����1�9�M���B�DG@ �|���tFr��^V�sb�U_̔�Vv1��kR*���n�\K��$��&�?���N���&�)PX�Zb!�,SJ�_��z(��x�3���~��t��m]\��8s��=`Oc�H����]�d�Z����x�]x�0��*���1��ǐu���� �.�3���v������mf��}������pk�yX�J�,�"�-�� ��������7�ن�.lA����<�I�o�����;����a����+2�����f�_�������� ��ZJ���KpȶƘ�"X/�\Ìg�9�l �����[�� ş�Nn��:�ȳ����b��{.궈}�r+}�[��3��&�*�뭯&b��內�1�� �T�ȳ��,%W]bx�%��8ף�ȱR�Z�CÜ .Bk�ՇT����SuE�Їs�K!�!&���J�1��cZ�*@���P"�UwdQ����zJ�z� �Jˏ[�MRm��Ѹ�`8K\4 ;�Z��f%�,��/u;�ȕ�����F��ݢ���]_9^������H�J��~�t�`U��7P�vɚ���6"�l��n?�L��U��8i�:{���Z�� +Y�ub� '>��|X%<b�9L���G �;@�T�\�T�k�1g���h6���[��g�n��@��a��y Y�֖`S��Ǣ5����aGT��H���_7[� �Gt�A?��a�o��4�Aߠ�' ��ʏ+��:g�\N)ͣ�]��s-���D�{�6E�1���3�����Z'��{���K�� �ɤ�{�/��˦'�|Z�����3 *WE�q����~�3|D]��1�2��0! (��BW-�D�lkz�����dl�^�O�a^��JǼ�q�C��_X����H�i�a����z� �K�8�e҉"'C^7���J�r�R��U|�"l+X-��_R8�熝��ҽ1�[�o� *�����2z� '�!�HMNv���2�=�� 7�2P�)�/R����\$XORi�G�Rw�ϙ��E�/�����z�X����Zk:{py!�NM�!J���(D�M���.�%D`��.b7�����!��df{��A�R����I|�OPQ�n�*�6�:>��`R�W��l��kebňE�/N��,v�w��6�nϴ�cTǫ;�o��O�3�m�oo��Tn@q�H+��-T�a#�"`�雯�GJ��.����B�m���W���e�������!��:r�����Ǽ��A,�/�T�:��1�`3�@ǃQ�svu�'�H7�Am0' D9��f�TO� �O���8Xd��u4'��i�q��k���9D�8͛ऊF���*�������$y�ڒ�@~��9�AS�r���`muR��9�e.>@��/ �#!$D6��̔'�Y���B�x�D+ ��)#_Nm.���2��śL����쩆c@����s�}����}w����i�.� �jZ�x������h�a����j556O��DL�pD���=�Ӈ�(��)�^�f���j�M� r�Hu�'3>FNG� [']=Q�CO<�t5A�>�OaC^^oPV���ݾ�7�^�d#tD����}A/>9������\�Arξx�����)K��w��l��$`����(�C�jO/�˥3N�}��0�Q��+p�bMJ��^�ʂdN��N�"x�_ԫ|R��c��b��]'5���m�Na��,dC��`G�&$z����Eᣴd/o�;C�?��D�4|�tk�y�}4 ��t!F~�K5�� �I����:S����v5�3<cE�6�a�5*���nA��THIx4�F�R�O� 5�/���W��ƃ��y����@NW�� F͇[@�Q��%V̘�,q�D�_撺���)&�U����A9�ghNj��R��KFw��a�|ħzR��|g�D�E��`~�Oqr�P`.���?w�Ỵ2O��ŧ%*����7��������!m?ڄ��)�h�g�@�j����ou@V�I|V_��{ܠQg�p��Z�CJ�V+$�#�*j-��n������ b� _�!��iaݒu1����=[>���3�8;�y��Y{x�|�K6p��d���)�BX0}��1L�3:h��ei���v9�D��f��l���-���,�T�UE��������Z�镬�����%�2�P��#�ᴿQ��U�m�mk�A�x��_"I�R�ʍ�*�)�E�R�G�apm�2�n�=Jz��5�Kn�� �vD��'�}���i$�i��z�����������U�N��x�l�D��Z���P���C`���f-�Nn������2�2�a��f�a+�S�����M`֮` 7�%�(e$O�\�����#MB�i����=̍<ܴi$���M�GG��X�3R�B~��z�uj�H/�U����OGd���g�/Ťb�h��iu4��?��M��h�R�qP��L��W �F��<�ӆl�`)�������jǫ�D���Ƒk��e���W�y:|���䍓�\q�\~�KD�X�@��?�����Ϫr;������X[]EO ��� \��� 5M<xcG${a@F�\�qX��SZ'���}�<i�L�@t$%���'���Co"��.�U��J` md��0��mE�`��%W)r�y��6�2@s��=�!�l��m�'ʤ9 ]wl 4�[�PM�tUh��L�����p��V/�YuOr���;_�{1��~b�*��Su�_h6�}�!� �s�V���j�zq]��>ϸ�x5��*�n�QZld���CH?~p#�}6���ק�k��b�>���.ԮB���ͳ8�#�3��Sް0�x�����[F�WT�ۚ��g�3������ UF������[������� �}����,��6R<��y�<Z���M2�Vٱ��X����<�W�pD�Q0�6j?�g���f(��10M� ��� e�{�z��~ 1�`����v#.y;��\��t����鶎���O�A�555�O2���������/�GT�xN�X>Ѕ@�zz�DW��h;��Rz\\� �[�{$#��>�v]��hڦ&�=��K��E��C�?7H
Static task
static1
Behavioral task
behavioral1
Sample
f4f5f782e09cb57aa25e5fd699d14bab9868e47c233afc03adb2d7b208eaefef.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
f4f5f782e09cb57aa25e5fd699d14bab9868e47c233afc03adb2d7b208eaefef.exe
Resource
win10v2004-20240508-en
General
-
Target
f4f5f782e09cb57aa25e5fd699d14bab9868e47c233afc03adb2d7b208eaefef
-
Size
11.1MB
-
MD5
0d071ea594c237e2ea2e2d178b121958
-
SHA1
0a92d9f574f596378a21de65dad7fc55a96444c8
-
SHA256
f4f5f782e09cb57aa25e5fd699d14bab9868e47c233afc03adb2d7b208eaefef
-
SHA512
03c7eb452a3899595dfc4e054c01f0e736fd0c610f1e4b867aeb91fdd688e94ea12f5c40e84eebf98795b652415e8968d74f50eff203737dcc8873054662b2a0
-
SSDEEP
196608:GiN5azxUcsGpdrTEy8PIWyg5VJMpoFVNa8mFUnnQYYVQer6Uw4/YgXKSoCputxxF:GiNGUcjXrwFwu3J5FPwFUnnQYYU+YVsS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f4f5f782e09cb57aa25e5fd699d14bab9868e47c233afc03adb2d7b208eaefef
Files
-
f4f5f782e09cb57aa25e5fd699d14bab9868e47c233afc03adb2d7b208eaefef.exe windows:5 windows x86 arch:x86
fc179892df4949e2ae68a3c341a3bd4e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
closesocket
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowRgn
CharUpperBuffW
gdi32
TextOutA
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
OleRun
oleaut32
GetErrorInfo
comctl32
ord17
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 758KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 904KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 305KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps2 Size: 11.0MB - Virtual size: 11.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ