X��5 s�ķ�=���gg0b���(X떥��W �{�i#�6 ������N8�R[2D�[x8uv]+�N��JaE=��zj��۳�!S�� ulS䇘���g1uc���0��A�4�\�u��F�Ff�槵O& �߽Cŀ f�/�6X �L�[�uNB�^G��]��н^��wAM!��gw�b��vGa��b�:~!����s�8�iҸ(��؟��W�E�9=}��,f��6�5�vV��*���Tv����w�=I�7~�.W�~��!��U����S~�izV�1I�}��,�B�k8����s5�6n ~�;�^#r���T���h���,�p����LJ�kf|~~�u��&��۞��kz(CF�� ��h�^4��l�,�`����9K��1��X�s�_�=�.<y"�3��qWU�jW�45��>�"<��C����m>���ܞ��'���M��h�롷��ꃺ�Ƈ���T08�/�`t�h�&�'k��ް�,�j�Q=���:R�:���1Ǹr� ��/&�����E5Ѐ�4C�B� E��pOM��;�љ��� ְ����,�y�!�wl�|��A�#M+�N�$� ��C2a�}L���1ϟ��G/���z�u&��L�p���Y@�PR #��' "p������f��-TC:�=���#,{D�������G]�Ԡ����{++�Z8��@��1�v�W� e��;1�D&���@4�|����q2�wކ[N��7��f(��Ot�3g�$�V<r�Cgʻ߽_@A=�K��K��U�������J���Z���X3+������� t�wK�jD� !`"M�;NA��R ��J[��Aip ��������c�Lz�A���d��J�D&˔������1{�i������Z�!��Y�F��H@�Q<w��nׅ��&ڄe7+_���)f�'����#���Y�f��.:�S�b�ݝ���wp mb�q)^�o�> N�g=�^�N�IΘ�����0�P��<�{j֔��qE�ɤOS��C�ND��W����7R��,2;�/;;q�}�`̹��ƟP�B�z�X�#��A��;T�/��R�������)'_��� D�� 5L2�۷��U���8����m���� kX�pH����-�Ot7|υ� ���UQ���LNY�[e�P�����GZt��p��~@�JK�ca���&�X��g�Scr^nƕ�D,�ɺ5g'��dq��($�#u%�����<����j�,v��A[��A���� =�-f�F��1c����h;�]�fT�/�9�+�� c)�1�e�p��P�����՝C�X�~`"j��o�]��� =�k:=6p�t� 8� B��/�3���⋐/�?����������$5����QR��$��p3����@4 L?�^�S�x�&����{�u�j����c��#��W�#�_��郖^i�/��'R�p���K���u���.�D:�9�����FkʭL��LDq\b �`n�.9W6r��l��$�rK��#�jϬ�XI#,У��#�I�ְ��`�ٰ �-nB��\��ĻJ��bd�jm�4�.���9�ˎȆ�:"1��hF�~_��@?��\�-U�2���X�/�h�=�y���k�=��O�;<A9�C���r��.��F�+���y�m�4�M�3�����k���4����x���EV��ߚ�9�� N����Au�FC�S�ۆ'�,nt=#w+l��x맊��%I00b�G�$��"f���̀��%��̆_�x�S��������$�Ke���7f}���L�9��3K�����H{{Z��L�Hg7Tx��c����,2����r�^Ij����C�1Rj�5�nK�������ZH��_q�4y� PQh�z�H�k��M�����ƠЏ�-@���ԛ���8%�N�j��Ib�a�����'ȡ�T�k�Wcf�N�z�j������u#[=vFG�ܧxsM��G� LT.)v��s��W��r�rˢ�b�]���S#���r�ZK �پ{�������/�W�� x(����F��c.���Ԏ2�{T�`8R�hW�����gnk2��;e~�l��P@r"�!�������� �z03�X��}z'J��n}D ��V_ ;* ̈́b�"������Q�� ��=� y �a��>�O���̎a$�ጹi+y.�0!��8����о�b���&�g<���N����� '���L:�q`s/ ��I���D���^!��$���N +�L�9�� ��� e�-ٳ�X�M_��z��8|W��B^�Ε͔?��+�B>�@�e8���O�UK/�'V"й&ѯY���U;C(Z�D�VVX�j�����/��8(& ���eI��LS�X?��,�ö)����r������?����Q7�m&Th�%*�1]�gETp����d[���S��j��� 㝁�&�{�� �G��p|�F/'j�d��d7�ݧ���\BW���C�f�`Bs�p1�Ey��F�"�(��#�kR�}�>�+ ɣl�0��C�] �e�ܶ^{Z/�m��_��t����}=|ʬ.Z=9/�D�S{L�8��QM�sⶬ©������qr�LI���"r����(�˯B�����J�&$8:f� ���B�{��r#B������vs�Z@�v����MQѕ���YnF�p3�����T�<|c�;_l��x�l� �6[��ݺZm�mxp��ԋx�(�ͅX�uC"`�w\�7�/}��m�0:y�Mq�!�.݀�p���:�>��S��@ϵ:\�����C-O-oU�ʅ�*�mK���;s��g��6,��b��e�`��|��tS3��6]ӂߔ�H�)������Rg|Xl�);��`�u�Y����,x�"b�@h��h���X��� ��ѠɎ�)��&���v�I�����_ �>i8�,YNy]��"�W�#�B�@^쯰(rQU��*�~E�k�jb���+��Nd�bv�{�����u]J�{ �z:&spU���eo�mj�E!�t{�OuZ<��]�
Static task
static1
Behavioral task
behavioral1
Sample
fe6ce063852e289e3b01ec4067839fa62031c5fcaa4cffd33cee37462799457e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fe6ce063852e289e3b01ec4067839fa62031c5fcaa4cffd33cee37462799457e.exe
Resource
win10v2004-20240426-en
General
-
Target
fe6ce063852e289e3b01ec4067839fa62031c5fcaa4cffd33cee37462799457e
-
Size
4.7MB
-
MD5
5bb5d126b5d75ca1398a08a29fb2f3b5
-
SHA1
f14e9ea5c867571620ef09fbb14014ac4f6086f9
-
SHA256
fe6ce063852e289e3b01ec4067839fa62031c5fcaa4cffd33cee37462799457e
-
SHA512
54d576772865227aeaf749fb9538e08fa946f04384f7d798bd1dcc2c97394f1c7b21c03bd685598a38decc94262e3311ebba58ac0113deec9c75186406a300ef
-
SSDEEP
98304:mYKI3edsxK8tbPOpbxDL/LLBCaG/zPTaZVka5+CdY8GeH4uxgcf3h:mYPks5GpbZ/LLBCa2AV/5hdY8GeYuxgc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fe6ce063852e289e3b01ec4067839fa62031c5fcaa4cffd33cee37462799457e
Files
-
fe6ce063852e289e3b01ec4067839fa62031c5fcaa4cffd33cee37462799457e.exe windows:5 windows x86 arch:x86
acc9041e0e92b4eb64a660806ccfa42c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ord17
kernel32
LeaveCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wvsprintfA
comdlg32
GetOpenFileNameA
advapi32
AllocateAndInitializeSid
ole32
CoInitialize
Exports
Exports
Sections
.text Size: - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 4.7MB - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ