�@�h����&��Ӕ� @1�2?���ܫO��ͫrpV����w6�z�5��돌9z�x�#rvc�`eG�� 5�6�s��`�:^��@�c�+OP_������f����@�v��Z� e����q�P�X���\T��r���1e�����|�d�����Fn�H�aX�U ��������z�p�p�,��~������`�P���#(UW� �/���X���9؛1%���~�@0yZs��CA�٦�W�ߛ�%��K��}���_)�]�"{^�C&U�c�H1�wd`����@g����-Qiy�+@�O�Y{�����������^g���G�M��y�s�M������FQ:�� �:�q��G��4��_��+s�¯ű`Z쳩\f 2, �Ḥ?��9��fΊ�e25�;���� �&,�����7�7��"��$�j��b"���`|�<�Dz�ip���e����9�%������l�g �.�ν�>RѴ�Hhr�"[���~Ua� DA�����}c�̞���D:�7����0P �� �>�����:�m� e���UN<$�VAiB*���m��q�\G����C���SEdT���+h)�8Qw0����� ��yV�ҋ���e�ؕ�-܌�U�.)�m��|��Š�l�����k52��f����_�\�������v���;�0wy08 ���htp�����l��X�3��C���~�z4\��Vz��n,�f���C�%�-��j�\�fT=�㡬#���Z�6���Wť)g�Tm����q�\�w�F�R����5���Xً��������THK1��kFEʃ�f�FE�� e�)�G�=�j��)'���^`]��=p��c����A͊�w(-Yt|U���qy~ �(��lO�>l���3@�P����be\>����7�]���%�@HgJv����f���[dw�{�E"Y�5䲳3���ۅ��/ <�W3.�������Fl�q�� [�C�e�Wӷ@��VGX�����Z����:���G� 1o�����}]ɏW�6����y%�% #?�pf�<|c�i7���y(����>lW0�(���3�ՓJ{�n#��2R�Nt<�ٮ|����Tt)ht�)�ۑ�ԅ��vkMʤ�S�"�н��&���QHiG���x�: c���Q6���m�g�|rJ����:#e8����ȒhiR<5�[VG�{��RI�d_�j�NeINAh�0VȆI����mǫ�W�j�yF�M2��n)�K��Cl6 �W\��q��żQ��^ί�[�᭑n\w`zxw�&(Y��ŕ��:���>O��_r���9� �Y�����7��o�Gՙڌ�v�q[u>�1v�+<g�qi�a�&,���J�O��Yu^߃93�Jj�{�S���~{��j����>���q|���p���i��NY"��6�����h��e�k�g����>�̺x*M��< ��f����t���Zf1n��ƙ;�ۋ� �Y��V�^gs!�T4�V�MAga���أe�n��F~FN�\Ι�}��EO�28�QM������zh�8d(Pd�� CfC��vN��A�n��P,����*��4�6>w�y��G�����,Mx��>�y\wД~?�L��C�1p!Vf���_ߣI:�E���^���.����)�״�d^T�aq�?d���)~�t�6k%����vZ5Ez����I<5�E��7"�L�ڿ�}{ˏ�a��G{i:��fJ�j�33Dۧ���A�K���8�_�`�Cj[5�o-���Pd�Y� �bڟ56Z�ϴ�u�М�� �wt]��8(P�����ZS]T��1YZJ/pq�wȂ5T�z`�N&��%�����x˔���Mp�[�"m���:�X�n���ߧ��ܮ�ƣ+�F��5Q��'�@l��]��7�����T�vv��!�K�`�pPH���k��5%A:`�g!�q\q��L$���U��u�'%�N8�sR�S�Q� ^s�>E����<�j%t�uOՄ��t3۔xr�#)k��-�C��%�'�$h�al�^w���G�N����K�����n�!f��� ����$���6��ny^A=�����XuJx�����V�F����(���eh��4j6��U[3��P�|K�ڻ7��R�R:e���K���S��/C�7�(�M��-�5&���Ʈ����[���s��pȧOV3C�EJ���N;��M"V�?�p�lDFFkZ�s���J/џOa����k����h���qX�Y�H`�Z8٩�����>����T5�-��B;)� �-�29��[3�(�8��¯eᛍ�bbd�F��7����z�&vB��F�O���6����~n���1Շ� �H��ߴA�MUQ"�H����5g���DaW�RX�a\��=�n7���l2������J�����XR�>���yd�2cC�ػ4M����n��-�U~�F⎼�FQ���ؓ>+`˫WC������Uѿ[��P��W���b���nIC�Ѷ٭:v��uV�z�K�H[� ӯ���}ym�)2Q�k� `�?�n=2�o�lO�8m���L�TFA7�Әa)�^��q��H��gL0[�w&�势Tۚ:�6R-���w�B��)�*S�ك�.��\����oI��v~���}�Bw�73���'s���"����L$��<8<��N9�oz��H��V*��z��ʫ-H)o-�|�_�P�(�I-1�(�S��YT��zy��L�c���o����-��PU�&��H�ޟ�`$�;��FQ"�֧ T�g�eٲ���ܹ88L4K>�J�v�[��-)��|���PDU ����Ý�����������y�X� ��ҍ�p�S�0�z}54_K�,$t|������ �sG�Jk'����4 �R��W8+?�� �����ճ�)����~[x�o[L5��)�&�a��8x=�c��ҩ�_��(̙���4��ظ�L=�F'/��W�Ɗ�ߌ=�g���B��Kv��v5�KN�{IsxT�7v�hJ�R��XO�:)����Y�����Qy
Static task
static1
Behavioral task
behavioral1
Sample
1e28c722c4e51f0229439bcc7d5619f98ee3f053dfa8c9324eb194d861a5ff2e.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1e28c722c4e51f0229439bcc7d5619f98ee3f053dfa8c9324eb194d861a5ff2e.exe
Resource
win10v2004-20240508-en
General
-
Target
1e28c722c4e51f0229439bcc7d5619f98ee3f053dfa8c9324eb194d861a5ff2e
-
Size
15.6MB
-
MD5
ac9e956671116776df7325c79f12470e
-
SHA1
60888e64039adeca37c4948a7c930cef18bb8e42
-
SHA256
1e28c722c4e51f0229439bcc7d5619f98ee3f053dfa8c9324eb194d861a5ff2e
-
SHA512
e43984ff1b66504c1a118e9d384a38a8f74cb134a9c1ac1780324153bbe03d68a43681f3d2118eef3c45ea24cfaa84e04fff07b0c93d444d674d10ca66a76c0c
-
SSDEEP
393216:ljp30kYlEX/wskMAqtfYOe+CCOCwB4qUDoGDbaJDyCGRAj55X:9p30k3X/wsnTvwjC0rRGD8DFVF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1e28c722c4e51f0229439bcc7d5619f98ee3f053dfa8c9324eb194d861a5ff2e
Files
-
1e28c722c4e51f0229439bcc7d5619f98ee3f053dfa8c9324eb194d861a5ff2e.exe windows:6 windows x86 arch:x86
bea24c6e4ba33f7139208cae93249298
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetLastError
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
wsprintfW
CharUpperBuffW
gdi32
CreateSolidBrush
advapi32
RegDeleteValueW
shell32
ShellExecuteW
ole32
CoInitializeEx
oleaut32
SysFreeString
comctl32
ImageList_Destroy
bcrypt
BCryptGenerateSymmetricKey
hpsocket_u
SYS_GZipCompress
gdiplus
GdipDisposeImage
psapi
GetProcessImageFileNameW
urlmon
URLDownloadToFileW
wininet
DeleteUrlCacheEntryW
ws2_32
WSACleanup
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.#1~ Size: - Virtual size: 12.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
._=E Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.r}\ Size: 15.6MB - Virtual size: 15.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ