��`�ȣÿ���)HC�oCh�/u?' ���1 �oY������th�A��F��ò>����n��&�ܺS�H����1�R�����(��C9M?p�0a�j��~^��&��K�����R��E#�� ��[p��,˚�h����ۊW/��O"�����E ��3kd�=VG�~kB�ST(#�wg��^ә�P�jӎ��L�1VP2(vӌR`�hf�-XyO��0!�0Mp�����Xs��5��C(���1������P*����P���f���4���ҡ�bڛޭDV� �MfxW��wwW��N���I�HsU;~��t��g�M��G��-����l��E��,g����Y?�ka�_��;-� 5��m�o{���������5�o� � 2T�?)vS/���i����V�)n����.7��5��[�Y?3uP�����DF��v:7��7����]1v=l��Z��s=Ɋ��:'Ӕє�@\P}(�8F���Ay��F���ʨL��1��m�|i�_�3���Ԝ����Gtc�4������0{��uBy��f��Ĭf�H��8�G�HT�tx�� c5�c'�V������� 1'���)��פ���gu��g�x��戛�fx7^4�!ރgʕ/ī������H�ҬEiTm7w������5��P��h�N���V�1�����H;PfM`��%��U�#�Ԭ�Ӏ�b�,�6㿙#ܢ��as-�Q��I�[{�18v����q^Tc8k�ƛ���ˬ����#�=:ޒ�Oi�m����KmF��@�h <�w%v�/� ����.���!��7�V��94y{B�\�L�}�ke��������y+��ϟe����Y���b� ״o�:zV\��ᶬW>e����J�솰Y�-F����5C�*��q�?C@i��-9���HO�_�����e�R����� ��t*�/\s0"�Y�����H��x@�B0���3���k�� "�`4ly2�z�� ��ҎG���JU�cN.e����^x�Ӑk�Xm���:Y:�\ �{�����,��5C\���_^C`#�� y56\h���X(�� �1 p��d6@&!���xb�~�A� ^)FK�esw&b�g���S�60O�����hҸ@�Y��%t)ƕ�e4>�5�d424#����g�ΛLMT�� �i���;E�9�j�]]_�Z��R�Ϝ���m�r�8[ Tx)v��d����2צ��v�����ޚ��ڝ��*���ۿW: �4�;GY���*��/˲�9�rP�W�Qm�� �+xw�Y�������Th��5V8�F��(�\4gk"fUpvy�S�Z�8��� ���>;cHηv��)�r��)��:L�y3�V�ڍڕ��Vo2���oۍ�xU'G�i���qs���?��-�j��<428�}�j��k��I�����F*�'�I�>�a`�\)�L^�q�o�Y���b���B�(��uPWVH癸E ΰ��J�˧kl��t<_��+|���f�n��+� ��?%� ��/v��jK�@�O�vU(�m��d���;4u�%V��٠|z��Y��Hu���[�+��YLi�����-�DGK�r��&��zx%�_l�N^D�lж[ВǾ=�%xT7!�i�);#0���C~z1���,Ѕs��eR65h��$bSw�ˈ����Tta1>%��BЊ�^F��z:����eo�F�B�K:�Ё�w��X~[� �1�قw�Sȸ�y^~G-�4���t��L��K�|j�@�T�kB��2�b�����n�{����C�O��J��ƿ����}F.���� ��j������������щg�* ̍L�73�!��� X�Q7���T8h����J�r�]䜋/���t��O}G���t�m��7���؆YY���G{,�uX�$� � �Ay�eVĶ �������˜|Si#L����-��A���J�T�,U���O�2���:S@F7]��K�]]����Q�71�c��3Օ�T�g��>��$�A�ї��)�'������2�9��3095�_��C��"�I$����~<�}�@s�I�VN�*����*�EC(���#1C~h�á�,�8����4���!� �Q��ЍE�՟�=e ��!H��^(�%�c�#t��R�j����(ED8����mFf�)����� �;p�r����w\;��N �TOJ����1�0� ��W���վF�o�*'�ʳ�FE����\7I*���Ն��H3<�(;���l�Q<-���\�ǡ^ԑA�7`����괄����k~RâDjA�h�KW4�����X��G"5�GAMU�R]��|@~��c,��cGP@�G"&,��c�ɼ�߹��&���@#��9��\��{3�cҴ�r���!I0�[&�^R�� �1�*��J�!�� ��p6��L�p/���8A��Ѧ��q̨ķN,����A�:Te�U����IWx�$�#�� 8����stw�XFp� %`ԫQTc�Q^�i�C�������,�h;ŕ�P���?1� �^�}�o���L۠i++��_5k�di8偍l%�I]�^g,JN�d��J;��%Eg��ӈ����:�: �٤��b����9e9zq��W����-�OD�1�×o����d�D��f���L�����&���,5H�6��N��_"7��crs\M.������NR����[�X|9�mQ�KڬUi�[�tf�[���$|e�z�ƚX�b�0g�W}����i8|w4���nI���}�H����]t.PPֳ���l}��lYܾ%�:6�K�X��)B +�v���U� T��������x��Y� ��9�L7��]��8m1{��T��T���ڕ��E� �~f�`W/�r� Ç3����������ݷ]��k�����\�ꦺ��RG$�����9�ܢ,eL�-&��ѕLcD%RӁ%*�EQ����s�YVm� ��L�#�-,m?M�нLN�!p�����q_�M[�T�C�J��,[uS{���9�ǩ�
Static task
static1
Behavioral task
behavioral1
Sample
d50c5b60a54065544333d332380e45249ed886349984c46a4023b979a912848b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d50c5b60a54065544333d332380e45249ed886349984c46a4023b979a912848b.exe
Resource
win10v2004-20240508-en
General
-
Target
d50c5b60a54065544333d332380e45249ed886349984c46a4023b979a912848b
-
Size
9.0MB
-
MD5
36e5b8bac55b91d6da4e922f3331615c
-
SHA1
015c3b7530596dc71648c90690115e27a750a376
-
SHA256
d50c5b60a54065544333d332380e45249ed886349984c46a4023b979a912848b
-
SHA512
0869c97fb5389cdfd397a4b662089b2c592e64f83d80f0be4322d27d158aea94697f14b89949018c3f6b869479dca34986d4a0e5facd42cd972cd54d7e0bca78
-
SSDEEP
196608:DsZAv5dYh+2I6fKpOylsaQXDhbFv1ZlDh6nh4u2W2BLerLtjqHoxefVhFj63:1jYh+ONyyDhbFzlN6nWurrLt2HoxeNPG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d50c5b60a54065544333d332380e45249ed886349984c46a4023b979a912848b
Files
-
d50c5b60a54065544333d332380e45249ed886349984c46a4023b979a912848b.exe windows:5 windows x86 arch:x86
c0f28c4dbf9c642a1d853d81b617fc69
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidToStringA
winmm
midiStreamOut
ws2_32
inet_ntoa
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetPropA
CharUpperBuffW
gdi32
LineTo
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
shell32
DragQueryFileA
ole32
ReleaseStgMedium
oleaut32
SafeArrayAccessData
comctl32
ImageList_GetImageCount
wldap32
ord29
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 918KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 406KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.1pX Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.fn& Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Fu] Size: 9.0MB - Virtual size: 9.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ