7Ӫ%�TF)V��.�������A#��TNJ�=ؽ�<��V�ݛQ�/�v�)�vK��#�S <g/��=��� ϞP�wRs�=@�P3F�O۔��M�hH���&Ǎ��*b��|F�"�X���ڒ�����T;O�T��i2�F#��ۼT��l,�Ų�)��x���j,�V7�~̷�P��R�S����(�zNL!�B�I`}:���<D���R����/�*�+�f�q�)3��!_��Ny%���SM&+��L�K%$���v��Ú�X,���=ԝd��c�$`mA�� �;ꄰ���E���[IT5Q�܂�>��H'� '� ,IHz��G��)��u̬\0������]:�#����Π��c%^a��|2��yk\���23����� ��6�i�6x�����K�-��Mދ;Gi��>F���L.�;� h!ާ��k��X�H�l*��jf��"�ܡ)@�(n�y�b[~�0-CNM_mxA{!�D/ (�Rӛ�6��%A��gӁ�_g`M������CY�Y��b .4DrMʺ*F,�֊��r�O�}��*2r[(���@����Cn�H%�\9��H��4�Ԃ�o9���ޯ�|��xC���.�^H��Q#�p�w �ev��2e���lh��4h������F;h��\`��:�X��7��V��k���I����e+M�Y�;��~;�<VZ���I��g���Zt��$#��w�n&�dљ�8��#ڈ���wo���F4��1Z塹�j�M]oj�8�'�t�;��v��"$��z��& r��*���:�hG�s ��s�aYPŞ�I�/E����=~5�c�Z�{�g&�������S���#"���c/�3D��|��C!S:AP0�ߛ ��Sǎg���SR�& �y��띏!��k�u.A����sҙ����AsK �?�n����ނw�B�?Nf�6W�kQ��T�f�7X<a�{�iA7~{�g$GF�ԁ��B{o��<�L�Hػ4Fu���wM�é.��:Nڌ��f�4�]�?�S����uE���4k}�M k�X�'����'���cs�^*�/1Y`uY����k/.0$��^��0����9bA�Gkcl�2�з��B���۰[j!Zb�1��d��yN+� ���8��� �J�2D勄�7����/X5%{�����"ƣm��ӧb Eݠ�F}��Q��`v,����;�fw�$u����21�.rS�����Zq�ƽ�Q�� l�@�x� A��+����*Tz�ܐ����v���'@Eq[�^�-O3 +� M��G�n��&���J:�D�rP@k�Jآ���B����)�+A�˷�� �la[�]�"�����[\s�����L���:rx����x�<D���W���w��.���K�ʶK�J�6�j8�7����$ғCfc�78�0��^� ��Vg������^@����2������wA<;�� ������zy*�tEZ�y�!_��J%'x�" 㲶7�� P�H.TD��ך��Y��'��t����Y�ȬO@Z2��M�-<�Ws�]�"��ɶi��k�kj��/�C�KhM��X��4���eY�J9���KJ7�\�������dY�͏UW�5����_/OhM�&�̑c~� 4���%Z����ݠ�����s:g���-� �0���_��U� ��6�4Pr1RU1y�1֡�#��z9V�w˩HhҢ��~!���7�٧60�n�Z�^2|A�K�8�kNJ�̢R����"�jo!d�MQ0ҁ*d�{X��o�?�A�� k�B�l&Q��%��I�ռ4>�[���3��1��?c�������_����6w=M��w������[�)X>\�3k�Y|�6����d]���K����zM�B?�)��y0�Ƽ%}&��`�Ać�]��U����H���H�eaI�D������ �v"ڏ�X�&�b�p�����f=�ӭ�綘��O��F�Q�R�/^��(�gԒw$��F�7��p���^3�i���H�q��,�vL���U6��5 ��]� �rN�H�$@�(\��'����K�����X���z�.��bha��H��� �Q��� B/�N�5<S0?��C�Ǐa����������R���=Ib��s�/��Do�s�9HL=~5�c$px*intA�JL��?/�1�r5�� ��?�ֳN|]��A=eݵ@m��&��?�U��OK�7$�{��HV�l��'�7sPX�=���dl�B��o����(`�{�o;�RA}�4� �*{|ֺ�fl�LӍf����L_�F'��W�Ԍs?H���Ѧ����;{L�إ7[�Y��� ��!���j�+����0����w�e>������l�<ų������֘$�'k����;f�v�{�*TU��Shd@0�����������9M"���uQ�:6 ͆����e���~�7`v��y����k]�0�|��R} ���5B�A�N�l}�)d�s�����}��o�7�^�?� ��U��#�j\��u�>����k'�^�G�&��ȳg��5�T8Cg�!1�[E�KA_��Ds �Y���WT�� M��aR�3��8�?o߱h\��,���Y<_��� ���!���79��7�jW9\$@Y�� b�N$;��h0g�� ���6M�q'Z>V�l$P�p��~�EP��-nw-�Qc!��FMxI�R(�8�$��ݜq���2���{�:P[$���0w�V��(S��*�@ڹ��g��'�nq5�%'�|d=ԉ���7viO�2��I� +���<�6V ��Um�!�#|�uIA�h��%����" �2"6��IؕG�u�����[��>^jn�f��Ebk�b���q��lq����M.!��������U��|�dzL��@����0��d�ӏu2�3��`��p�B8�����YuH. �h�c�������ף���O_#�h��?���H1K8%ė���v�XͿ�bY&� ��P�+�k�}����@B��@q�t����~�����M�HQ��8wqyF�W�Y����T2��R�����QВCɥ��D=`@ T�
Static task
static1
Behavioral task
behavioral1
Sample
223e133219fa08456368783e3fbe179445263059ae8954d4db9498fd2b84efa8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
223e133219fa08456368783e3fbe179445263059ae8954d4db9498fd2b84efa8.exe
Resource
win10v2004-20240426-en
General
-
Target
223e133219fa08456368783e3fbe179445263059ae8954d4db9498fd2b84efa8
-
Size
5.4MB
-
MD5
8edfa5e7a31ae9542c4c9d08092cc2b4
-
SHA1
59be20d5d714dfa90201cd64af41ba62c75b120a
-
SHA256
223e133219fa08456368783e3fbe179445263059ae8954d4db9498fd2b84efa8
-
SHA512
f802c95fa8ebb37ebd72c495a424ef935c8179534779c8362d0bfd5f1d81d6f3d50b4302691a64461d6e551989a175ae40d156096d695a96381a68a53e454bac
-
SSDEEP
98304:y682cVrpoLQPV9YAl1ADUOblih+HvKa1IaQtjpQvwd9almloy6v4KV9k:yUWpoLQdeArSBm+PKaea0jWId9Yqoy1O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 223e133219fa08456368783e3fbe179445263059ae8954d4db9498fd2b84efa8
Files
-
223e133219fa08456368783e3fbe179445263059ae8954d4db9498fd2b84efa8.exe windows:5 windows x86 arch:x86
d72822263764d910ddd134c5b5066841
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ord17
kernel32
DeleteCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetFocus
comdlg32
GetOpenFileNameA
advapi32
RegQueryInfoKeyA
ole32
CoInitialize
Exports
Exports
Sections
.text Size: - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 180KB - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ