�,��w_�t�[}������9��R���o*B����.�שL� �}�:O�sdl�$���|x@�.#j6��声���� �tr�8KiY��o��kjaV.���f��0xŻ2Ŭd:�`oK)p���9|��ն@��J�EJ���i`5�G%�Y���T�,MPмgf�U ���^�R���J���~Jr6db� �)n�a�l�:�x*�U�\�<䱕$hX��o�ź��kؤ�1}Sʐ'�~d��og�̹d���<Nt'���;dj~[k�f���O���L�g�B���泟����CԊ�t�������͂4��������F^F"�]�R�D��A��e��h:�LNr֕o@C���x�"� ���E�L$��U�������-c�ߴzܲq�4Kv眔{��Gs�c�u$�Ѥ�����E OC�1#���']rJ�E���0:�lE��kc��Z��p���>Ƶ�������~��^D�$�~���{������3�.qG�ɥ�xp�Ij�p�0�=ܲp<;�������ȨB�����Q��#I�z-��t\rX���k�*�E�i�g�@x ��G���t`#�S�+�ʝ�l�-��j��S[)B8�p��/�4/�� }~��8[M�X*Zk��I41���§��5�Ǿ�%A���"�".�i}}[G��l�<5(�������߹2"�=�s�^��?p��a��Q����}�ΖmJ��8� �pI�ƙ^g�#�T�H�����ɉô<��;�%���ZWQ�s �d������a)����:� ��?M��{��J�QW��?���B{Eh�\��N�Q��"�A�a����[ze���X�ĘSi�Άpl��?����?]�����X�-g[�� ���__2��d�x��q���y���e��W�Q�Y�t��&ͬ x�+ZYp=b mׇ>�oS��1F(��J"|l`kK]?�k\D$l���K�ט���Tu?S���sl+��5�ђq���>��ͅ�͠<>L���f���c.n�d'S��L!�}���H ˄��;HP�D5(��K���0�c���sM�:&���.�h�c�X�x �3#��"y�/��������zb�����ڜM��y�ճ�g�j��8<ݶq<+E�|ip��-�@T�9�����*��)O�P=�N�w�DΜ��䃈 bw��R��~�x�a"�l����:R�֛��Ƭڪ�w���.W����[L�5̨'��)�<>��L��B�f�����[ ( 1��C�{����4ۇ���;�w5f� �Of��)�}�C�ɵK2�FG�wgΙ����v�7�������MW���p�+��X��5�{��x7�z����p����h����9�5e���,p��Q\Iz�����Y��J]������B۵XX� t���|b^�z�I!J<��j���2~����I�<3�מğ�K���PO����X�ڽ̃wP@�.��K��Ӑ��*��!���[���O�ނTPڧPrU b�dK�#j��U�1Kg�e"��`JA�Pg5Ϛ�1M2����R�P�7b[�`XVp ��ॳ��t*1ʱA���H�K{����E����"�]��J��Wf��A�= ����6\��`��E�^��~���|���Y�T� 1j������������p�I>P,�hKo=l��"�E�^C2R���e�a�����.:Z�3S=� �gX=\�RXAK5U%����� �� �<�HP;����CqQ��C����3�����^���0�n&�pჾ��??���lY�S��+�����/)� ��Kft�?�"A�X��e�2��ތ�!�����f )'���]���a��h�C��v��W*^.F *�8�W��]��^Kk��=��;2��4��n ���YO-�-��I֝QH�=A����r�^�}� $n����F��U��� qf#+��i�ċ�?9���Q����A}��Q�uq�<�\���5<�)�&���x��%�[�m���i�o�NJ�[�:%>��`�҇wh�t}ߙ�cc�HUQ{���{������k,���x�s� /d �(�q+}��k��MC�+�#��l�V5��M�씣/��ԥ��W��B�����ʨA�� ���S�ѵ 1�����:{��9ϔ|F�c����W7���Ʋ2k ��i�����p�������o�X�+a������d�t�w"��f�J�P��aG�pa]�7�,��-��Q�l�Fv���xKi��0f�q�٥Jـ^�����e�Q?��w`��f�7"zs�����z�p]т�"�0���Ѓ���b��-8}��g��F=�_oU�4{~ѩ��(9@�Ol��W���P�^�Q:��^�M`���M顁mѺ�ug`�#�����(�#�L?�"۬v�D��v�bq��'��IJ��SOp���A�Z�2�RզT���D6�M�
Static task
static1
Behavioral task
behavioral1
Sample
afd5d8edce971a6c13b6d112c0b0e519cb33d8f69e6c2afd9c0449efae930931.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
afd5d8edce971a6c13b6d112c0b0e519cb33d8f69e6c2afd9c0449efae930931.exe
Resource
win10v2004-20240508-en
General
-
Target
afd5d8edce971a6c13b6d112c0b0e519cb33d8f69e6c2afd9c0449efae930931.exe
-
Size
628KB
-
MD5
e4143f505907a6d865085a2a4784041c
-
SHA1
0c15733cd68594109cb3eddde8ca9b943a33022f
-
SHA256
afd5d8edce971a6c13b6d112c0b0e519cb33d8f69e6c2afd9c0449efae930931
-
SHA512
1ddc463ddc796a88ab2c7aa044acc6d1c14aedc5533de159f546b0a14785190ea64c397750aee53f8d1bce22bad43ca2e69287ef5824100fe9098a9bb3da21c4
-
SSDEEP
12288:KusyYY5HTntm68ECY5nTTxVHbdiFD5Ggz3Sq/AOEeqsyVa:OsHTntz8KTTz4pnz3jAOEpsy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource afd5d8edce971a6c13b6d112c0b0e519cb33d8f69e6c2afd9c0449efae930931.exe
Files
-
afd5d8edce971a6c13b6d112c0b0e519cb33d8f69e6c2afd9c0449efae930931.exe.exe windows:5 windows x86 arch:x86
dfd4650d0daa53c84ab675810da696fb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord525
kernel32
FindResourceExW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 275KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.t345340 Size: - Virtual size: 514KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.t345341 Size: 616KB - Virtual size: 612KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ