p�������+����B(vrأ�6�RIb$a�L�3����`�r�H��;�A��!Z��l�m�q��3:����J�t�D�#�#�& I #�l�;#4��ؓ����7�a���0G]���{ o,��1:c-x���<�Òƺ �t�I}n�]<{�s�qJ&|a6�!,Q2��sZ��c�;-$I�L�Nx=��oG٘h?^�B��T�Qi��2dzlQ��o7F9GK���O�[��5@@��]^�?�%,m�{{U{�5l�m�!qu�V��������D1(��"3��(�������Fwg�j��ͮGX;#���*|*d![r���o�nW�_���댣�_�哔��¶�$�&����[V��/�{������O�:v2�י[�\u�/� )Z�ݣa"�|di��� 协�7SW9~���{X'Cd��p��LY�(�"aW u�>�T �ɖ� �f���ֳ� �Q~i�\� ���~�����x��ա�]�ߜ�ŝ}����x6��k�����tO�}-�͜�3�n�W�J�'�d�7 !�I�c�mK5�ݠG���[��b���^e��'��'8�P!��?� _��V��\��5r@��u��*1� �W8e �T ����Kc8��������k�T-�Rw��<�����Hi��:��:,�p��6"�Xfk!�'c� :�/���[xx��D����6��G�k^Z�k�H��k�t:R��E�/�-� ,�FI�T��?�n�K{�sE�8�fɞf".'��{W������K������>���'�{����,�e��o��}��=ꡒ���8��k����1v�_�aOR��x�V��QL�tʹ�6 �҄]v5�r<`7U�����W�!�;� 4���r#Z^r�?:&a/�?����wc�_:�h�\�b^���<�G��UK��&T��,�g��EJ}Ĕ?RZ�pt��]��x��,�@cA9�N�6���| ��[���>fiCÛH-���)U�l7g�h|YI��`�5Wj���B���"9������<9�Q3f�]ߎQ����S�w���`'h���F����"�>M���8�bp鲀�k_����3v�$�G�|,%�%Z&��[�tu���v;>�iP�� �jQE����ݛg�|� �L�m�hBي&P[!��3AK�L� SV�Z���N��T����~؞F���=%n{�h*�B3�K�?�m�cG��I�À�G���}�'Վ�<ca�< �l��M�\b�@��z�g@WJ?VȿǞc=� 1���V˜���^���c�X� 2qӖ�V��T9|nf�G����mPj�NVɃ�4��˱?^,i�D7Mp�d������A6>xz�S_L�x�h�E:�˖i�V�D�8�s��c� ĤT���?����)\��9^��w�ЪF2H�.�N?���vSB�trk�!�R�7jL�|��4���p0���)��7����+`s����M4��Jۑ�K=�n�~���j�\�C�����HAfe��F��|J��zR��S�6H���kk��ͣ��wo>��P����c�<��˙��3"I�=t���f=���R,BD*ҽ>X�c�?��R�u^=+�f���P�|QV�:Zy�@X�y�|�l��x��@>V�z3�19���P&X�w�l���p��Q���������\]k�H�l��.�F9!gJ$:y�e�U�!N����Ix�>V+��+��\�n7��5�1{B�eM2 r�0]S�Z��U��p��a������g�k���Gk�������_�(_n�kMU��E�#��R<�\[�ؙ�G ���և#�t�E�MQ��j�u�6Ef�^̋��fob��g(���$s+�;jAʝ:/�ێZ/��T8*��VcK6�<��t��R��ΰ�ֵ��HzFhw`���q�*���I����������! 0����2�����=0��{�{m�?��#���Xq6fuY���f�����j�r�}A ��\��$�E+þ�t��2|{�ua���tG��[�H����;l���1ÜrD.+�{�6Ȥ�����% 牣�}'��u��Go��\��\���K��ΨKR�Μ�Ö�m �HxW����?l�4͕��q��Ɔ͵ PG���Wh��MD�C������n�#C[D]�bmh�e��U�Qld�!�O�u[|����[[ɱ$����Mߍ���ߪ����uXG[;V���>�Vw���O K3�bŔdm$s�rpY� /�v�=4I6�)H�M�(0��.8��7���Gb���&e��l^�} A���������m��mi�C]H�$�y�b��C�HVy�Ȏ;��}aqeژ�'�i���$!���{-q�Ԏ�K��o�Gm���� ��)��-]�>7�#:%;(|s`.�@q��im�Ë�y����RBd䢅Bw���T^��i��zxA���5��� ����ŧ�_m�Re�,B��b�ϲ֚B0Jٳ��G��=ΥyWA�K�Dd��]>����v�[&��ˉS�pD��161̣y�<l�A�@1��U�g��S"�m0�Ÿ�N��-n��S��7ȡ��AX�:E��w�31He����1���� ZA�����/�2���Eܽ�͢���jP����V}(@p��60����`�XC�V�96Ȟ��o�z��BaFMЖ� �c�w�h���m�����ӆ�E�ȕQ���������a`K��f�+�P.�/S&�����)X��$��~���f� �.��SoE_&Y��MM�+!`O9+E���\dk��[�&�:ip�� �*��x������r���^�� b��ֶ���ZW��ێ��Ґ}�ɳ9�uN2�2Zec�����?q4����Ԋ��'ĭ�q��9�9��k=W�=�P�Xm�d�]F��ezƟ]mI��,sxn�#n�����[O��Pu��K�����Dq�4��ԧ��Nˋ��9�(pl(�&q�Nu�)�S�H�6���w�M��L����������dz\��NB�XVR��j����5g��k�:W�,� ��N�2��X�(��ē�\������N������u�Q1Y�J j�R
Static task
static1
Behavioral task
behavioral1
Sample
87a6064d6e707299b32669cdd3fa97b226ab8b41b4f39ed397bd8f7b275e468a.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
87a6064d6e707299b32669cdd3fa97b226ab8b41b4f39ed397bd8f7b275e468a.exe
Resource
win10v2004-20240508-en
General
-
Target
87a6064d6e707299b32669cdd3fa97b226ab8b41b4f39ed397bd8f7b275e468a
-
Size
7.8MB
-
MD5
a3704cb2ddb2c0fbd6b220f982987dcf
-
SHA1
db9009602be5a439ea4ffbf89895abb8bbd0de80
-
SHA256
87a6064d6e707299b32669cdd3fa97b226ab8b41b4f39ed397bd8f7b275e468a
-
SHA512
99e07b4bcabf462186d009178ec8d2be8cdb8adc67892a68646a3235647827b7f6b76624279568965abe53b230e38f3d33ce3784fc3bf40018c823a265cb7a4d
-
SSDEEP
196608:znKOBhMwiVD05M91pFqHJoaU/GwIpjsGpnMi1CBqQmcdcht:NeVD05M3qHBfpNnMq6qQmcCht
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 87a6064d6e707299b32669cdd3fa97b226ab8b41b4f39ed397bd8f7b275e468a
Files
-
87a6064d6e707299b32669cdd3fa97b226ab8b41b4f39ed397bd8f7b275e468a.exe windows:6 windows x86 arch:x86
13e1491737e7b68a013445ad8e14a4b5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
rasapi32
RasGetConnectStatusA
kernel32
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetMenuCheckMarkDimensions
CharUpperBuffW
gdi32
MoveToEx
winmm
midiOutReset
winspool.drv
DocumentPropertiesA
comdlg32
GetSaveFileNameW
advapi32
RegCreateKeyExA
shell32
SHGetSpecialFolderPathA
ole32
OleIsCurrentClipboard
oleaut32
SysAllocStringByteLen
comctl32
ImageList_Duplicate
oledlg
ord8
ws2_32
WSAAsyncSelect
wininet
InternetCanonicalizeUrlA
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 514KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.se0 Size: - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.se1 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.se2 Size: 7.8MB - Virtual size: 7.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ