�l�{�ܲ�Ҋ?���$W�Q�ԨtgxJ��8�K�k�[�݉)��_++����$ n��"���C����q~�&�O��¼td� ']z8;3�����P����, �z�$+c`��A�+��:�w �Ei̺͂B��jl�^�ʕ[HH��D?h����~���C�����jVfG�8?��X�p��V�:�Y�23FqC�X�|��Շ̠aR��������^���)�������^���=SY^�R�7�G�l�� �$C���/Ёc�C�ގ{�����>�������JAOl����@lvs�-!R�3Pܵ�Zj�Z�� ���=S�X��z�8��=�*ep�V�l��XpsNz�0�B�z�Α6(�.����{�H%K���A���+b�Z.LNZ�oF:���#��3�o{��ɮ���d�2L�5��CAC��~}8P�I2�A��D�G�KD� j�z)AZyyE�Y67�c���o�����-k�ݿ���h����'9RfW5�%7C2��U�G������W�t�a����'5ˈ���]'����8;�6��(��������n��m���˄[��q�^�k��ye VV�T�D:S�g�����,�� ��v�w�<��]k�C��F ����ġ�,��|'�?f�Zf�M6 ��{�>������CY�0���_�����V3��$���5�61WZ>�k�"����~sI�s�zI�}���O�:�֝���3�țň���U �)y ���gc��X�����i��|�Wl:���e���a�ݓ�3�23�7Q�H���.!���~2.��3eF�v�L�N�3!�I��z5�]��Cv/����S.�Y�p��즰����sk�`��s�G�2�]�s���M�r����6:�V�4/�����8Kq�0)f�R� �� ��p�f�>���*��W�KҲ��_�m�Q�[ˊOzp���<?9,!�j������u7/٭�O��92 �t��9iP�r�D��~�<#�t%�����H�'$�GU����b�f���k�:X��������UT�>azpĸ1F�$��G�ƒ���s�b����=4�Q@p�s9F(Q�3���Yi�`w���]R�Q�k����Q8%���9P��kj18僙� xl�6mtsv��,U$��S#�����[^Q�w0�x�NL_��l���ڗ"]QfYȮZ�,6Hr�$��'��"�n�t�#OO��·/��{���e��o �1��r��i,-���<��O�C|��E���M��]B��&ߕ�;��x�c�Cg��R�������ξ>�5�����㳃��#��R��G�%��c^~`�fXﶦ��^�A���kO�A��j� ���D�;��!ϗ�ƈB�oI�d[��XMh4_���}5���es�<�N�a������r7�|C[�����\bn��= ��z1����>vV~���;��Vg$`�>Al���u�� 보7P��2YZH��K�h���p����7����)w��7���g 5pSBVr� ���=!_$v{"mF��,d���1���~1*WK��pw�]����X�C��@��- �?��M���ex�f�I#xy��&O���D���WUN���%�z ңwҧ�R��eK����Q��[���e+���C�b�!}"V�9���������W(s_ڼ904��C,1���|�9��u��2������É����m�,�h����(8��Z)�5����n<��m�X=U �����2��e��>$�5��9*}�c���ė�@�hs����[��,�m�,FJۈ�#�%�G�[���&�V����y���ɣP��[� ��z.'K0�X���ЬČ^�p�������� �.�ڌ�Ň��7K�x�y�+P7�H��K��Df������ kޮ} ��i�4B���#��#�I�]��h�9J��;��)���.*7ƝW�]�V}��7��I�iBiV�C� �� �`.j�M)Ҽ'��ݫ�Sc�� �@��;�̄E�;�+�:�S��Q���O<�cM��n\x䖟�Ϝ���ҧӣ+�Y����hTq���i'�K��������̅?B�կ`k/v_2pn��6+n'��=w����7W!��� =<����c��O�9�U�M��:r��D���茚��(?�����!=h����0-���N߂����u�e0�*R2B�z�������|Q`ئ�"�L���>6�ne��ү!��[]�7�B&�Y��h �R�#�;&��#���8�Q;���$�mc��㦁�# z��v�`Y.XC��õ�˖������,K^���Û�l�z!��.n�]����g��P��#NQ�_�Le�6v�ћ@@�gs�UIt�ga�i���3:���AR��g�͕c O��-�ZeuS�-;�0��Z�j�$�! �欛s��q;��7�G�O�X���s��kW���:1�b�+�<�\����t1#Q�7҅5isȴ��j��������AH-Z�ɱ���uU*1% 6���!� �u��JV䊩��'u'R�n���RΙCޙ��Ӄ{h9��^�a�-�SJ��J%1"����l!G�K��>�rq�"��J�[E+�6\�MKS*E��}햅 ��XZ����+M3�7K�w�ݍ%�d� �b�J�y{,�ד4�����$�HYr�UT���[��"���[f5����Vsp��M٥�'���#�{Y�x�i��w(�nuc��_\��*�"{Sj9_ٖ�#Kf�~�T�Q�J�R�\�X�ݿI�9��X��"��P���������� p�-[ct�3�~��6ے�c�o�M�9Jn�\J�;T��������d�PW��ޓ��{�ϵ���a�����4~f_��_�1��*SY��{6 �̽6+�=�.�� ��[��n,z��gsɮsԲ���8��k9d� �m������&�!���`�C���8�g&�0���g���cW�>�s��x�6��4�w@K$4b��� .aks1&��mue>֜Z�$����%��L��/�4r+�A6�����k4O����5��{�m�����Z
Static task
static1
Behavioral task
behavioral1
Sample
c40be61f18078e31fb0146a04d9e62c4b3ad70433b8635a6b49d32da9b4ad43c.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c40be61f18078e31fb0146a04d9e62c4b3ad70433b8635a6b49d32da9b4ad43c.exe
Resource
win10v2004-20240508-en
General
-
Target
c40be61f18078e31fb0146a04d9e62c4b3ad70433b8635a6b49d32da9b4ad43c
-
Size
633KB
-
MD5
6cd9d099d74dbb0f2e9f12fcb341dc7e
-
SHA1
5b815ce5613a235460d364fccd61726903b6e89a
-
SHA256
c40be61f18078e31fb0146a04d9e62c4b3ad70433b8635a6b49d32da9b4ad43c
-
SHA512
6669482dcb5b910c6019779c70cd07ec2d416c012faa71050e200b58f0443d68030ffdc874ed5f23d7f9d9223d9912b69ec79a6d26f96d4f3099e90e8b98a3d4
-
SSDEEP
12288:65jFAsZs1Mi6uTV478udJEsW/PSIWLHN2Kgb:iAUs1Mi6uSYcfOlEs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c40be61f18078e31fb0146a04d9e62c4b3ad70433b8635a6b49d32da9b4ad43c
Files
-
c40be61f18078e31fb0146a04d9e62c4b3ad70433b8635a6b49d32da9b4ad43c.exe windows:5 windows x86 arch:x86
71694ef220b9f52f5b05e3d3e1d26707
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoA
kernel32
CreateFileA
MultiByteToWideChar
GetCurrentProcessId
LoadLibraryA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
DeleteFileA
FindNextFileA
FindClose
FindFirstFileA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetProcessHeap
HeapAlloc
HeapFree
GetTickCount
Sleep
GetCurrentProcess
GetLastError
GetNativeSystemInfo
TerminateProcess
WaitForSingleObject
WideCharToMultiByte
CloseHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleA
GetProcAddress
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
HeapReAlloc
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
ReadFile
LCMapStringA
LCMapStringW
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
GetStartupInfoA
SetStdHandle
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
wvsprintfA
SetDlgItemTextA
PeekMessageA
DispatchMessageA
GetMessageA
TranslateMessage
comdlg32
GetOpenFileNameA
advapi32
QueryServiceConfigA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
StartServiceA
QueryServiceStatus
CloseServiceHandle
OpenServiceA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
EnumServicesStatusExA
DeleteService
LockServiceDatabase
ChangeServiceConfigA
UnlockServiceDatabase
EnumDependentServicesA
ControlService
OpenSCManagerA
ole32
CoInitialize
CoUninitialize
psapi
EnumProcessModules
GetModuleFileNameExA
Exports
Exports
Sections
.text Size: - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 327KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 475KB - Virtual size: 474KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 157KB - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ