EX<�n��}.��b�8�~�WP��6j��#��oDx|/�pZ���|T=��yD ����s2��)�IN�3�MF��m���JeY�[���2�������������Q��fN�����]��|J����Z�$DK1����6gK���xmF{־[\� ���jYn��H�F�v�Ѩs[�-���ܡ�Eb�)-\��Gn���T'�r����,���Hd��7Q_o.kr�g�X\8���i�E�g�m���#���u_�v���.Rq��Qʫ�N �n�#+fD�U���@���5&d�f���x�c�B�叺�Dd���/6��X�����.\bWN�n�qs+3x��1r���NZ~/�_ Β!����}�*��t]~��<g@�u9����;m��b��A�& ���Kb���.Ou P*pQ��P ����ʆ�@}�_�ۛi5�,��72�������E|�c�Co��h�_G�{Z�v������3�I���+Ue�1J�w]�=�����wގ��=cd2�ږ7Z/��j� l�o�TNx�t�r̅u.\z5K�a�"]e�aQw��/G|�oķܰ�8 W@\�/�0�Te�~���7^��!@��IA��w(��e���xv��8��|X.VV��{C�p[ܣ���:d}K�ID)~.���ν��-j�!��r{N���a�bi�L�ǧ�T��!-X�-�#�B��X��3A�������.<�p�C�H=��D��ag�F'G�3���{6[ÿ�Hu����K�$s�ͦ`�����g���P4��-�{��Z�`���pMh4{���і@�[�4�+�x��_vCi��(�HT��ˊ���j�Z�g�$�ߊn����胭���$�Q����;צ���®�[Y��i햔�x�����u�;_:V���oe}�c��r^�W��W�������#BDȵ�7��R&U����G�Y����j�'!B��S�o�<����:�p-��?"0�)�"k6��7,���g�%( �W����� �L:����&^�4YMp`!�n��S�W��ab�v��h4H�1�M�{+%1����mpS1�В)�VS�����-�Y�0x�5Ľ��Z*˶����՚�J�,7����Q��+���"�ds�;�N���R<�AMf�7���)����|����u["���:���|.�g���e6J�Ed��t��R����e��bC��2�Kc�!-��W�E���ЙH��K �r~r1�#u�xp�1��� ����[ز�!��*���lbI~G�lF�d�hŊ������u��� u���ij �:#4[�2�����=#�S#�[�xAL?�5��D?/�X�jt�(�8l����/i�DΓԹ�@�l��;�&���tR���� ��Ֆ�.��s�s^�%�x-i(�cq����(n���$D7�Ufޠ�����F���Gޏ�������m��#>�#� ����2�������r3� �2O��}�BD������s�s� �?����d�"���_�����P��q��]jDx�T�W8@��g��,��j�侭W�c ,� #o�G�!GM8��1���AW?�_�湽��?v#v��_���PE��䀯-�ɼ��7���{�ш�9�6ݖc}8���-��g���Gږ%#i�D�xWй��ha�]�k�����K��?��CaR��u���ш�#���ԩ�Xo��7 ��VP�4q����Xb ��gQP=�u���z�^�PG��2��y�,P��,D\�lW庢fY�3xwo���6�]Os�s�4\I���1��o����Ie{Wj�]�0f�\5\v���=��D��[Pe�Ձ���9�<1����j��a����PmY��U���J{7;Y��Nh����c�n�b��@eɺp�i���K �!����=���o�[�Z�K\�FM�L�i\_K��ft�Y1M����q�����73ˁdl�����<�������9���`�Zp_(���/i�3�W�t��s��g v6."G�t����FpM�r�~yKe��]*�i ]N���1�6�5O�W��0(�� �s�W���0����0���c�c`#�t�AƜ���P��R�����(��& �3�~pζ�`��P��� �<�>�5��J� ����z�țFe��K6�D�~E��0vLV�$O2�����}�hO��+��>��g���@f�O�s�C*�)�<�y�(��S2�?�>д@�Z|���ci�ޗ)c�<�1�bcn��O$��˨N�m` D�[M@%VP��]P.@E�BƢ����g�+���R�+P�ę��`_�G,�Y���ڥ����?�B"Te?\�P��y�of{�-������51?.��E(�܃�ϏH��A8g�5=�O��%�������R����� dvD !4��1v�ے��G-�#�KYۜ��a�������}em�<��A>%FN�cD���k���0r\��L��VX�4�mѨ�V�KEʯ�%V���&�����ï?V�Q�sD0-�osp���+��aV�/�J_v��g �۽v�;��*F����v�J$��9zqKC��[����l�6�6��0D��Nh�o$�"\<Ċ�<1ʼ;�p� +V�]A����ޥggvZ�4X����J��{�t�uH�;`4d��Πy�?�EJ�/\�2��!7Q�0�d7 �Kc�����˴����̸p+}���Y��ך;�@�"��^L���4CZ��_�7BJ���vd}���rk�'L����4�u� j<�*��r:ְ�{�Éh�N"e�U^�,>G����r��u�0̏�S���6���5�F$#C��O�\nJ�#&� ��(����kl����Ŷ��+���-Q4k� �{ĈJ;&��Z�Ӳ��i�+Y.��w��vH��_��c2⳺H��!H�* ˃���3b���A,/�x���8g#�8X����&�O$�_���q��.���A˹����y#�q�7w����5�ʈ�prD����i��aL'v �Wƨ�jm�% ��ɤZ�%���*QcJ����������a �.R�h�h9t��{ա�a�}�Eq���x�N1#����|A#
Static task
static1
Behavioral task
behavioral1
Sample
d1251b5ad976029da52a1790d277141407b390f1d2a6ff83b1815789c3f7e210.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
d1251b5ad976029da52a1790d277141407b390f1d2a6ff83b1815789c3f7e210.exe
Resource
win10v2004-20240226-en
General
-
Target
d1251b5ad976029da52a1790d277141407b390f1d2a6ff83b1815789c3f7e210
-
Size
13.6MB
-
MD5
793ed7534b27651ddedfc410d3464655
-
SHA1
6a61d607fd4189fec28730dde8e126475ff1680e
-
SHA256
d1251b5ad976029da52a1790d277141407b390f1d2a6ff83b1815789c3f7e210
-
SHA512
471aff5d8b7661459996db93e515f9f31a5f2a9a3fefc5e4229f8d51157fd6558e566da5eb5dd7e41afcf3c7100bbb4a55c6e8f26a1bc58967b38ea1a29ac574
-
SSDEEP
393216:9poy1eYrxiN+jiM/aEf7xHEwRFNNdV811:QmEN+WKxkwjNP63
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d1251b5ad976029da52a1790d277141407b390f1d2a6ff83b1815789c3f7e210
Files
-
d1251b5ad976029da52a1790d277141407b390f1d2a6ff83b1815789c3f7e210.exe windows:4 windows x86 arch:x86
924adee3235111aa51155dbc716b590e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
advapi32
RegQueryValueExA
user32
GetKeyboardType
kernel32
GetVersionExA
WriteProcessMemory
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 344B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 18KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dat0 Size: - Virtual size: 267KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dat1 Size: 13.5MB - Virtual size: 13.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 284B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 67KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ