l>=bŴSJ�����o�2^��R G߹��]W�*��r�E4�Yh6��*�S���Z����̿���2��0̵/��U���}��~�d�W���>�L�áSk�8n2n9�=އU��.k��Vn�?�W��̆2G�{ߋ#�z� �}Ȁէ���1[b%h����!�x���"�0��@��O��~ ��L�K��Mq���R�����<92�*�)H��`��6�>���+.+Lw�����aWn�u����m��,8QS�=��5rb��� J(��=3j�`�����.��آ��4 �VO�� ��`���z�nj����-��.j DB ���x �ˍ{3|��<͠)�_��Z�f!9������)�%���Y��#'/�e�r;�mk�ӕ�iw�U�Qvcуb�7�J�� ��2?_�;$��[�}ߗ�E��O�r�ͮ�F������A�K��k*?�e��1PU���WX�^&�e`�A48�Jm�)�,��d�.����j�;��dM�9^���Ⓘ;߇pz��<�/ ��u�{����on���� ��� "8��紫,>B��9r4jE��91�j\�>˽�f3���'��{z����O���{ᱚ�M�=Z;q�������Fut����~d��v-�@.�-9k�O��#��W��KH�7���d#3�լ�`��Z��S��rG9l\Ʌ<99���"��tKm�G��R}!YQw�u��Q[��E)���-��Pn�0:�>�w�6�J�ۼI�Ҏ�d�Ñ��3�� �'��2���� �܂���.�%�(�ډh~r%a �\Q"�N[�`Lʆh��{P�?�B��վ�}~%��*f������\���ۍE������Y�����I��2�FFr0�� ��A��F�cN�jh0O����ב~�� [���_��O��a�-�Ӻ��zJ�?*�-�6�H3����K����o*�|�i�vx�%N_�V��.!}��)���ܑw�>��]��B��/Zl��r��5U/�kc��q$� �w��D��TF&���?E���W�w�h6U>۳-�1�aBC�)������! �L�+�Mw0Z�ٺ�1OsX�KS�-��='C�m����4��7OUՒ�K��Q�y����1S��HIZ9� �����_��!=�0>����T��IE2�-�j�#�e��X`� �����[ 9j�w�ڑ]MWh5�?ޡ�>bBq��%9�u���"{��_�s�͕@�P1M*F�C��k�����G�ɤ�L,m<��um�O�;��ua�L�š��S6`,R�����j��RR�kt������lo��Q^@1��<���ѱA -���.���f|E*�ϔnDΣ����%H�՛s~A�+���Ox�tU!Z�Ҝ 9 ���ykI�i?,��6W���ҽd���t$�[%�0Փ���^�ꑡ,G���Qr6���8����QǾ/nu��c�*�ׇ:�}����]�.(�Y~7��+�i%����M���mLƅ��q��Ȓ~� �_�,h�t����l)�3�b��v&��89Mԏ�1�s.M��N��kR��M�R~��l�u��pF| ?�x ��}�u�B�%Ƥ|�ua�(����a��&�sk>B�1��� �Q�{�9��MH�^�^;1xUN����L/*Mh}^������t�γ��9�`=�ٟn�R������X�v���#h~�D��J�(`�QZ6 �uQ@f��= P�9����LAk������s;9Ǥ�`��U�K=�G}�(�o����������0n�>g�g�#�9��C<n��� �[v{�Dr�sQ"dT��E_�����(�@l��£-ás�� d���$4X}V�\Ǥ{�����T �Qo�*V�zh��EwS��<u�g}蠻�u�s�S7�� 3%f�9G� ����e��p)�9GԲ@��h�Y���g<G�)��%$ep��P�|�k�����ο���� ]5��-�ѓ���E��P��ɏ�儘�y�r :l�3���{���)�����%ײ����$�����7!2�����������Ho"1xV)�ܐ8z��GB�16��b�ɢ_L\u���j���R+�ŏ��3���Qضݚ.CLa*3�z�F���'��ƽ�J}�M��<��gf-�G+�u��˷?��ͥ8�����cHp��x�KП$��q����&��&6�@�oS�=���P.���įag�d(�s��>�kT��Ǘb��Օ���y[��[|$:��� �F ,q�N-E���Ո�Dn����D���L�I� ��L���-,��C� ���M���G�8��L'�,�Z�|���]�W�/.��R+NtA&��̍$�9��*9��d�?�Y��{D��*x|2\��g�`�c���$h&�E pY�1�(!��0-��=| �C���*�� �]���V�� "�?L�n���5R��0��� *(I��hsf2w����ƌ���{�v�,=�(���um�z��\Y7�o����Ù(?q��S_Vr�YH_a�=���*�Z���@(��]�G�s2^�o�=��<W�Ͼ�����3:�`�w�-��a����D�MG���V��z5�������Pڦ��(R�+#��~���foc����ƍn�����@���n��։ R�B�}7�AaYg2��� zl�q/�Y�z��8}�E SԤ�7�G�$T�����[����Ki��`Mc-�����y�+�ʬ3���^�1[���+v������;�-�d���h��RCy�0�t|H�q~�A�30���K�9D�GU���\/?㩫������c�AS{���m��y��v���� b��[�hdm�j�WE�7ӈW5���TS�|����$�=Kf|_�C� #o�հw��l�y�]:�� PqUo�B�l)SS��q+E�BLx��w��=)y�Zd��kM��Z6���<��?�jC���VVl� ���u:��� �^CA�Z3�5v��`�R�~O�� 4���ܐ͋3|p�W�x����!�K�v���w��`��!���ʐ���
Static task
static1
Behavioral task
behavioral1
Sample
e400321cad194b0fc74ad199156a424a65ef7eb0283a4fb698229871461cfb31.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
e400321cad194b0fc74ad199156a424a65ef7eb0283a4fb698229871461cfb31.exe
Resource
win10v2004-20240426-en
General
-
Target
e400321cad194b0fc74ad199156a424a65ef7eb0283a4fb698229871461cfb31
-
Size
5.9MB
-
MD5
2846defe5c6a2a78ab39d230c468454f
-
SHA1
22443ef047d9848d5af3c106581b7abfe01d0868
-
SHA256
e400321cad194b0fc74ad199156a424a65ef7eb0283a4fb698229871461cfb31
-
SHA512
e8178677b6e01037df7ec7b5c26606c9f778e50602fcd35f8c2223a0e81a982eefbb64890b5b48a0d444f5c5578c723a313ad3cf535081861c6d52c3dd581085
-
SSDEEP
98304:2Jeko4meKiEyroIByOwW3k3uV/gTKKLFAc1cpMhRF+/11y1PXFqqvnRvFhIpixZ+:Km/Lo3fwkkCgx1cpMhWzy1PV1R90iK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e400321cad194b0fc74ad199156a424a65ef7eb0283a4fb698229871461cfb31
Files
-
e400321cad194b0fc74ad199156a424a65ef7eb0283a4fb698229871461cfb31.exe windows:5 windows x86 arch:x86
3929eb2103040cd0bb68659dd1ec8cc6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PeekMessageA
CharUpperBuffW
gdi32
ExtSelectClipRgn
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ImageList_GetIcon
wininet
DeleteUrlCacheEntry
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 779KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 566KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 377KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps2 Size: 5.9MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 40KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ