ͷ�6���ݠ~��O �3 �Zwʹ��2��q�05�k �S�ޭJ�i�� �����n���x`��PB��P�#�K&�L��k�+�!��>{[5|�>Ce���@�.W��h�&�?bM��X��������o��A�۸s�����s@$�O�|���(���g�BxE&/OC%R���q��1x*e��*v����CP�xށ�R;�>��!4)>���CC�ɖn�?���3 x#����?5sf�����_�̻� ;nN��6�,�����tqv~���4�A"t;bБV2�h������S���}[V ];���}e�o�?Q �|D��B�1��RbB>��䩪�����[�H�ҥ^u��|��udSZ�ov��+����i�_��h�Bg]Հ��aU����ak���^�D��D�.n����a���tM5�Z��� �aA7Z�ݼK�ԥ!7�I�ϩ�r�)��'݅L�������������L��kf��pxsX8����q���5�g��p���O��OrY�����:�a�X���^��b�?���� ��Ϝ�'� PuSX�aU��րآ��T{ ���i��-���������q�I ʼn"dah�?�LdF/�g�B�k��r��:����rD�q$r?3��C8�'�-����Xn��˄LSf���c���r� �N����I���̞Ȉw�)@g5��%��,՞l��� ~�"��I�! ��)xp�����*r������d��>-ܺh�Cjf�<"�B+j�Qq���%G�-�C�����==bR<\���hV֛�ZĘΙ2}���|�!������[1_�O��@�\��k؉W����z����#�^b�YU�r߶t�B����#���ri' �� �*z����< ʬ�� �?�2چ2�%o|�i�]r����Q�r�<iCg�� \�ȍ�&:���������]��/Vl����]:�oRl9 ������o���pC��# J�LX�I�UȪߵ�Wf�R⩿ \���E T=�'�*L�������,jHn���s�I�+GH.5^�U�Ǧ��z���{������|�e��'�$_O]!� Kxc�5�/���5Y� 9�w���#M��e�����?r�X�z�<��)��de��G����(j[���Y,ǧZɴ+5U��]"��=��2Ww�_ g�8u��w)���J��/���OV�T��m�y �9Z�ǝ�8ئ�D�Y?�b}^1H<��H�зog�/��GU��v?�r���MO�.�W�� ��D5;b��Z���^�� V\^�_2�b����*p*�0�F�=;�����w:b�� �E%����!2 �rJ�� #C,*����Ti��2�'2=�,��j�bF�)1�n�ܱ]~�&�K��+�*x�{i�l�]'�|E�{~s�=*?��O� �����FyL�Ix��W���K��s�3��R���Dm�Z� TG�3�J�PEPC��rc�c��fB��S�� �x��g�ۤ_X�NK0����3�� .Dk�H�a������5�Һ����C���o%���+ ���MP��IP��o�e.�A�Bd�G.�y��y�c�&t�Iפ|����(���I�d��U�ZV1oT�[���0�)L�b��E��i^28�U�86����[F16�Pz�?4đ��b2���V�>+�f�,�1���M����)�e�á 9I����=t�!{&��æD3p�t��X�.K9l:=Է�dGR��Q� �R@a�vtz�_�[bU.��z 2GoO�B$R�����|�5�w1B:V��T��V ~���G�X_u�~�7���g�h4����bm=�z7Y���f���������x���@��@��2�މH��7&a6��iL�n���{k����}����4 �'�{ͽ]���U�������S�<���f�j*9����$;q���W�S|K\h���O��O�c��3�Dx�����,�=)Y (�ȵ(�SIӄ�|&��a������nǢù�s� D�yy�>{T�5�F>_i7�� ��������j�.�^?v���,:�[�V�_� �;Q��*Hm0s�Uj�����IP�U����C��p\�Y����)1�%��VT��ë���EY+t�֟g�@��~ua�����"kv� PK|��.�_�պnW�,ʟ�u����(KvC��C.Q����EW ��$7\+���^n/:�&p��Mmj�ꇹ���r���������jq����^L:��<��<�i)��N+I [���3��%����a�9u�n�m&�����Qbc�-T���[�$�,?_��o���'o��l�Pn�z�`��P�>~�|݊!1���Ҿr��ݰ���;��:FV�Ӟg+X������4�fk����e^�$E���6��Ý��Ɛ���,-��J�L�w5�r�c��Wڪ�����=��<z��{� r������l��3"Pԅ�����tkr6���;徜/{-.���U��S�Y�#ċo5�y�#����\aI�!xtVT�$Ss�Xp+Bz��LԖ��m݁���&u�(���������8[��1YS�<Qҳ ��n��>ōo`H��?�[�(�?���/��H�74�s�/T���&��J���l������_�9�q���4-R��Q�߄X���u;�] ���*�}ީ�ij5�~�?3�қ��6��k�@��s(��-�X��ё;`����+ƒ�N���� ۳qp{�J�UsrIi��s�<���:F}���(3b�S�^���ּ�kk��n�����G��8qR��8������wd!Z�[�+���y�����by�;�Z�h�LCN`�y֣Y�֭"���C�3��\צ��"E{��@H��j� X�j��}�Y����� ƚ�E�c�����9)a��f�aw+�!��Nҽ&�Slz�@�A�Ɲ������t�'V�-+Բ4D�8����۽����ѧwC��I��x��0��)Z?����ќ�D9.|@X"�=�5����hE������V���NR�1�ҺM���ٱ�Fx�<6G�, O:��B[����pH
Static task
static1
Behavioral task
behavioral1
Sample
3e86be837039b684f4a6e12080723b1082e5d12d529bbceccb942f178a0d2420.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3e86be837039b684f4a6e12080723b1082e5d12d529bbceccb942f178a0d2420.exe
Resource
win10v2004-20240426-en
General
-
Target
3e86be837039b684f4a6e12080723b1082e5d12d529bbceccb942f178a0d2420
-
Size
4.6MB
-
MD5
33aeae721c5c860ff082d802f2460b84
-
SHA1
f795b453f8232e99f93f0f10a9b8d89a8616060f
-
SHA256
3e86be837039b684f4a6e12080723b1082e5d12d529bbceccb942f178a0d2420
-
SHA512
831ef2807cfd79bf9727e6278b558df7d3d4a2388883c98aff73f2ba6247ce6594490b0ed49acd5a1fb91e8a05ef88c183845b91e98331c58c0f638ef159654c
-
SSDEEP
98304:mpzZg4fNRSH3dT8l6rMvU96JiH+lvpqu6OCp9Jbt5Nikz0mMwq0KWaPikLzcV0TG:mptgANRp8rMvUcJi0Ab9Jbt5ck00qac
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e86be837039b684f4a6e12080723b1082e5d12d529bbceccb942f178a0d2420
Files
-
3e86be837039b684f4a6e12080723b1082e5d12d529bbceccb942f178a0d2420.exe windows:5 windows x86 arch:x86
95a01dc37e9efb718b216e4cfa2e3c59
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamStop
ws2_32
WSAAsyncSelect
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DefWindowProcA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
ExcludeClipRect
winspool.drv
ClosePrinter
advapi32
RegQueryValueExA
shell32
Shell_NotifyIconA
ole32
CoTaskMemAlloc
oleaut32
UnRegisterTypeLi
comctl32
ImageList_AddMasked
wldap32
ord29
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 862KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 420KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 148KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ