�#�����*�@u�Lq�7�[gƁ����>�a.�S��ѣV\.�/�j���w�Co�^k`�n�T{j�8�e�C"Q��įQ���`H�C��`�����@Y^>��Aj=.�Ϳ�����=�1�+ë�y��~���j�� QmH,yX<�&u���D��xJ���yZ$��y{��= � ��nBz.�]���x�7�U�-/R"��X�>�ٖG?H�N��˄7�P�&�<8��^���X����j�f}g�O��g�A#7íP�E��{�É �r7���p�g��&��X����2���~,'z��+��]Rg�x>��Ao��#���5�P�C:;� ���B��\��]gm���}�ꛘ#� W��{�#+]����<LWF�t��Ѣ*'O�.�w(bK8��L���x#'^Kfܾ����+�����jמ�+Z�q�i̩Ț�ˡ�L@<�'�]lS}V+wi�S2A�ʿt ��OY�|n�����e��s@Ot�>D�5�:iV:~��[s��0-�[Xz>}�Uy�O$�gr�߰��}K�.6 �$�����!��|X���2��GG��L��N��Ѯ`]-W�>��,��'cP�/P�%�\1�Wײ������P�?P�1*�@ρnАZI�é�g�X�u��nk�G�%q�q,^R������S�A���{��:`fe5$�&Y��������'�4 �'���Y7(�s�(��@{QHdF{J+/9R�����d~�h��$��`��ðVe��z��13dG�l����3�S������{� �>6'��"�HM�a�}}��3��O � >�$s�����e>u����I�Ɖ:*�nQ���������X+["9�Ԧ`>�l�Ük��5����g��o����m�����(�������%P��9�[~W��#��ͻM�N���d�|-�m�QA��;o.-������G����$�(�I���ډ8\iV0O��"�������K�u+�,����[�?�~�����-;�y�~Ol���%�d��\}�K��l�5֙ɼ0]F^��-�z��|*����"��!��;Zh�a\U���c�}1Um��t;��]��z·Ts�59*`���~�d`��T���wOW���/�=��"�W��T�ټ�[n}o��-��訯y�x F�md��7c1��j��,S�+��k8x�X�[t'(�%�R"`�%�0����$<b��%Es�#��6b�J�_ܼ�3�3�^�F����[~�2��O!�z�����.�8�c]��Z��G���A���~x'��L86��SВ����3�K�E<�k �`_6�y���8T�>쀅1�y��E�����`=���j�k�2}П+����J_悴Z�9�I�:d;"�&���A�A�Y��y n:����r��I�e�GhA�K� t�ƫZI[~��� ��ٕ r�ɰ!���~� �Z#��|0ڦ�a?6e 1�d�>nD�$j��6�Y�g`�yt��E���g9�u1=J�]R�r�YKJ��A��C�vNӕ�N�������d�����ax/�����.f���)h�^�u�; &��X��(�1YQ-J�Z��y_���gׅ��ˑ�B0� ������.])�AW����?-���P���V�C#f�u6�k��q������mL����j�B�\�����,�k+��'|�����pc���Uc���������;�Ж�v� �OpNӗY�����nꂸ���ϛ��+/��/P��Y�F��}x������8��$��b6#��aKB����4��U�X�Q=B���S����mlܢ�}/��n=���i��Ar��� ���M3�O�d�(����F;���?�;�ލʢq�*I1�"��8��7�"Q1��A�I����Fݯ-�m̬���u�o��i�s#�ZF��bt�$�c��DM���n1�V��N!3! ����l 1�ߏ_�0ԙ']G��n[� k�4'�rB��FIӤ�An_ti��t�� � &`�D-k�BC�}sHx%g��Θs�[C���>S>���b����U���Z-�;��]rY:���dk�l���쌯w�D�����Mp�M�L��F�]:4�v0v2���fzُ���NU��?p>���ך:����"���8��"�iZ�g'�7�j%�����%A8���l#P���Nj`Kn`q��r�x���Aw�3$_� �&[��F����$XUH9��7�1�� ���G0̆ܮ����&'H)�+_q��I�7��?a�̐�DG�֒ 02s�W��X���ZS9Q������ݡ!\+X�� W� �����W _��ߜ<��_kY�l���w���_���:Q���cm�|�$���_@n��sl�+�rΐ��c $����V��u�}�4U��ת����A����>�j7�s)�b�gN �r���N, FȦf��x-�w�|6tDl�Rэx�2�"0��`�B�[��[�Cpp'��5� @���ńk댒m�sOs��� "�t�p��}���b�q����i����4���P�����T�"a �� ��#[p�䊁DSv�h7A�)��%�Q@�T��ң��[�Z|H�m�A�hXSs[LʈZO�#�`��H�w6���̵P%�UuX����1˕��Hvs�����S(t����3Y�V���8��t;����k�:�%�������E�<��bGoMZ|�/i���ϼ�:@8;]�G�`=�{��<�=B���9�|Rl}c�ŏ�(N�7s1R#�|1����S��0�Xk�2x����f��a@BW����2�|w(3�����-nN�`]���nkq�D��|�N���{̌I5e�Z8�=�ק�D-Ot��<;�!�@�3'����r2��D��kO������yO�|�5;���9�ʼ�;�̡��b�hď���%�,1�������_W���$���)>k���1{F1�Pz�� ��� ��g8�Kgzp�l�Psm�@�܁��X$!Ρ����9�s4�X3�ϷY` 5��-��R��t/r8l/�"(�����M�t��(^�[Q��D���k��zO��=z�k�y�
Static task
static1
Behavioral task
behavioral1
Sample
2c63b3156f4403d287a1d34449fbceb9cf760c7036e585e8c42b23463b916462.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2c63b3156f4403d287a1d34449fbceb9cf760c7036e585e8c42b23463b916462.exe
Resource
win10v2004-20240508-en
General
-
Target
2c63b3156f4403d287a1d34449fbceb9cf760c7036e585e8c42b23463b916462
-
Size
4.8MB
-
MD5
0d6149caadefc108ebf3bf6a17cc794a
-
SHA1
b30ab5c06ce51faa02e7e043a227da03e99d4c29
-
SHA256
2c63b3156f4403d287a1d34449fbceb9cf760c7036e585e8c42b23463b916462
-
SHA512
f164c50b3ee739ee256962fc1cddcab9cdc0514ff8e19ee929be641e4ebcd526f35c0a8e7b10d71b18801015e665978f8b6284b820083ef64a762e9b1e5e011b
-
SSDEEP
98304:626YxwxwAwfSF0u+sm1M428nkOTd/BHF93a1Ijacj:J60PW+smw8kOTT3Mr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c63b3156f4403d287a1d34449fbceb9cf760c7036e585e8c42b23463b916462
Files
-
2c63b3156f4403d287a1d34449fbceb9cf760c7036e585e8c42b23463b916462.exe windows:5 windows x86 arch:x86
bb3ab4fe8d924e67a49918306d39657f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ord17
kernel32
HeapDestroy
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetFocus
comdlg32
GetOpenFileNameA
advapi32
RegQueryInfoKeyA
ole32
CoInitialize
Exports
Exports
Sections
.text Size: - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ