�[�]�kdi�;9���il��6�%K4ٰ���T+��e�������6��S�FvpC!r�@���������.��V#��֪XoN�H썱]\:,%�z�By�] +�a})�W��������ʽ.�w��fI܇�T���㑦8Ӂa������jZgk`#�. kΤ�D�Y��EY�ƛ⤙�|lX/[����iy��ϫ�u2G#���-6��g`�M�]`H(�B�%�Ϫ0X��%�i�c�ު�7��`��XM��-*�]�����>q��Q��p�5�Sb�oE��s�<����cn�p����7��7��M2EѝX�0�h��\5mʂ(�C����(�K�s���3#}�u����MOH�c �Si���D,ؠ:1��E-��>����z\�.e�^�|�$[sL�Qpy+ع�Fo���B�.����܍hP�����L����ʺ��� 瞸8�f]��V*����&�6CV������ � ��M��4��� 3���q�" @A̩O��o���1��͗�����9h��h@�C�I��5�ɉ�-.�K�b�C<��ox� s uL:��I��ȒE��� \�u�.Y���Px�V�%�A:;�{�����Y�T8�b�#K��Dt�y6[�R��z��9��B����A`�oʫr^ԫ�����b�d�g!�aw��pu0u#���U� 3�o���^>�F�f��v�w�u[����X�% 3%ޙ$�W��Քu��Ro��,RD���:L���5:h�s�#����5���G�z0ӌl�7�{��0zr'$q˝����8� ����&�C��������bnm��G�z !�Cj'�����"s� ��� 51SFp���} qs�U�����\ ��r����Z�E���|�(K(!$͔�*\j�c��3�2�V:��[74�7Acb���-�ݣ6W�~��U�Q6`^ y����{)���w$;@ ܭ=�I��;����乶� T�mLR����&�.~�� ��2�d��ns��CT����|���PO����r�vD��d��im,O;f�Ax�v�Bt\2�eO�@��ڍ<%��h�j��'O�C��f�N �:ѥwu�s��/{��a���i��B�L�nvd�����'*��\��۶�tjy��w�r�dž��SSn*�t��yw������wx�:�h�Fҵv� � n���#��sz�Ⅱ�����%&�8 S���p��c���ب�=��:*G.��t�O���8?�Q�D)?������� �s� Q93uw�l��--H�m��~/<X'E'xUpdb����q�ا���ùp z��m#��Q��;�(BC�SK!���f������t�yf����l���i�\�ukp��� ߓ�� ���r�t�9cb�(a���n�Dgj�i��pw�pDM�5�V�d���ا!��5������AmAM���O���������%)��j�m�ԧɻ\ 쯂�?6ݏ��%���� ���X��ێ�5�0�~wN�#�7g]�����>h�CRr�|Ձ/�9i��[m��"��O'A���`X�g_Ү�3�����Ɏ��w|a��*�ቑ�W���V�s\TQ�����/#�ڄk�5�S�g�9��#Č�4�x����c����]#�&�`tT���Z��wfܜ�o�T�+R��ǎ�:C/Y6��]i���2�ʉ|~n������e!���g�7�W�U'��w����r��;�f�)�'L~R����nd |D��a՞U7HkN;���{(�'��ZU���sJ쳧4^�J괥�� �5����^~���j�ݗ���st`����n�1��q" 7*��)�D����I;����G/����ע7�� �lJR��$��.g���`�b���:������@�C�䴔���H(��eL%��F��/��n�'8����?U����L�� +�@Y�a��������� ��>��q�%�S_��<6�5�4��2�Owlj:Q��p�4Hzf����A��rQ�~��5�44�����F�����(�a�!vT��"'ME<*T��&T2ѝ������Q�Z�t��$Q�F�^���o��v�����6�t�d��?rsI��<��uۗ\ +����U���?{Zk5���Ӯ�*�q5�!ڼ��q�_�6m-�턩>�@��x���E�TW�pA���jS�9��Bf�T ����`�Τ@��q�`h)�j�}"��`P��E;ٕ��3 ����6��EN����z��+��OT{C1`S ҟ:*S�0!��}*�E �K�!~s,(9�bF��rb�b�~��\Ż�;l��elE�%ށ�nA�?�����[B㹍�4(�����uV��i���^���6Xݸ� ��`��ڡ<n�:nTz C���x~��_6�t�X�f"{Ç����օ�nYy�,u<[^����v�'<�c��y�3�Xim�d��3��,���D�q�x�;ls��!Ap]���ܐ4�/�������n5Gx�\?��io��O1&P���A���kΑ-�pJM�v���`�A�c����"��0�9�f�5��>zS�����B�Ua=���5~,Y��$���0����9�YC���Yٞ��)v�#�f��-T����P��a]���Cˣ'I�JI�ܥUB����h����&3��?oj�zh����h'g-�^_#C�e�*�s��P�9 �:F S��F��?u�`Mzm��Q���PLi���H��ɹZ�/�m�Ȫa���B2+Gr�\a�UP�C��tG��}�@�s\���O��� �㽡{f#L*O Rh�gM��_3OQ_Q���Mp�aò�$���j�+(,<ν��)������ق���G�Z3F�¢���<}��f��6�&���~У%��%�.�VCx�p�Cy ��ӳ���ȗK�u�Iߡʍ�z3�t�d����JU$i5���8�����_O��~ЍO��n�{�<�S��zw����NH��Λ�Y0���-6-H�����G0rÊ8�����>k�����t$HnT�8!�=���~�����U��š� �ᘖO� �p��r�{���*���I{\�@� F�To������ .���cD�,N� >
Static task
static1
Behavioral task
behavioral1
Sample
d15c62ebab398e9520c00629d47de4c686c986aa0c313a7d9b4c836b08df1288.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d15c62ebab398e9520c00629d47de4c686c986aa0c313a7d9b4c836b08df1288.exe
Resource
win10v2004-20240426-en
General
-
Target
d15c62ebab398e9520c00629d47de4c686c986aa0c313a7d9b4c836b08df1288
-
Size
7.3MB
-
MD5
90c1ba41215dd5eb1e9d5b869d5b462b
-
SHA1
92a14f861900ae21afbf61001a0aa1f65ca0286c
-
SHA256
d15c62ebab398e9520c00629d47de4c686c986aa0c313a7d9b4c836b08df1288
-
SHA512
fcdfbe3c4bd3f4d0e1ac3b200480e705ffffdd3e280e41ac99b3d07e1566c525ea2a5cd0ff4d4733f0774d6f9a1d17e72351ab97467a18870fbc2b021116660b
-
SSDEEP
98304:U/9oVJAvjoxQcMAckIhIJy9cjA/7YDdwSdrZZNUAMKXlwHWDxAAaPP9D4/ZUpUBL:U8sU69147IP+ZZjmH+8DWnBBqY02Nu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d15c62ebab398e9520c00629d47de4c686c986aa0c313a7d9b4c836b08df1288
Files
-
d15c62ebab398e9520c00629d47de4c686c986aa0c313a7d9b4c836b08df1288.exe windows:5 windows x86 arch:x86
2df154c86873371d4376e2295620e0db
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyAcceleratorTable
CharUpperBuffW
gdi32
GetViewportExtEx
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ord17
comdlg32
ChooseColorA
Exports
Exports
Sections
XEPBWQEU Size: 604KB - Virtual size: 600KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
XEPBWQEU Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
XEPBWQEU Size: 96KB - Virtual size: 321KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
XEPBWQEU Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
XEPBWQEU Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
XEPBWQEU Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
XEPBWQEU Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ