+�h�pX�+�:������r�xz�:�p�<7�����S������|I H���Ă����n�KHc�*���]�gW��֥��*�DZ:?dŞ|�VU�����h៊I�1B�&�'kR �62��� �c[>u���m�O�x�[���~�`��[�gδPk��P~Ý(D��.���$�S3B��1��*�)'i��3���i=��2��������Oa_ ���r�?�Np�n�E�I��g��T��o8�X��~���X;��]Hj1��@���,U:Ȑ7�V�����ۓw� ��woTl=j�ӴzS<�﮽��F_�����I� �R2�m�ݨ�����R��Y�5����;�MfTdz�6�2֪��7��� ��Z���Ċ��Sw-�_o^�g����}7?��i�H�����c�5�&K���+���E���#�yPe��&�T_b��}��%���.p�|4@�U����ѵ%n��b4y��YMu|�7��a����lm���# ���.�TQ�η��1:�~ �������s��;�t�Y�O�K&Fu������mA��:镩��XU����C ��������C����@����K��4��KꌯH\�l�����+��"��\��khZ��_6�I|�i���-!�H�ڪ���\��Y?!s���EM�X��P�|6|��y����g���볡���C�[��A�F}!�9xu�0��p ��J!:!i��T����W��~�y�NTS��A�Ϛ�Vk+^dIk3��% U�o�f�+���� �pod0��ʣ�{N�5��h����Azd_��� ?���OЙ�I��EֵA3.S�K�9�0�[i�&)�՚>��1�J+߽|���U�ȼ;^=�� ��h[j�p�h����f� ���3߶�p��L���`��j��,�L��C��`�ej}O�i7��s^�F�_Ⱥ�c�?�*x9*^�Ā�T7�i�r��7�+�w��CRN�V�k}d� ^�y�sE�Tk��jni��.S^�O�R'��Ũ[���N�����9��X�𢆱�K_F�չZl m3x����l �BH��&?�dNoc���d9$�hr�X2�I>|���2%t�Q��-���7��c�Cy6�s�"'���}G3ph��5�G� ;(}�se���y �]'�= �A.�w�ky|�Թ������S��J����Hłಾ��b����C����2��������D��gp&&���5F���x���uQ#�D�Aj:^�Zr��9�ʷ��u��@E����L�7:'�]���?D�i**)ߣ�3�MI��?���[S�?�y4��ҭ��Pȶ8>���e���FJאZ����}bR� ԖG������D<J���E�ie�n����[�['�37ܖ�58��/VK������h"K?�����YЌ������G�'A��;;l�B���qr�3��^�D���7";ʒ���$pQ�� x�Ml� ��΅�@X���L���L4�)�� �ɩzS���]�ޫ�^�"�yi(�\8tC4E�'�u���#6��%��J���RO- ���g�uڌf���k�ɻ���=��Oq^k7V$E�E��� ڞ)74���fN��Z��������B�ԪiȒ�i@|�iP�:Ö��o��ΜC��qGy����1 "E�a!/ #X ���Ԝ�O�ډq=t�����P7�|�}s� �s���$ÒcO��~x[�@!J,�Zcm���C�wצ���_��E�Z�@���Qңi�����+�G�5p�+?��y�:�(팮���k�<E�����,0�_ 7aR��!�e�?V�� Оy�m{���nП:`���ĵN�Z���G^����*VPDu@k /0C���3M���HTS����*^�*a���?�6a&:��-{��+ |P�Y� �& �8�h\y�}!����!�KF�<��-�ӧ�=������<Y��ycj"��5 �q�nQ�o�qb��)[vq����X�7�T��V�"�0V�Q[�'ߤ�Kg�mr��WE�"��0"1`W� ��JT��C������V�iY���6)���ɧ,|��v�2��u�!ʰ����0 ��cM����E����.�-��ȭ1I�������f��I�0[�E����o�XG��\�o �7W�,�Ui&T �x��U�2v��{S:Չ:��&?�Ŋ���Eʟ��0K�K��~^�)����*��[�����Z֒�)L� �R�J(s�p���\B_U{�'�T�u6^ 7|��#E��-6yF��]i�VF_�k��9�P�[g���M�̀�2��=Y����Ip�ws���օ�ٸE�|^�2�\Y�h�[ì�PR@���o���0z������%!uM�(f��P�8��` ݨ�()9i�4&}Q����z8��۞��'�ug\!��j7J+XE�&���9�P�jA����G�D�{i}��[y�j�9�S��93� |$\N����[�R0��$>I֛F���[� ��0��z��K|�fq$��;�(���j�:�KL�Bנn="�r'^�`i�ͦ6�gӆ� �K����WI�t�Y��~X# �2���>���[`��m��=bE�#�.u�9��m:�[*ꀪb��z�ooș��r?��Ͳ��_qh���]��Fgj�B���-Z� N������: {Hq��u`��]\ $�4AN�3A���ns,�uZW9�7M��~��~;#c�?Z��D�x�?��)e}�����{���lcx���p��گ��i�9���ZC�|뷚Xz��TgQ���xr�N�#�&�rM�*���GRd�v3K*]:�N>��st�e� Js3~�p�d�['<Y��[�B�$(o���)�ρZJ @��]9$F��� ����"�qcȻB�.�ct}$�|9��1-�3�������F6D>C�����Z8�5w���K�p�㠖�FW�ʁ-�RƂ �%���'���r�*�}+�y�>i��� �T<���� Mq������?�2���d��{B��_�{�M�5���O����_�/X�<�x��#2��Pf�U���
Static task
static1
Behavioral task
behavioral1
Sample
bfdbe329251311bd2c1ac38f76e9a06baeb8258e9a64d5f875edf10cecdbcf01.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
bfdbe329251311bd2c1ac38f76e9a06baeb8258e9a64d5f875edf10cecdbcf01.exe
Resource
win10v2004-20240508-en
General
-
Target
bfdbe329251311bd2c1ac38f76e9a06baeb8258e9a64d5f875edf10cecdbcf01
-
Size
12.8MB
-
MD5
6d21c973d180dc37bcec3fa88070f77b
-
SHA1
00705b0014a7445adb848bf7db27626a9d4267e2
-
SHA256
bfdbe329251311bd2c1ac38f76e9a06baeb8258e9a64d5f875edf10cecdbcf01
-
SHA512
d61c81177277d050bcf4d6215549fe9a041ad0e50927f0499897da82373eab21f029f1e073f386be668f10049427b8fbfeed5f0365f7e5f904115ca97aacc08e
-
SSDEEP
393216:sO5MVqX2RvWRDmhPvi7d3rThNDACzJaC1hxQz:X50qX2gRDmhvUdrTrzYCLxY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bfdbe329251311bd2c1ac38f76e9a06baeb8258e9a64d5f875edf10cecdbcf01
Files
-
bfdbe329251311bd2c1ac38f76e9a06baeb8258e9a64d5f875edf10cecdbcf01.exe windows:5 windows x86 arch:x86
5e1b7a0fcbae53369ef3230528545517
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetDesktopWindow
CharUpperBuffW
gdi32
RectVisible
winmm
waveOutUnprepareHeader
msimg32
GradientFill
winspool.drv
OpenPrinterA
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
shell32
SHGetSpecialFolderPathA
ole32
OleRun
oleaut32
OleCreatePictureIndirect
comctl32
ImageList_GetImageInfo
ws2_32
socket
wininet
InternetCanonicalizeUrlA
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 508KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp0 Size: - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.svmp1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp2 Size: 12.7MB - Virtual size: 12.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 164KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ