������C�qi!.ٲ�kV���@�Zc�Dyx�C^��҈�n{�ǟ�r���H����GWg��x.MJ�����Z�iD��`�Z��� bt�]!� �Sr39755{�zǸ�pZ���NMO�%~�-�"oui�h���?=q��P��L���y����9j� ��~�������d�Z��H�[�)~����&5���oNXx Wn�)j�$���1B��Ԉq�Og`�� ����گ�u@��k:�b���R^��g�E�4�]lw�a����P���Ҿ"䥦����� @�%�� ��b<�-�\M5�H#A�ejK*9$q��h�>�e7��G��ª� k�%���;Oc�K �^��$$4�������$�άX|O��������5�n� ��2p�D�Z�Z��U�@����ޔ�>�GV�nm�m1��L��*�ԐЇ�(�+p꾶�v����$���ЙĉC"�=�)�ޅ�J� �:͆�o�f�?\�T�F�)�K/��Z �5[�c&�S}9�A���� 0tcH)cPv(�C���c*gdVW{�� ��5���&3�PO���eo���큮s�UӮq�ә�֊E�g��27�r� |��j�`ۉ�ϒ%�_�(v��(��[!c�@���ņ����ħ��^K̳�`� �ؚ��ׄ�:� 3����I<^�9r�;�r�<�FQb~y�e|�BӠ,K��Ut����xc��[���~�6?ћ���)�C'�:�ܛ����U,UڭJnds^���m�w��3�N._���e���e��Re�ff1z�] QPϷ�סQ��p���u��qO�����_=?�|�� ��c(�x��&��9�o7�d��;ոj/�r�j� �9���<�A#)ȍ'CT;�I��6}�}N���ɠ�l+3r��g�4�y��L����W�6�KS�Xn���{�J�@O���L��r*֟�������4��� �4��10��pl?+����d�m�7����������ӥs�s7�dV۵����l�3Z�8ֳ����%��i��ʆi1A������H��m44~����)X��;���6�~�?���? ?ph(�[�W��� t�����1CŇ�(����S w�`P�MNu�hj����HULYsjh�`�:��8�F�VB�ӎ��K������ �I5�n�����Z�L���݅i�S�j���v���Ӭ���Q��d��*#� �M�E�')�>[ݳ\nAI��>�� "�_f�q�C��ly��53�S�t��gC�,3ߌ��:� �!o�&�Q�>��5y|ߘ t�|��߾�� �3O-��N���/����}�Ra*�5�ڗ�z�BϪئ{.!�n�5�F 4n3�Uk�SӮ��C"��R�KB]���n�s���K��6qt$9��:� �y匃��*�Q�*o.�������שz6�N��ABW����������Ď� ��ɮ�l�/���°���Xg���x>9�X�[�i|����Ȣ*�����H�0[_�{C!��#�1/�ï밡z՜����g6$ߓD�%��ήDQ�A(��_.�Fm���6�Qx[��{B������]��6�û�)2 ���R�*q�q��TE�Og��HgK�Xӯ �|y8˝�ёMf�ʬD���# ��k�.q>��"�*���o�q��yZ�Oۋ@"\�Y��Тx����i��z���qzO�J��e��yj%{��L@Z�����ltb����Uis,� 0�+4E���;% �Vf�&�V�ٯ5$��3{j�ݣO�L��Ϯ����*��V�o��(���`֔����g��؇��p������h9&����/6Ϻ}�z��jH�(�A���F�C1��ٳj��T��8.H(Yp}=���ۥ��������7�?Z�1F䛥�B���I�vv���7r�VW8��� �,�b�� �s�;d�����b���e.[�$�9���.M>(���C����)!���Ϫ����ߒ�q0���t'�n���x�9�ntfr���u~��zb�P��T�tI>� 7B�����M�W��ĭJH��}'�=�I� L �(^"��!_����Z��Kf��+��P������!g��Ŭ�$R��YT�,�����|%u���FF���l��݀�$QL¡����8*�֖/ܔ��j;hq����Y�r������ZJ'����H�&���K���.t�Ƚ#�"F�Iֿ����8�}KuL_ 2�Ɋ+�����UPu�⩹С �Dج�5�q*����s�a�Ex�ak,˜�� �������L�k���ʉ4Hr+v��X5a/����Lz�����t��a��]<�bJ���P���#JTo3��H���c�o�c�Ci>R^�?<�F��ƾ�� z�.�@�� �1�0�Z��Y ƥ��<AFz(���&@y�o]���dB��~9�DrPI@��4���'�1I�c���5���'��V��!�5��Z��L# 櫣s?�&���d��y�L'�> ����lyo���pʨ�[G�u++˺HeWE]�W�1=��=<�M�&�r\�-=8(�M�,�K� ʂ;ԕH^�F�.�y�L%�PDb�F>9rC�4�� H=7CCdS~瘆�gR �̏VK��jʨW�7�u9����[�Ɉ����1��t��y��&xPp���+@=P�&�oAj���D�#q��x��c�s\/ث};�Dԇ�K������E�&��������ES?�V$k�%fͷ�� ӈ�_��;�J��'���Mf��-w��)�f�B��(�p�1��*>>����Zg=�-���;I���6��'B|�&��>��aK�Y����h���hNұL6��e��B/�mx�oC��h8�jϔn�eKX;a�������O�R���x����R����G���@���d�F�[aj� �_��8����$_�d����֡�l����'��@a�+8���Td*����{�ا�X�����C T�!r@��Y��sp!�OW�@{�xT����z��&��1Cx�M��l����4��n�7���j'��h��I~�[�d
Static task
static1
Behavioral task
behavioral1
Sample
64276118697a50036e4f840ce951d172afa6d3baad4bcf0bebf61bc530896d24.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
64276118697a50036e4f840ce951d172afa6d3baad4bcf0bebf61bc530896d24.exe
Resource
win10v2004-20240426-en
General
-
Target
64276118697a50036e4f840ce951d172afa6d3baad4bcf0bebf61bc530896d24
-
Size
3.8MB
-
MD5
164274f19f2872c09136cf5a97de2d20
-
SHA1
efbb7171d1b280d26e839f177152bca291e9df4c
-
SHA256
64276118697a50036e4f840ce951d172afa6d3baad4bcf0bebf61bc530896d24
-
SHA512
cf97c0fe39d296a7fbd134bd0851a76e273e02fbb337c1890bfb8448a942359734a7a81f8193838b5be5a744adedf6c4f8001d277f1288e81507a261b3538967
-
SSDEEP
98304:apL2DqZnBouHqcD1TrGwYxOAe/ssDXcD1/9xT:aIiqc5vz4OAe/sqMD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 64276118697a50036e4f840ce951d172afa6d3baad4bcf0bebf61bc530896d24
Files
-
64276118697a50036e4f840ce951d172afa6d3baad4bcf0bebf61bc530896d24.exe windows:5 windows x86 arch:x86
8fb4c718ac44864740b1f52425555fa5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ord17
kernel32
GetACP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetActiveWindow
advapi32
RegCreateKeyExA
shell32
SHGetMalloc
ole32
CoCreateInstance
Exports
Exports
Sections
.text Size: - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 54KB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ