qf\Xv��e�;k���[JQ��9��,BV\�d'1��T�����j�^�uC��y��&ę��؟.�H��� �me@Aa93H1��@\�����#�� ��7��Be����E��c9��e��ȗ��w�T=T.����7VV�}��-�m��qxQ��L2�1w[��=�6��2��w�B�>I�70x�ו����(:z��a�t�Yė���S�@H ��="fL��b�&C&�C��M����/X��̱Z5T���� ����L�{KF0Sz�d�U���-����6�39v�`�^�@��*;��S-��^PY���л�Hw�:1 Q�ظv�p�f�i��d�Y�dI��B '���G6k��s�G�����5�m�:��mE3��R+�/;=�N��ݬz8�mF��*���E����������]6^�Ps�%8��Y寓Me�F��r �8�:nLĺ����k����w ��uk����G(����ϖIO���9){�cה���"_�?�(���/�z�:�8�����&x�] �C��{q�^�=�U-P M<���:�67>��c��)�S�}�mrQ5(�ȯB����)È驘��§.��v6�}�6��2qIv��<���>H������/���!�;�M���;L��VS�/�XX� ��/r���!k���P�/s�h�Q.��6N2�6����A�B�[=-�H*6��a}���rs]ۜ���������1�T�>Vo:8�����&s�8z%��d���VXb��J-e�5Kg���{ʕ�%y�-�2�3�6[�J�V��.@��l�JiA;�wGCv|a�¢��s�S�Q<�1�s9��dmړ�"���@�������mD��ă5�Th��K�4�.t�B��:�����J��ݽ]����W��[�rC*�m">eR������ī�|�����Oze����/����Q/\�\�h3L<@�z���(����Pr�����oS��a�M�ł��݆���j��K{�,�Nf��A�ד�3Q>Y1��1��� �e�%0#5=��Ը��}<~.��@z��=�)�I?�J>`ա\���T|g5��b���i���'��ВKhN~z�0tۯ ZWd1�:���3����G=%�L�h���d�ߔ����ѧA�����8OE��G�-�IQ�(�x��x����C����ԫg����m�C��~���`����R~����[�l=��Ů����G���3�27�.z6@�yb��]l@�zc1�+����-ɵ����"t�P�固�K`` J'W�I�-���?��R���0(O��^c9��͊�@�T� �� �ٸ��Y�Lc����(��$;����ۄ���ڤ1�7�u��-�2h3� i>y^F��U�5��+3o�>fO�%#���[�S<e�2����6����ʑ!�(��!�.�=�β�m�3(~GTԋ��+;t�oU���+��$$��4D���[�ߞ�51�J�i���7I�,����cX8��?��4j�: B��c#Z�5�C���-'&4_��@ ]ġ����i��V���h���l�~������"�#6?���{b�<a��>{uik�M?xI�|�ec����g�����vc /��5R `��y遡bO�� ���Yf)R���J���^��.��Jڻ����+�& ���xY�2�QUw��Q�rӔ%.����(��,9��X��nnl��bA2"���9�ۃ�_�� ���__c|&N,j�6x}�>?5�F��8NQ�Z#�I<'�6J:=5�F�S�g Gq�́��jn��d�>EUʕ��{'�/��cr�E�P�f[ �a��J&D�D�N�0]~m��J�����L���V�`��-5��uI:�����Ж`�9����ܲ�6踧��ԥ| z�_]=�0w��8���8ކ�1���b%/mneN 6�z�;����q�Z��w������,W���6�|*�����&��� &�hUG���%��yM〧��Ks��^�`Uv��\�)*����-����d��v���j�~��Tj>,�#�ĭ�rr�$7G���w�z����ݷ|P���g�^��K-��9��1c�e�s�V���j�m�V�>->R�~,H����� əmS��L��vU��"&�|�g�78&��j��XTL2V\{�;�r}sW̾k@c�����z��nw��?�Bu���32�5�V���-R& �d�����.N����ٙ��NG}�/��T������ �������⊈���v��]�ěخ���~a��N�5v�宠�0�Ɩ���6�R}9�]m����{U�� s����C����J̀�0�JZ&��W�fEF1K��.x�����2����R4��l<�G�*�8��V ?�E�J }(���f�_6���5��)��[{�l�uR�)3yTn����Pk\��|\�$�d��8���~�`���6z#��K�(%L��c.&� U=a���&p�E4�#���v�p%b��5KD����~8�w%ҏn��H�n�-mo����s� q���p�B�>6�4����N���b�p�w s���P��M3�C��zs)�xy�K!�ѥX�~o�����5K_4�����5�v7Y�[����/ ���0��P����.`���:�R���w����4�~�y3:Ic QC�{� DE~�aUg@�� U��֙cX�`��H/̭�/��Ohr-��G"�"&�YU��B� �RmndC�(��=!�qj�ie�w-3u�Gt`k2A5f�?�k<���ݱ��U�<zտ�����������)����FV���Υb�ǃḑ�&]��.\�;*���5�`D����v47Ŀ��ҳ�H8N���TJc ����2�F�%[(a.��,����oӰA�z���ȓt{1Y����P����!��S���r�k�3�O��x&��BkX�I��t��Kb���l�q�H]n/�������3B�� �<j�1��g ,�%'nH�G�ia����L#s#.��y4{�G�ܧ�&b��JQ��C�ICܪ��:��Dc�~յ���
Static task
static1
Behavioral task
behavioral1
Sample
4b0b70b3760bfcef297fd452ca82e4d9f3456b78396f25919b6d6322109f912b.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4b0b70b3760bfcef297fd452ca82e4d9f3456b78396f25919b6d6322109f912b.exe
Resource
win10v2004-20240508-en
General
-
Target
4b0b70b3760bfcef297fd452ca82e4d9f3456b78396f25919b6d6322109f912b
-
Size
508KB
-
MD5
325e7eacd2c945b96d691a4d983c2abc
-
SHA1
4e3d35a4bc8c41a563f27b2a8ff550fe8aa02091
-
SHA256
4b0b70b3760bfcef297fd452ca82e4d9f3456b78396f25919b6d6322109f912b
-
SHA512
a5dab33d0ea08482b06683d5190c4d6e51de23c16c0cb4c618830b408a3084dc858957136b3113e583e424074a6d3aa8050326391d35bd8c9fb29f8fcd86651f
-
SSDEEP
6144:Q3yxKYy2EyGFPpAmPjk/ym6UUsj/1BMuiBB4pcyGRE91UiKAE16myt2T3Z:QiwY9EUgjYymHzj/1BMtWhGREH2D6mb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b0b70b3760bfcef297fd452ca82e4d9f3456b78396f25919b6d6322109f912b
Files
-
4b0b70b3760bfcef297fd452ca82e4d9f3456b78396f25919b6d6322109f912b.exe windows:5 windows x86 arch:x86
be0011d54c11170ddf6bd20b20baa2a3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
GetCurrentProcessId
FindNextFileA
MultiByteToWideChar
DeleteFileA
LoadLibraryA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FindFirstFileA
FindClose
CreateToolhelp32Snapshot
Process32First
Process32Next
GetProcessHeap
HeapAlloc
HeapFree
GetTickCount
Sleep
GetCurrentProcess
GetLastError
GetNativeSystemInfo
TerminateProcess
WaitForSingleObject
WideCharToMultiByte
CloseHandle
GetModuleHandleA
GetProcAddress
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
HeapReAlloc
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
LCMapStringA
LCMapStringW
EnterCriticalSection
LeaveCriticalSection
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
GetStartupInfoA
SetStdHandle
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
comdlg32
GetOpenFileNameA
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
EnumServicesStatusExA
DeleteService
LockServiceDatabase
ChangeServiceConfigA
UnlockServiceDatabase
EnumDependentServicesA
ControlService
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
StartServiceA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
ole32
CoInitialize
CoUninitialize
psapi
EnumProcessModules
GetModuleFileNameExA
Exports
Exports
Sections
.text Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 231KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 349KB - Virtual size: 349KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 157KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ