���{�����PibCN����V��# BS�x�����} 2�zn�o��i��=�8V�dF�����H�+���r�d/����D�� �^��=>;�7p�v�-��>�8�Z�|&�{�e�t]�bm��Nկ �)8�6�_v�m�ې�Ȯm<��Q1�>�^��!�C �����^1��HD��ځ.��l� ,���I�[��e����_ͨ��V��Ϣ���G"_��5>�w��^^���nRϣ4�s�g^=?�y* e��ﰈM#<�L�E����ն�~e�kq�W����<���ՍTN�wdf)���E<�z�r�[_ߑ"����'������N�"a�ƚ=�Тx�����r��8�2������8�I]��*GS����ƴn�n���ߊ�0߄�ҋ9ׯ���Ż��醋o%OѐG���hŻ �`� `/���C*��Fٲ��F���n����W3DG�6��iW"�,+�m�,`��w�ϱ��U=5�{���"�E 7��x�X�ͮ�V���KR�n$ua<�i`6��OG&z��\���ЭB�/X*"��E�t�|�OI�D���r��Y|,�"V�8���"�ݓ�qJ��Ǔ�����#�X2+ݕƟ-ݤ�0�w�Ԃ�ɾT�w������¼M"�$jk���]�4r�C��������~�~yuzt�2�;�ԥ��_Ю7i,Z�]gn؍\r�K�_�G H��0��ry6��&�|��>u�do_O�$Pދt4��j˯�<�^J>U��<NH^�p`]�Vf�A�T��G "�{U�M��H:���@Y�H7^ �!����<Xr�f���{���X�ŦuqRõJ_���r���.��3�,|�1�4W��֯�L��q���[e��}�ts84n:��h梄(�i��֧cb�hi�Q��6t��O$R��]�sSv��8|���Q��bwf ��c^�G_6ٗ��w�+�8X��������*�(}��%?F)$�'����2^��2*�ǯ�hEU7�2�f�d���o���sZ_�*�����l�4� ����$_k����w+��#H�U#O~ �ʋ$n*_!�[/7�2���N���� ���Y&�G�ÊA3(�� Ԏ����b�xX^�5�_��P ��ö��#�S:�������>T��-����WCL��*o��h)?����tw8�#H���gR>K�J@�6�#�aHaq#�V{�����v,ԁ�c<UN����OR�3m�F�\���&�nEJ����7�>�v@���)'ϴ+�-�D��ӡ�|��kh�)5�F4:�.şK��lv��zs�q�;��Z;��%�,y��_�#������ ���W��� o�a*>ͩ�����~#�"�F�] >.���"�l���$��"���Ͻj�5�(��-��0[����&�8�@��o�<?~Q+`y��!������M] zJ c<4];�0����߹z���� �0�!I����z��� q���[k4���? �1x�U�1� ����I�$2�19R_{��C��&㧠ra����?� ���z��%d!����X�[��;\x�i�H��T�st�.�x�1�b���ɩg(�;�cK���h0��ݲ����m�z�S�#��!/G����/�Ӵ6����K-�T�П`쩰o�� �ґ�C-�RP������f�<G�ދ6c�vF�Z�#!@�����J��Y�K�� ��`�]��^�,R��J��%6tApo��)�K�'��H�c �:;�J~��ܞȶ����2����85��q=��h��z��L�-(~:��B��{�z�s�����E-nE�dVPv�v��w�`�Pzz �Į�����"@!$jJ|�w0u�ေ�O3�(�f;]&d8�������/�x���;�ٌOi�0T�m�����(_@2��L/h�To�]�d�x�ܛ�M�����؉�'��t�.�����g� ���Lk�L���5�1~������/���A�&Pg:��6f{7���@�/��yȂ��Bs>�E�9�:/�#+�� �j�����K�#�(`��&��Ɣ�J2�����?ҏ�wD^t<�����M��� �H�m�T>�o�.4�iĿ���_p��Ծ}��H�`n�]+�j��M1�m�qX�\���y)��]ꇔqc"����< ���Iw]Z��0Q!0s��_���Z������] ����s���8a^��r�n �O�q����=[����)��q$F���2�k�s�%��r��dvv����#܀Ol�M�mP���L��:` .(c�w�"�1睝_ڶ,�i���Je@$���u����k��;X3�v��Յ17�(;�&z�͑�tdV�UL���?�{���'P�T+���*9;*���Ǫ���f��y�1A�g`���P�g��������\u���oѶ�`OQ\��� o\�{�Lp�iC��AY��h%�,J�N�� U�M��|8�`��X�i��-��QÈ?H)�cY�(��&[{�����M���(�S������`5����t+@�v5EAK�WJ7ARж�Ap���$�Eh�f��+-����gg,'�O��Hh0�b{ R�zƞ\�[h��z�!�J1��7ΕS���A�>-�Xى,������ձG(�W��y�Dͮ����7��N��Ÿ�Ɂ�%��k����I�x���lȑ_o����2[���u\���3��^k+5��=�q���SD�'�Y��Fm�,_�uΒ��;�g��g�MDd���ע�1�d�������}P-w#�L�?���� ���o���ڮ�L!>]��� �5�3�=N�� ̒�@�o�Лn�����JSS��[�]U'��̸�vj���^̧KxZ�fE� >�ÔU�]/@��#��ײ�Hӥ��i[� +#;o�V���@>i{5 ڸ���<��S/�g�mCYſn�[��L"��_��Xf$(�\�;E1�ol3� I5��+����Y��e��e�g9_vFI~6��տ�2@�c6R������8Ϭz��R�-��"3m6������#��l��j��\���Ûr�̹�f�] �ҨDK4�T�!!��"�M
Static task
static1
Behavioral task
behavioral1
Sample
3c7b6515646a8dc9a3f2694f2a61c3bf40264b57ae5e7a01b34dc0f62ff08b3e.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
3c7b6515646a8dc9a3f2694f2a61c3bf40264b57ae5e7a01b34dc0f62ff08b3e.exe
Resource
win10v2004-20240508-en
General
-
Target
3c7b6515646a8dc9a3f2694f2a61c3bf40264b57ae5e7a01b34dc0f62ff08b3e
-
Size
7.9MB
-
MD5
3ee71f2d1d1a89abfe797875398162aa
-
SHA1
b0f09021ad2ec56c0cadf5e13bf791f9e51dec58
-
SHA256
3c7b6515646a8dc9a3f2694f2a61c3bf40264b57ae5e7a01b34dc0f62ff08b3e
-
SHA512
4dfe9052c567735da90a3584ff6752aaa1c15e45009d41914070b2e1c86754dc71e373cf6a6a55d692fb2a4a43326be3146e45660f816d49c7c2d6fde8302116
-
SSDEEP
196608:B3lWJXaJMYSd6fKeQ1TLn4mk0tHMXMpLrimKPnfsDH:BdjSd6fKe2Y70tscpqPe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c7b6515646a8dc9a3f2694f2a61c3bf40264b57ae5e7a01b34dc0f62ff08b3e
Files
-
3c7b6515646a8dc9a3f2694f2a61c3bf40264b57ae5e7a01b34dc0f62ff08b3e.exe windows:5 windows x86 arch:x86
8a10b4a1f912b34561b98c97db9d83d5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowTextA
CharUpperBuffW
gdi32
StretchBlt
winmm
midiStreamRestart
msimg32
GradientFill
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
_TrackMouseEvent
ws2_32
gethostbyname
wininet
InternetCanonicalizeUrlA
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 490KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 494KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.71h Size: - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Pq] Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.QWQ Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ