�rF�0�O��nj֑#I,}��4�����oǡ��z�Q#^ �p�J�������ޞ�}#m�D>�)���G���Q/���`K<D�ގ�t�n�G#H��U���������Ó&�h��9�B����.E6���eȒ���w���ttcꭥ]x�$� ��fQ*����c�� hhL�M��x�2l�cH���!-�t��uߋ��5�P!9a)���ftާ�H��������ӿ�U��:�rוɀ66\���dk��E_�?�8��NRkV1�9A�^`��7m#�b[��#��V�@=�������u���Y�'������/��Avf��h��P�)�����.{eW�Di&i�&#�4��\[x��I�A0�4�7�S�� �_�K&�Jz�-���[����7k�=��?�ס���G�]�k��<������V�L��l�kTV�:���C18������M�8�J��Sn/X����\,#�~j�e^��4��>����Q�p���-�w.<�����DwT@��h�ʤab�X�'#<Z̺b��WBQh��+ʞ�}m@�e��"�������EOv�ro��'&$Xm�E_�/��ڰenA�����r&~z#q�9�SV�0���2�EZ�?#0�B�"OX�{=�s� S��)����*����{���莧C�6�z�V�N_�����z�2��MMn^�#G�Z� ��u�0��M�b����9������切��'+#��EZྐྵ��J��C��e�vg-�kg����5&�i�� �p18p��`�P�D��_it�3�0��Kd]D���6�Z{G�}��9�,,��� ����ԘO �Z_�=�f��n]��H8>���2(�&M��-�$�+��#W -_���:2%�Z���g7@�>��ßӊ'������\���=�BTgj(w�u��k�R������c�B^�ՓN�fu"a!9<�=�~����o1�uk�\`��gnI���7��fg!��`+���M̺-Q)+u^�c�&�<vG�ܗg�͇a� �7������l ����<:KL)�y�_���TX̀�t� Nd�W�%��sО3.D!!�����d��P>�}).?�C�/���J��R�����y1 ,�έ�'��`���Q��k���K�f��L�wb��=A> {���L���|���1�yn�1"�i�ewv$�r��X��� M�3�V]5�᙮a��X�K��� 4h�C��E�4�@�����Ǯ-�8�7��BlBq�a��z^h�=��,�pU����5V7��S�)mB !���jY(��VlĿc�v����;��:=�l�c��z��g�o<$�P��2��Y{ ��P(�L��� ����^`on�˄�#n�B��5]�<�(Y~o����P��"m'�s- ��{ʌ#� >H����o��B��O� c�6�W9������\�}%s��6)E�h���6cm�J�K�0��q�${�A8_��������T�6̅#��5^BL���]�|����E<����U���J��e$��z[4X$��Q6b��[�2k���s��+9�蚦��4�����&�_���\�7_cy9�}d��54Y�[�0�.�I�����Z�I��Ǿ��t�!w��Ol���n�����K҅�_뽷;�Kq3�S*�u�I/�Le3�Z���s������,K�h~W�խ��.��^��˯b$� �,���(��Mb��/����%�l �"��W0�.� ��IE���ݐϟ�+�"�ٜ��YU�wrB���u�Y��A���a�T������b��i�3��8��� �ƨ��{�rB��쟥�vE�ҕ> Hi���KA %���bq���JЂG<�WY���Y�`�H��|#&`�(�Q�b��r�US���G3�/�A��Ԋ����N`�ណ���g�v��Ko�]59���8�T�X�T���0������)�����q|p·b㘵Q����hl��?��a����$YVo����b�#ys���g3��4����8 ���"��\����ɥ#��9������N��~�U%fu�+쾗�AQ�-�����A����O�Y6� ����Ch�����vG�/y1�~���Z'�ej�CG�A���)�n�A��V���s-x��x\$�n�I�R�8��t���.|H����Y�|U�����V�\F8m���h���GC��-c���=�;,3�t,������R^SvٔX�,2�����7�DGy���.��_�}��O��/���T��ѷ�g��p�ݳ6�w�pɯp;_䱯� �ip|\�X��`�2���g�!�y��.�I����nTc}���}��j�8�\u�2��ߎ��1��s� ���(��ۉ]��|vT/j��\3o�Uz��#hٗ��V06�y�տ�#����}�����e�c��2Ũ��f��CVJA���͂L�U���rdQ5fe� PT+���b�m�,&%�q<E�Ͼ9!U�ͅk� ���э��*�b�xʼ���E���(���n��y�b$yxϛ,�du-��.<��k'p��V̝��4�e��K5�~'͖��٢��B����_�"Tƅ��;���}V�����>�+����Б�N1�_��ɕ�3c�m��-�oK�k�����*��<��m��#Y⛙�K��� ��B��^>�9��} p&`���K:##��jFQs%�1� �ڔ�8��H��*ֽr���c����t�aЭkja�Rx����܀��V�����������Ŵ ��I��u��a�X 3R� q0�{&oG�:�K}1xXy��o}����o��G�[�?� �Ș�o>��G�.v�m} 7=3��f��)C���-��gr� H���洝Z���#���m����̡|�E�K���p�����p��M.A&����-��2�dOf�rQ�bv@V^�2�k?��y�����Q���#������<4=� R4bY>�&����@-�(�C�:Wlr��@Ìo�\w�.�Ga}���NP��:ߦb�É\E-�Չ�,�!@�p�i����j[� T�n?����Y��
Static task
static1
Behavioral task
behavioral1
Sample
e2056af14c8d2512df02fd494085daf9b20f8ff2d4170f4682ea5edaf4cd2825.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
e2056af14c8d2512df02fd494085daf9b20f8ff2d4170f4682ea5edaf4cd2825.exe
Resource
win10v2004-20240508-en
General
-
Target
e2056af14c8d2512df02fd494085daf9b20f8ff2d4170f4682ea5edaf4cd2825
-
Size
8.3MB
-
MD5
a3cb774ca6d8a128718d09c2461dae64
-
SHA1
b4575b3a39b3f05541f5192df8dd64d3ff298a78
-
SHA256
e2056af14c8d2512df02fd494085daf9b20f8ff2d4170f4682ea5edaf4cd2825
-
SHA512
64bf2f40b4d7d02e5c875d9cd6f6ac81d1bc5dbd8027ca973615cf5c8e7443d8a07a6f2578c10c37c3894b6f8c298d857ae431edda1708de644f5f470be8ae13
-
SSDEEP
196608:z9gLKYdACa0Bpbp0wxZGUG8vOfEP/MisIUgIC597fpUARejS+28BRoQ:WL2v0vbpLZE8cDiPIC5VRUAovR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e2056af14c8d2512df02fd494085daf9b20f8ff2d4170f4682ea5edaf4cd2825
Files
-
e2056af14c8d2512df02fd494085daf9b20f8ff2d4170f4682ea5edaf4cd2825.exe windows:5 windows x86 arch:x86
929be1d5c60075c2f1da783df9c8bc5c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
SetCursor
GetCursorPos
CharUpperBuffW
kernel32
GetVersion
GetVersionExA
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
gdi32
SetMapMode
GetViewportExtEx
ws2_32
setsockopt
WSACleanup
atl
ord42
advapi32
RegOpenKeyA
RegCloseKey
ole32
OleInitialize
oleaut32
VariantChangeType
VarDateFromStr
winspool.drv
OpenPrinterA
OpenPrinterA
comctl32
ord17
ImageList_Create
oledlg
ord8
winmm
midiStreamOut
shell32
Shell_NotifyIconA
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 599KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ew] Size: - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.T#\ Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.XY* Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ