�8�9 ���W�Q���IEK���o��m�R7��1��#52m~�č��Z����S�B��.���kU�H���m��kb��z�9t����~�|�Q�?��ߖ,3�����7!�2�^1S���`��~��a b��>\E��|'�����Ā9E=�颠���֤� �F�����Qh.��Җ#%�S��G�7�v�Z�l�B�N7E Y���D�YB�iU�l~��A�J�Cq%����<���|�lǑ%��а�x� �@��ƪ����_QVH��N�[��:\�v�'��j�����=�zy�"*ݸz�&Ce��iS�ƀn��R��F;!~b��]���$q>�jpT�E��J�7��y���ҹ�����6��Ƿ<jD|���W�~���vA3��0ކ�!�I�C&�(��)��oDm�s!��꺟a�ݤE�������`.��P�h���l� džlK�˷�@��{oj"鼮=�"�/���ވ:$ XO�6|�O���]��ߌ�r]��|d����H�ƹ�����Qn� ��cCz{jT�� �>�v1��u��/A�4$ �~��B8�ͤ*G^��5���e��ȅ�d�}��)����`�1�+nd�3�N)_%#��E�s·���(;i�Bi}��xd%�*^J�z�E��yٶ��t���j����z�y�5�r�c�j'G�'iGMӽ2p�������bh$�\2z�o��G�§W�1ρnQV�� o��'��}Z�Xfsn�"Nks2GG��-m�-�e�,�I��D�E� 1-�<V����M�XZZ?�Q�,6{�y�LYp&������To3������}9���Ŋt�x6ގ�L)�X(kٝD�їu������XR}�=���4-0 ���.���3u#O$�� ņ��g�$�u���A��.����m/%~0U�ݾ�@:��=���݃�X{��=��ji]���k��R���އ��3�&�! ��椆Vj;������ ( T���e��i�syval���4�tW]y0��~�_}�⚸�x�;��=?1�qs�,'�C:ː�ԫ�0�gB�p���Hˍ(/�����v~�p���΅Z,Q�.���2�����u54sa0`w����(4'!;vA]4]ڿdz�e����3cN����<�:s�E�� ձ��_$[3TL����Y�u�4�d�?S�r��b�����[��Ji��b� ��Á��7W��N�5{z����^�pD��7g����?K��M�@��˜�ݻ݊�����ދNg���>x�"sw�FL��z�!��1�t���j�_�Rռ���dY��nvPA.���!�k)TW�$� ��Y+I T�V���[�@V+V��Fȓ�t�*;����s���<��ضG!�e�(%�&x6�i~##цm�{�j8tlyT��~l:� jhu�^�3f�yn��� ���y��ґ�R�\�Yq'Mi���Vqp<f�V��Rږg$���F+�|���_�M�Y��7�-�f՚P����4�v(�)A����� �D�� �wOp�i'�s�Ý�E�p��tHO�L]��z_J�-���ް���@��b�uP^)ـM����:m�[vm���X~���ܜ�ª��$_�O�gOX�¿6�u��C�q���~�<���R����(1X����G��5OP�b��[���x�$P�8�8����^r��7�4�A�9�%�g�.��`z��<rb<�[��و�#'�y\h���}FkW'T'T��^�>@a�ک7�&����a�����ӷ�� ��^�0乘x�YhtD�|V+sH�K�B��d^�ma�JqUk54���RB0�0�V�"��_�`��w��i�P;etj����[IĦ��#�����B�<EYJpN��AB���kIb�e��[5�0N���f�r��_��F�*�vAQʪ��=q�K�~�%h?�\s^�^�]�h1��o�Ge�.nɩ��Lq �mI�LJ�`��8�������Xך���~�Nц����-sN?��o��Y����pQd�4��>A�g���`!u|�h��;�x��y��b�R+S�O�#:���b�s6�#ֺ�P�ag��݄9�Ɍ,_�(��������Q�e�_ಯB��t{�'M�if��:Ӈw���ڇ4W~�ZJ�Q�^�)l����_���ƲzS�E��/O�0��凄B %���=��{�M~VI?�F��Ѩb�4���hS��r�&�W������I�I��yu�.6�մ��v��ߡ�}I��=�W��>��H����������h����|W�44���Uh,o7�87J����=DžE�Y�٨R���V$z�ʛs�$���ׁ?۪%�Ṅ��T@jSܼ�5^-����e������uLK~QSj�(k>/'�k������[۽�����R��`қ���(���Ve�!9Z�ƿ�I�E�U���ӭ���| :w���Q�����05o���;%S�Ai���%c=�+�J�W�4T�h~᪗��(T��Zh9�Q�+zt���rާB��9�+�s��5�樂��,�硈+n��JVQ���P5��=O臝$(�֝~D�q :��e��������f��q��v���K;��|�/#�$F@w_aI,���\�x�E���#��f�_��!M8��N+����]�u��˞�����@N8����=�G��D�}V��L��b1����W���4����7�1�='�@�ovi���S����@>�k&�0=�;%kǴuB���5s�q��kS����5��j,��K������0v�ؾ ����"/�_S}�kNc'nI(y�d�p�,��4A8���Bн�IP�?!�q�ʅ�%�F��lr��hww8��$�ɾb^�ْ�~:rB�L�wA�Щ��ܕKI�);T�}�o�k�/��}`oq@{����J5�����u���_�S�;W^*�0{}7��R��k�;���B������ꅗ/g���+ ����U��x�N"w���N� �PA� �`=>���8p��M]6 m��U3B_e�L�G$&��l����n��7U��jYC���צ%C6���L�ng�ƞ� !�.�
Static task
static1
Behavioral task
behavioral1
Sample
4575e90b30b56cf1e6fc2b36930a57453166d036288c149b262b68f8aac00915.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4575e90b30b56cf1e6fc2b36930a57453166d036288c149b262b68f8aac00915.exe
Resource
win10v2004-20240508-en
General
-
Target
4575e90b30b56cf1e6fc2b36930a57453166d036288c149b262b68f8aac00915
-
Size
14.8MB
-
MD5
70761f2d4ef7588e88a785bd1830ed77
-
SHA1
6f4e6146026648546467780ddd4926ca7871f14c
-
SHA256
4575e90b30b56cf1e6fc2b36930a57453166d036288c149b262b68f8aac00915
-
SHA512
7801a4b69eacbade88a2d3f52be9df50ba66a789057bd0fe55aed251e127a9d5d39ddb616f46a909fe2d71c414fb40e81258a9d14a7a55d47c96cdb2a811dfac
-
SSDEEP
393216:KKFX/GOKkQqSrJxHt8cfVccw4Vw31+8pvAS49fU:hZ/PK4SdxtVVTx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4575e90b30b56cf1e6fc2b36930a57453166d036288c149b262b68f8aac00915
Files
-
4575e90b30b56cf1e6fc2b36930a57453166d036288c149b262b68f8aac00915.exe windows:5 windows x86 arch:x86
1dec0733655832bdfae4262465d62110
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyAcceleratorTable
CharUpperBuffW
gdi32
TextOutA
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ord17
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 627KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 231KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.'cI Size: - Virtual size: 11.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.d0Q Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Te< Size: 14.8MB - Virtual size: 14.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ