tc�@`��xSV��e,��Lr�c�R��gU^)iSڤF���~Á�U�qD�"6m&� o�Ɵ����dyD���������Mzl�\:�-���������=WylT����@W����'1����Vס8���5R�-�G7fx-&5aęh�Xʁ�]%m���-X�tBTk>�����G�,��j��r�o=�:�dL��ԡ?��47�VMƈ+U �]��ڎ�XI��״T��R�Q�g�������E���9![�1��������Z��s�O��n1h�6�͛���^�uf���V��X��}fEe� Svق9�@d�#_I�{�<�t��v8_�FB�YPx�1DcG½��C���5�<'�f��$耭�����Z���]Q�Gh~�ȿ�G�'��9��ٕ��ɳ�6�L!�f����zд9�l��:Y;��"F�ZJ3^�%/���j�,~�Oӈu����:� ;�����I�BN8�-S�0���zs�P�X.��+jci0�[t"� D�N�s�6��Ӝ'OcŁ�{Eʢ�^�} ��0=��&��<�!�1�ݲQ oE��%s���+qJif�;����`P�PLK=���t��I�J�y�!8f6_Cͫ��5<���9����T�� �������d�;��-Ͱ�ӌ���ֳ��B������R�e�ް�Q��bnQ��u���ƲΔش]�T���uU��0��]��Zܷ����������Bc��NΕn#*�9n��Z�s�}V6T1�H����Q���Y����<�s<o}�{�/����tft ��9�V|�y��u��@�ߖ=��:����P4*)�_�B�R��!�/s���S�J勽Q���vrOƝ]���Q�,��e�b�=��~��������Q�z�������,Z�plJ���XI{X�?�5���-_jh3v`���5 tɭ�!��"��-W���Xqj��q�ߑ+0X�m������#����x�C�tM��_���I�r����I��O$T3J�^|�F���[�cL��md��ڈU��M��oG����;���y��8r���A�عƆ O=&_����JP�=o�%cFo��i>S�2��g�>W���*�R3��C7��6�����"�iA��AJ]�5��lFc�웇ٚ|�|w�N<9�E-q�bb �h���E�,%���O��ۧi�TXg@�"i�� ��G �*���&^Ag����F,��i)��[�-����� �WF���+d~��{��Q�v�C?I�K�#�5�[�H:���XE���X�6�}�G�� ���'�������2���z���iA�Ӥ���/ATK��ۋɖs������ݗ�4�Q/4I�=��?����ր��ㅋ�鏐�T���ݖ]�#��=�rë�ƺtW��:E�o��廄f�o�+�W���9)� �-"u����6��OT%����0����u��D"��q����t�"����������"1v=3�Z�Cw��@T�w�k�:�7�߮�K����j��n�vv̓_����]N��;���tmU_��Z�b0$��y�vtx�����9E� >�����-�W��&/���c8N�S���ҝ���1&U����1]�ˍ�<g��E��}Y���+UΤ��~� �d��n�_����W� �~ �o�@ԟh$��n#�_���$�Z�8e��F��! �Dw?��g�f��&���m�3.���(7�м�Hj �\!(��22���� ��N��Z21~┤����5,��d{��J�`��r���� )��3�L�����<���>RX����%e�y1�q��r� ��-!u$�?SPS�J�]#����k-_�f;L�!���TL���O!-�͏a�@�z@�}~�;��N.+��S����d�n��u�����7>3=1ͮs��e�;X~���2gL�'k�q���W5�@ɢ�����5����#9[c��ٌJ�WG���)����Z�,����d�,�s�__��K7-��|�T��� !%�@`1x~з�!E�Y���E(�� ��z�z!ϲ9�QV�=��u���+^�Y������MX)m"���oy��r�_����t�-�W�9�|7Vn���&�WO�W����Њg�e7�-}��/�ϝ���s��2���u�pq5�"��w�_�x�[%� �q'~��P�Rr�,����J� ���[NY۸V� v�,��jB��ؾ)7@����z;!v��|͒��S�Vʄ���,�����y&�/�6t���Z/<��)W�#U<���p�6�zn���fA���R�$m1s�>�P��R�qu���Y�ٸk���d\�����;4����D��N6&���W�ADYu�[��ϣ+���}��Ch��*e�+��Z%�X��X�cj70q�����r K��6�gl����2���)�6�^��}y`S5O:ar,��m�lbS�pc�zy0�k�����'A��]k��`3X�o^���v�k���s�.�e�{ 5��$�"����-�i�q��s���A+z�Kzf~6c.�� ��M�[�je�(����(�&n�`4*ɰo wp����^<w!ò;ޢ���~9j�(��l�L�u$�.ɂT4/�;�W1S�[�˃zk��Y��/���0� =���ʫ�UR�*{1��d�yqG�^�~��P;ʓS��!aq�@h��W}�Y]��զil�!^�H/�$�F{i�- v�w%�[ߔ��rM�]�Te�H0�����N�0�,N�:zNcV���������w 4Dv����4S�Tu �4楷V��A<��/�Od29�����N�;4,�!��/�?�x��O_�|5g�����zG��Y��g�r�vK`G��b�x�T�e��5�Uz�j�� �8ADk̷C6��[�ׄq��0��^���|,x�� ��7���*x3��ێ���;����'|��%n����U���Ww���P��� ��U^���f�=�c� �����i�:�,hp��JΞ0����d��+��K��D/`J��O|�.�Ex5�^^����c|����j����������4.Co�c^g���X�*�˶�
Static task
static1
Behavioral task
behavioral1
Sample
a729353d1fb9cfebf84163bebc83343a05888fc56b3bc6e55db972b370b17fda.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a729353d1fb9cfebf84163bebc83343a05888fc56b3bc6e55db972b370b17fda.exe
Resource
win10v2004-20240508-en
General
-
Target
a729353d1fb9cfebf84163bebc83343a05888fc56b3bc6e55db972b370b17fda
-
Size
7.5MB
-
MD5
042e34271f2419c57045595484ea67c1
-
SHA1
7ef9fd6479d00213dc3d4a4e3db31fe4264c2972
-
SHA256
a729353d1fb9cfebf84163bebc83343a05888fc56b3bc6e55db972b370b17fda
-
SHA512
2801f31fd71710ebf6cdeabdf59a130f74222e0789ca0df9883699671e3881fd6c7944525504114a88a0299994f12209505f1153217675e76280e8aed8eb5f31
-
SSDEEP
196608:dAVLfAESmRA9OREufMHcx7SDAfjNupLaAnIdoNkH5YhzTcq:WLfAESmRA9OSHHcx7SDGNuJIdoi5afcq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a729353d1fb9cfebf84163bebc83343a05888fc56b3bc6e55db972b370b17fda
Files
-
a729353d1fb9cfebf84163bebc83343a05888fc56b3bc6e55db972b370b17fda.exe windows:5 windows x86 arch:x86
5a8ee94a4f825697145b679b8998b6b5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysAllocStringLen
advapi32
StartServiceA
user32
GetScrollRange
kernel32
RaiseException
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
GetEnhMetaFileHeader
version
GetFileVersionInfoSizeA
mpr
WNetGetConnectionA
ole32
StringFromCLSID
comctl32
ImageList_Create
urlmon
URLDownloadToFileA
shell32
SHGetFileInfoA
comdlg32
GetOpenFileNameA
wsock32
WSAStartup
winmm
timeGetTime
netapi32
Netbios
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 50KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 476B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ