J���N���a�/��2���W��gּ�*�9˩LiŮ���/���}֯�q�V��P���hV��rw�����j��{`��/�J�o��7f+l�U�:� �)� ���1��}���i���NC��}[��Q]�n���w6s`�P�* `��9�v>�?��dz��)ě�y}�t������6�x:�����)5���!ѓ[`�a`��h���X�m:�Cp�D3���a0�S4hİ�a����"��D��[��4 ؤjT�~5�wN��X��`���)�<H��۳�X�-B�2���(��^�Q�*s�t}�ŅcD�n��+���`�@y$@x?� B�3MLJ�����o�������/�<��$�L@t,�}O�%a��>�O�6�/�u"k�kK� |�{9\.Λ�����M֥�٬N�j�'3�&x���+UI5y��Mz��,c:T���Md�UU3�&�NS�k���3�!�kk`�;��)�?gu?X�A�]��{�R�����"���G�%��@��� �0 ��씦.6�~RK^�7�Hs��j�S��J���S\Yb�]wx���,�Q�1�`��3>����I+��ި��і;�`����pU|+�P|�ʻ�}�e�j�����霟��0Ǐ��\������C�fuƼ1g����a�q��Qt";J��"S�a/����8���-���!�Ky�S�)�3���5i�B| ��Tg 9n/ޒ�|�`8ڿ�W�[�zc�7� vH�����{�����P$B�7�R-�tF*f�V����sb��ZB��q[��p��d�PW�; tr��ֈWL|��l�0�� �Y~�"zb�~ői�1��q�mx�j��.1���z������ߜ;x^m�S���Rr��� H\�~sv"%N�<0�ɨLn���6gҮĽ��~���Z�u�C� �d�[H�ݭN��� #wK �U�kТ%�̧�{�庛ZK�,}*3�A(��Ԝ�!�d%(��������t�ܻ2�f٢�۵�|���V��gJ�w�;�2�.�Pp�rOL�7����/y"S����gӗl�+�&��-��_���=� GEE-Lt�I3���2�hG�=r��݃�9ݳB�}�nWw�5�֖�F�8G�1���ƃ� ��ʢk29%荃��rZH2 �{tP������� uΦ���s�$f�w�Ds��_���ML����͖�{3QfZ�� k������� <��X����������y�%�!�� ��B����0��[۰�� ���3 �a��/j��D.�n����n݆�lČml�W:̋%Ww#@���J�\?"�L'Ģpy���At�&r?d5��tҗ �{��t T�nMiA�)B����H��Ս`g�&��%ȱ�):=���w"�jJ��p��Q�� f�z�h"��^Jyؤ��y\E����^L2W��rKyv?���Z9�W���2� ^��(j�k���K�wZks��}T��-��o����6�w�|�G��~�%VLT(+��T�hr��2��6'��lm.tT��h���#���&_g���?���w9���c˲U��{�4�`P�v?��%;�JeY��L���lxAUmU"/0z�����ѿK�����_��b-=����[z���B?��VYuj=?O�'3�m�ko�Կ�3D�s�r_��LUt�ړ �^A��u�����lq�";���3��>Uk�����T�%���[77���?F0��~Y֏��q"�����J�&��5�]��8>�Hᗵ�P���s����Z�&�R8��"�u�������C�T� ��.��oc���]���U�w���)� p6�ah��-�I"S������0��͡���j],�Oƛ�{|�٫����'���X8��PN�A�}����0W� � �r'SZ,+ ���LnX��P9,-���q�����psᏸv�dJY,�έw�L��H.�<``�IG�5���L� �����d½�/j%lPEd8�3[�H����5s5����5*$�\�%}rM�A0@s>iGӷ@�B�UV�W 0@r0@�aNB���� b�}����/�m6g��=����!��CY#��������*z���T�@��]�@a~D|�t��쑊��c{+�|UV�� �>�y�Ӕ�p:>R�H/R��T�����ɈA��[�DZF������8E����zt����W|wJ6l/vz}�>�A�F�.2_�}�;�}#���rkǀj;t��_�{��ႄ|� ���>{� Ti�_-���,�4����no�� H ���xPl�%�˔�&����ʗ�Vi�������M�]�9��� ��C�hVϾV0�dKn�!�&T� J����ƕ%5���}0Mu�C~~ڢ0k�G���|��c� �暤�ʽ�� ��uU���-#����W��T�@~Q�,���O�����D"��ދ�;�S��!�?����y���Q�e���i�pG��6�����Uw�t�@P5�juD���Z?��>�i��hq���Ч}��-�~���"��z�� �����i�C� ���˼0�'����k���p�����������gPݕ�e�F�DG��XźL�U��_�!cY�d�n'6U�[�"��G'����;�ߜ��E����[պ��Ͽ�U hY蚓8/)B1t��L;�U�܀��MA N�f`H9��=�<�k�K^YBQ�u.�|0*SȨ�_3��#� g�Hl����Q�����u��#���_�G����?�� o3�۹k�pm6�d�z��Ib�u�:}�Uٯ��'`����)��4��BPU{�f���_�<9F�9�ƪ�+�WY�E��5�ƴ�ҶD�� L��_U���������\[p�RbE?�z��#���t��^2\o��T'4J7��v]!���x���{���4E�W�[���S���̅�I)nՃo,�`BQ+�|���ԟ���u������d��Z\�F�/�Z��;�L`�>c��4K�LY�{|��s ?{����r���o���W��&� a]�E�6l\���`
Static task
static1
Behavioral task
behavioral1
Sample
1fb063dd83c8301952e2812fc64c228c7fff9b04b381346a15449980cdb170b6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1fb063dd83c8301952e2812fc64c228c7fff9b04b381346a15449980cdb170b6.exe
Resource
win10v2004-20240426-en
General
-
Target
1fb063dd83c8301952e2812fc64c228c7fff9b04b381346a15449980cdb170b6
-
Size
9.2MB
-
MD5
994571e1fe7b2dd49ea7da10f2818113
-
SHA1
0423ca1b84c288861699c5ca3b4caa174a3a8d6f
-
SHA256
1fb063dd83c8301952e2812fc64c228c7fff9b04b381346a15449980cdb170b6
-
SHA512
b720c477851451483d84cedc8a7bd74fa81fcc3663024aebf9ec9819b4968af3ce042bae1f208f507f8ee36d89d50db4d43235b504f4638e880e4cb5055c02c9
-
SSDEEP
196608:bRHqXgY2h49fEvqyM2uE0G49OjS/PWSq6GfseRRw4mtjPcC6g6v66666ES66666u:kwW0ogS/OSqVfseLPmtLcC6g6v66666N
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1fb063dd83c8301952e2812fc64c228c7fff9b04b381346a15449980cdb170b6
Files
-
1fb063dd83c8301952e2812fc64c228c7fff9b04b381346a15449980cdb170b6.exe windows:5 windows x86 arch:x86
9216f709158eaab7066d340104234e89
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
midiStreamOut
ws2_32
WSAAsyncSelect
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumDisplaySettingsA
CharUpperBuffW
gdi32
LineTo
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CoGetClassObject
oleaut32
SysAllocStringLen
comctl32
ImageList_GetIcon
oledlg
ord8
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 436KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Y[~ Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.[DW Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gSa Size: 9.1MB - Virtual size: 9.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ