�G��,L�%[�җ�������n�Z��N�1�:��a�W�̲�����+�T�n%5�6d�Dcឤ� _v��එ^�+E)��2zh� E��:4�ҵ/ke%h���+\p�W(���'n�����p.�t�ta��� ��٘��'�Ԛ#G}������@�{b�)o�"��-ƴZH(}��C�0(/��P�"�/j"B6�����`~�"��Y����&)������Iֻ�E��-T�?��s9,��gxۣ�j�Br������{�J�3��J�T�9�����I�2��Y������ )�l:1���bHk0��b���Q�03ۚ���;���V1�@�ƥ\�X�m^��@��4%��Q��8B�e��� �uO��kO5��m ����L+X�N?!� ��|* �LNbm ���������m���p���o��P�f]��V����M���c^��R��co���X>,[m`'��0��M����W�W�����Q�̹m�U��1 ����������%�"~ah�f��:�z�}�k���0.��L�m ��Eƾ�{�#���=���5q@�������朏���/�o��ˇAX��X�i�� S�,(�.[�m�6�ySآ�Ǵ�x6�dLy�מy3K)�;ɧfy���Z�b�DV�A���Mݎ����YJ��+<P*��D�ZkG�g��.Vxμ�1��U� ���|�0��\�Ģ�{���.��z�ݿ���1�/�b�m���i�5��'�`a �I� !$�һO"e��ʄ�Y�� yHs��|#�'y�G6`��`8���]���+xv����p#bI�Y����S��%�{������x�g���%�3�{܍t3AJb���H�!p�`��v�&ۓTA�me��M���ir��Dg��P})�5`��@��}���Y�����̄��r�GW�`]DZ�6<-_C>�-����F܊�pm��������J�)Nc���W�����R����zk 1�z �:��+w��� ��/�l+2�S������/w��%Opn�Se���d�1J�l�,�7���r�֜Špeq��^������z#�>۪��n���;#�#�5�*���荱�$��G�-�]&��{/P<@��և�\�6���ǔf;@��#0r��A>Z4Jq��B�,�� ���%g$p��8�7���v�L6%�H��ȑh��BI����qB����@��s�{�J�j�a�?�*!�-�:�=����C�K���mz�I�Й��F��綌���R���]���g0 #���q�'^����o4����@����ct�����q6��7���/�߈��G��DOV���{�M��:Q�Y�,�\Z��0��p��Hԧ*g�ܹګ��Ը��ϛ����FM�P�ř} �nѣ��w�8\�p����� ��j/~�aR�W=�g��g�df��I6Q�V����yq\mYJg?s���w��i��ӥo��Cv8����m���dp��|���]41��8is+.�]�b�j�������%_�o_����:ؚ���Ŋ�a���z�5UC��R\��c�3a4)v����nQ�\S웍/�oGص}���M{��}�y�i����SP������i�����4�}��?���J���}HB)Y�e��� T( �e��gUOe��m�l%l��U��1o�|t(��B�3-BCW ���)��ғf�{��P\��|)|�W`�i��[�S:�>�U<~Aֹ'a�A�[Aݪ0&�][��Ȋ�n�@U��(�Ms|��?��LBlgi.�S�Wh3�͑�t�9o�K��zH���_FQ�3�K��[�C*ʘN�>��c�x�9��!wU�B.6 wg�B<�Hj�{�x*�G�8�"���Ig�� ��1ժ�g����t�� �ղ(|���/��ʻc�k��.Bax�����w?��c"�=����8�JY-�Ź��i�ꓴ��� 4��J9b�4�#�v�ɜ!����u�v�)�����tR�k0����Ax L����j�5����Ɵ�΅X�具�P��]9��9ֲ��$D� ��e�3�c�9�u�F]����yJ�M���s7x ���?)������.rR�(R���!�S��-G���W���{�\�6�1'���� n�G��X����e�P��89L��@�����[���9�_���O�x㑨pgj�.�^�6[�����.���!�����RZ�JV����#���Fm8[��\w�DW����ya����3e���`��m��F���>�\x`Ƣ�&���*[�f[�[��Ǖ�Z�1����ڗ�n�yG�b����o[;L��љkӽ��,[h"��c˞�C�l4���8B��'�6'�V��*��Qe&�������=L�l���`Cͺ��ʷ��D�2z�c�ɥ�߳�n��d4= AwV3q�O:5UCG�Z�>3{Z�@��6V��1�G��)Sb��a�u���;��5GV0s��@G}�d�o��҃ۯ���a��]�:'�ݤ�ra[@����;4M?����,ز�Ո�$ъ��AZ������e7�[�� �_�h�5Ö9m�џ���5��� ��W���Yk>��fA^��������M"�O؟��PG�˹ `s���������DB62�����n�� 7��roZ�it���n����lD(����1����x5pE]��oRI�d���ۄھ���ϒ��%� <�A�Ʒ����"8���������Ns���E%"L�b��n�H���RG����hO\>A#Og�d�-$��]���jҞ.a1!$ �R���� w�kjl#l����R.6Y^\�$�7n���-�w2 %��H��'���B���/��ü��o]�'IJ��pbx@R�Dz�R<!�g/�VkF���R_�뱘.s���x��E��s�%U���IJ՞F?�,��l�����6��yؿ^!��K:�}L<��mF\�~Y����'�l]̂�qX��F�'Q�N�Q�;�d���E6�$,��%�}��Ld�u^����jkc�F�� ���B�l0�:���L�@_/�%0AE�Յ��Kl�s���մ����$!@��S:����1E.|
Static task
static1
Behavioral task
behavioral1
Sample
c7f4580e3a7ba8d284a9547eb1d863d6f993d3d4e203b16a2aa4ceaaa82d97ec.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c7f4580e3a7ba8d284a9547eb1d863d6f993d3d4e203b16a2aa4ceaaa82d97ec.exe
Resource
win10v2004-20240426-en
General
-
Target
c7f4580e3a7ba8d284a9547eb1d863d6f993d3d4e203b16a2aa4ceaaa82d97ec
-
Size
11.7MB
-
MD5
26584a169578ebd742e8ac8afeb678d4
-
SHA1
a00fe4101bf9d6c606aa5de9bc34bb864d1f44f0
-
SHA256
c7f4580e3a7ba8d284a9547eb1d863d6f993d3d4e203b16a2aa4ceaaa82d97ec
-
SHA512
c1f3996993c7d66e148a9174f8d29f5b08c95a53e141216690a74021ca463508ba8482ba37cf02165d339dcbb57a6112b39717a1a4ea60ea33e6446e27c2f2cd
-
SSDEEP
196608:BDXZtLzp+/rJHrlACPx6TsHembxy2WmtiDrsTdeYyLFEmiRa/BM8FX+7nVxCZWr:BDXZtLzgtHJ5oIbxy2NisTd1yBEta/fD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c7f4580e3a7ba8d284a9547eb1d863d6f993d3d4e203b16a2aa4ceaaa82d97ec
Files
-
c7f4580e3a7ba8d284a9547eb1d863d6f993d3d4e203b16a2aa4ceaaa82d97ec.exe windows:5 windows x86 arch:x86
d9fb7ad17ba761786a4527208521df5c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnterCriticalSection
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetDC
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateDIBSection
comdlg32
GetOpenFileNameA
advapi32
RegOpenKeyExA
shell32
DragQueryFileA
ole32
CoCreateInstance
oleaut32
SysAllocStringLen
wininet
FtpOpenFileA
iphlpapi
GetAdaptersInfo
shlwapi
StrStrA
gdiplus
GdipCreateBitmapFromHBITMAP
comctl32
ord17
ws2_32
gethostbyname
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 277KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 568B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data0 Size: - Virtual size: 9.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data1 Size: 11.3MB - Virtual size: 11.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 413KB - Virtual size: 412KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ