q}�[#�ɯ70*��L�#0�`ؼV������x�M����bn֕+�rA:�Q=��Ŋ�k~����^��%��I�u�WW"�Y}��/�)��$E�ࢶ�W�Ӝ9�X�����xNؿ��dy��U|1r�T~n�<A� �yn���ԫ�vwǢg:ӄwÇJ��B�!�S���9 e8�UI��r�a�Sl����qo�j���zi�0��閫�O���U��<<]YH ���8���j+�~3h)r3���{�\]mPǴ�W>�Ǥ���f�)E ���s�8W3W\��z�۹�3�|v)`�/m>������ȋ=�Z�R1��u���b����� ݶ�r@f��3}H�>"�c,Y+���)|ܐ�������$��}m��j}�Q�n�ripꝚ�����-���a�#�$�(��h��%K�\6yJ".��mzB�7<|��pT�{����Eͭ�b�Xͥh)Z�MF%\jT �=Gg�>����2�w(��̉x/z�f��Ҩ����F���lA��iu6�/��h�7&�*Gh9!��_�Z������w�$�eUػ? KL<nh�fL>A� �.]���U\�!"DDZ�-�ś���s��!ڎyoԼ�BPvء�4��vԔ&�S_!n�� v��K���f��KK]��P��<#l�ƴ�u��B�Xsz�M�y�>'�CLɅq��%El�Bw�u�Dp�Å���q�L��5�i�0g6��:&��qK�������]��%��N�}@�I��X_?���H����mN'*���2���A�,YE����.<P��zJ����!�)$��Iy�M�����&�R�_��ӕ���a����y����$0us��$Pل��8f����f�#�)�=�� o�N�l��E�6�:�;�Q9��C_�%Gm�È�0��`njg�*Mɍ�CK'�� �g�Bi��-&�f+���3��mmbv%b�%To�x\$���% J�9��Yx`��o4��F�6��x�e���+�2�l�T�\�Ytl�]˛�@b'�0��\���!$���i��9��z_�(�5C��orY�H�>��;S��=���W�@[���Bԧ�|�To��Mn�v�r+c_a��Bx��ެl�uݬ��b.���̆�7�<����,W:�-� ��d]��[p&+�Wa��)�\�����k�l�"c�x���`{���diJ�G�!���Q��G��#��h)<`Xd<� � Sΐ�pqU� �m?���"��2��r�$AD,N�&_Jcn��Ч5x4K��sV��Q��6yb����1s�D�6�PI�M�{���J�Ԝ�/u �\���p�Ef��+�#|rm��I�v���A�����K����8���`����|Q�G8�=S�#�I�7�r} ��m%\� +߄�S��$$A�I:N���� ��A[̃���Sf�.D� �6����S���S�S�3-�Aw��h��r�{��.����//c�(5~U��ģ�i$c���>v����$|�$�4��M���$ޑM��C<��;B���$�Q�O!��O7��4h /�6;������\�:0c�⢩t�,L����X�v�-��>��!�h�o?m���n ��M0~�r���8�9��Ax�9V�}�1��1�������_�r��|R����LÜ�*.�X0�9r�4 ���y��W�).%��=Ӌsr;b�I0�[ �!�qh�*թ�p"�A�>`Ң�$ny\���!\��~&��)� �-+�WH�T,+�kg��z��ό�ڨx�b 2�«4�QuqZ�\�,sM����iIf������O���ӄ�1^NSڄ�q��ތ�P�<���cȒ�|&A����3��������;�o�(�Q�2�&`\�b>�_�d��J�2b�#�#���(e�h+�Z�S2R11 A=��rFxt��@`c5ȕ�k���3t�de��td� |1���7l�2ې��؝�ޯ/��¡F�/<��yhZq�_��|h������lF�R숎Yg�� �V�qg��*��^9��m̲�@5d�_s ,��O��,�,W�;�4��H%�~���*�#�wD�UJ#���2���7������̡t�$FF�ԥ���� �e�Ԃn%�NKRn���˦�)L���-��Eb��;���d(�8<1EϠ K 6�����4N��>�-0����[��^e �1!�)�$�`��������&��� _�zO�"��Yp�����������g�����S"�2��2r)*� ��lA=��BEf��Ԍ߸2��l~c� ����ծزH5l��ָj�\I#�\4G�c�Ƈ�L���&®A%l����>z%��nT�<J,':p7���7CX3:v_\��K6Q�T�X�g;���ft�/��&�z�p�w֝T�*�WMY�n�+RL�&F�����y�S��|0����N����1��X�}�C(��^Z�������%����XC�@Œ�[��x-�I*�V�����LUb=h�q��W�{�}ˠ(h��\��e��S��:�bs��"��6� ���1 ����=��G"�Zn��Ś�o��&�Q�f���Ve�2>�.-%�%d�>����M<��[�#�!GM�D!���1*��zۖOz���A�e˝�$�~�y��k#�������@�1�Q&ǯ�e��S�PT?kZJ��qk� �����Ŵ�� Ƴ����Ry��.�mn���7�٣�}\U�k�N>4eH�0��Y�K�YbH�|fqۇX_I��� 7�R�!z��IH;����8C��;y��xk��49.��'�0n�R�SV^�;Ur�ALJ��4V�ʸ�[5+�Z���y�8FҾ���\$� �꽱�4������Q�A&�Q �Y�h�g�����$n?�8���s&����X�9�bt=$�8iؚ��r7�:�8�2�X�saLO Dzt�ɳ;�F��"U{ �C=�?b$2�9� �".�lK��@��Y-�d���.X�a �2����=�^�dW?2ψ�0н:��U��:v!DOL��V���}���.}�fR�9��Eo��#�[�v&7�4ʍ0\P�D��ew
Static task
static1
Behavioral task
behavioral1
Sample
3a52e1fca7f4df29084a61c0669d1cabf09b08f95c75bc48444e17a73e921e5d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3a52e1fca7f4df29084a61c0669d1cabf09b08f95c75bc48444e17a73e921e5d.exe
Resource
win10v2004-20240508-en
General
-
Target
3a52e1fca7f4df29084a61c0669d1cabf09b08f95c75bc48444e17a73e921e5d
-
Size
8.1MB
-
MD5
cb08541192a1df3df4d3bab4477e1212
-
SHA1
9835caa32ed2c2bd3f919c13f4b684b449234bf9
-
SHA256
3a52e1fca7f4df29084a61c0669d1cabf09b08f95c75bc48444e17a73e921e5d
-
SHA512
b19dc22b5391c7c7ecff15be441ca0150d67c115a232f7d0e0feaece53b2a3608e49c25e219ccd298740b29bfb326a7a4238f66968b92db2d9856fd7a940ebf7
-
SSDEEP
196608:DDNZB8xthNnPcqhqymA3EsvGU7EPzu8tFWgp2+6oljlDS:DDNwdQmsUwPK8tFW2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a52e1fca7f4df29084a61c0669d1cabf09b08f95c75bc48444e17a73e921e5d
Files
-
3a52e1fca7f4df29084a61c0669d1cabf09b08f95c75bc48444e17a73e921e5d.exe windows:5 windows x86 arch:x86
18b323b0336db5e20c3f5ffcf2bf5d9c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegSetValueExA
comctl32
ImageList_GetImageInfo
gdi32
ExtSelectClipRgn
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
oleaut32
UnRegisterTypeLib
rasapi32
RasHangUpA
shell32
Shell_NotifyIconA
user32
GetDlgItem
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
wininet
InternetCloseHandle
winmm
midiStreamRestart
winspool.drv
OpenPrinterA
ws2_32
gethostbyname
comdlg32
GetFileTitleA
ole32
OleSetClipboard
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 784KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 644KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 504KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp0 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.CHK Size: - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SCY Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CHK Size: - Virtual size: 4.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp1 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.svmp2 Size: 8.1MB - Virtual size: 8.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ