��Ti�de��Q,5�~P �Ω�m�؟u �����_�G��ز��v�}��^���j��}��(�#:��c��t��z��g;/�pR>��( R2�C$+�,X � �%ݧ��"��."�ž}��n��\��f8.i���Z��_��HI #4H2��4�0{��T�����6��cI�;\n�������:�L�V�ŤTE��N{�@,U� =_B�?q���.R5����x�K;ɯ��o#/nR������+���`����Zj����|�9��=!�0ќ{�ש;��*#~.]E\��py[�u��!�&�Bj�NI��J��+@�ڮ+�8��!�-c3<���D2"e��٪=������������ͫU��&��ZYu��e�� S�D�L��]n&4��3��vjl�z��8��J�5�����)�����'��h�?��V�L���"^�R�&c�n���ˢ���0���6�9»He���~2"�=}�s�A�$�+��y�Ƥb��������^���z�B�����wxs[�[%NC��8{�bd,y<���=�우@?ߴ��mt�@[)רּ�67�+��cu"o�|� �S ��%���+������`,^>Oz83׳� ͠�t^�35��2��y����3��%�>�TT:�,���m ~!b��j��2�Ű�]�g[w���� ߋ�%Z��G�h.�0��,�J�>O����n��e_:�(�d+��֑��z,1�".}����)���� ���g�� �3� ��D��� 0!��P�]x�|���6��6��Lm���l���X�(��Ρ_�4����;�+��yr&�!] A�O3�f%�{���5�����fb/��*-���eHV$/r�!3N����3����&˺��*k���÷��-k�S�����ئ�H��F�$N���/�u�����K��i5����E�h�j���b�0w��7�M4�H�M?x�UװO�y�o�<�]�4H�������f�[K�?ƛ;CZr�Y���7�^�Q�澖��j�{5�������n����^v���<95��,���sO\����m�e?�݁Z i>U�o�!B���\�L����EN&��y|������<&��o���+��8/�xH�r��� ���c��JF���?,��n+�Q���&/��/���o�[tꊋ���c�N9pC�-Y����3*�����j��G>�.P ز��aE|��zP�zR�bJ �e���ӥ\r�J���i��"�:-� �_��!�M9{8t�V��]dP7J��h4�RawTp�M��4 ��%,��weQ���[�i] 8�щ��E:�b�Y���%�� 0�����_�������|�U�����T�ي�[GK��}�!ҕ z�"7������sb�gNx�����p6���}{�Me���5���n��G�LQ�����1t#���ͪ�8�x�0�.�>��fV��I�ǃՋ\nf�_{z $c�&\P�Cx�&�dZ�\��\&I���ѣda��"���h3D, �̻��B�-Uq��K>|bQJj�>%�@���,�� ^s߈� ��zŇ�F�����d^ŵ�g�B�- �E�P%W\����!>�:;[2o��L��*�E46ќ�6.�5��,�|F�~�X`���"���xF��z�.p%y%�����H�qeFd'�����?��� �����)��;��T|#;�4e��2�*�� ��ϋ� 7^(ķA�^r���\U �P�(�M� !���dLA�q_�e�ף�WI3l���G��h�Ü���N�j�����w`���x#��Ѣ6*BĠ\��L���G���'�MI�R��`R �# � MQ}��-I1�;[�� �����*^D�L�B��}���5��� eN.{�`��l���Ձ�߂���li�-#2?s��BҨك����'����c�����S��%�EP�=y�5����+�b�_/e�Ԇ���R��������r"NRJ?K M�A�M3\Yd��9N�?_���k.R��r� ����&�@L_�f�3i�ci���(2�Ҳ�����xg�e�]��`5 �� v_wʽ������K��%��1D�K���'L��Q����&p�~LS���ٴF�b��������|�ë��Z��))�v�3�����{u�|��CNu��+|�Vi� �T֟�>���B�c{h�J�m�P�Yw"���ڥm��E�����G�� 3_����b���0�y��[�<�*��$�P�=q��Wb����b���<�s� ��W��p�ۅ�̅f�q��KM��$�0�p�Z�b��Ϡ���d8v�%�GXc����4-���EAo�z��J�3���EC�;��B���6���X7�bT�W6Q��/����E� �� ����_Z Ej�!y�j�8!l��H���/'�˞L�/g�+}��A|����D�Vy�S��HW��609�iI�_��߬s,�'O�Q�IZ[�~������W�M�ȲC�E����SX���o�a����3�-���u�թQ+:H mN8�Y�ۛ���2���ޙR�s����.]k�*l��RBe)��acM������ZI�����}4�_���Rx�}E�����1��g���&�#�9Ce^d��ZI�h T��c�Z���E(t^i�E�[R����P�����2B��ci��W.rK����O��Zpn����;;U"n�L�O�9�d��&^��ؿ��,;�)?,����6�%\�h�a����*3e�=3�т�:aW���H�ݏ�xE>�N�3�i�A�D�W�XC�r�^Җ8b�xҎ��E��B��d����I�j>���L��p���ەy�')��i�KH�1+ �l|[���|L'{>,�t���}�����������[��v����v�w��=��¯/�4��C�5���Q�a�}w���Y�/��� ,�I�8�x��a�%w�%%��-��_IyF�r)U����Rw1��Xp�V�j R���6�ی��z&/��l� �YK�WURY�h��p�Ev��ʚ�w���1�hϤ��t�a���
Static task
static1
Behavioral task
behavioral1
Sample
793f2ab70018ae21eefe1edf57f2bec4f603580321609127003cdce55a73b2b5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
793f2ab70018ae21eefe1edf57f2bec4f603580321609127003cdce55a73b2b5.exe
Resource
win10v2004-20240508-en
General
-
Target
793f2ab70018ae21eefe1edf57f2bec4f603580321609127003cdce55a73b2b5
-
Size
9.2MB
-
MD5
c3639315e9c2da5c398e762fb36e0a4c
-
SHA1
8e797f6a592336a47234215f08f590e20da1cacb
-
SHA256
793f2ab70018ae21eefe1edf57f2bec4f603580321609127003cdce55a73b2b5
-
SHA512
3ccaf68b7638a55f11e596ca37057bc6f7bd5667a5387825d822c1bfcf2cae3a8e4ffa97f82741d306eb8b23e1da95d88ed75ee952fcb4a413f95b716fabc044
-
SSDEEP
196608:oW+7p2GtkGjOtwzF4CmYfmS5RiebIYV9KKMAa8n+ocC6g6v66666ES66666E6kD7:v+7prWWC1S1xV9EAh+ocC6g6v66666ES
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 793f2ab70018ae21eefe1edf57f2bec4f603580321609127003cdce55a73b2b5
Files
-
793f2ab70018ae21eefe1edf57f2bec4f603580321609127003cdce55a73b2b5.exe windows:5 windows x86 arch:x86
ed799629564001c53964e1b8495e875d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
midiStreamOut
ws2_32
WSAAsyncSelect
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ClientToScreen
CharUpperBuffW
gdi32
LineTo
msimg32
GradientFill
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
CoGetClassObject
oleaut32
SysAllocStringLen
comctl32
ImageList_GetIcon
oledlg
ord8
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 412KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.'yc Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vkp Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vnP Size: 9.2MB - Virtual size: 9.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ