5<_�5U�_ �j�J~�9������� �w=���dy��B;�����l{�+���F�/���1�l �U 6��c�V^�N�9 u�6cn'���)t4:��#���PM��z�"ؾ������cNT���W?3�l�<�~�1C�ɴ*��!��~�\_�5d�X��m����D_:5k6{J-�EМ�<��XQ�jj_�{Ak�ռ�e{/� �����2��0�4�� ��X�]������766Iɫ�x���b9���w� G�B�&��i����T��ue�$q��t=����5b�瘝���IzM���D4��h4L^US���N@3���g�~%��S�M��:�l�9(S:���ܪ�ܾO�{ӥ�ۨ7WN嵼 ���I��B�v\I��ݯ3\�m%KQ���U���"�U�?�Z���@� �I�[E�2"��a�*���7e�R*�ũ��K<i���"|��T\ƕ�W]���S�@hy�E��}徊,P���Ai��^�n�쥳���K�N?�y���]���_Ca���4�'����ǜpc���ϦL�,���f>�7Br yK������2��s�d��r ���S�������#��H��4�+թ� g]���$o7wx��Q��M����bܰ�5u�d#IJi� �XN䲾���'ѐ����N7(�j���?���D�,�r��eJ�xd�{e�nj���%v��!6 �lK"1�x ��I����y����&i�O�M2J�f��.h�I!q��m3㿍�l�T����4.�wf4$�}�G�F�������3t�h?9�m<U.�|zk ��ըJz)��M`��ax�-9���%�G��j�����5ItP��+�U����J��?�&��R�/A@,r9vx�R%k���� ��dK a���.�3�R*��K��h�3tn����� {�ez���E�d�q[G%F�hn�|!qe���Q��W���`q�@7 � k(���%�s���f�4Ճm}�6�����f�����z�`���$�H����@|S�� ���m�����}��?ZR��T����R��؆�n�o��i�7��?D �����%&�'� �O��/䥥��iեGC�{��� S`�h3� �f�,���s�m�Z(Ts�yC6���yEhd�^#��%k���ʭ�y�#<��ĭ�ReKc��� p�HݧW�"�i_ZI}q3����V�.��j�G&��0Zמ>�uYO���;�'�s�PT�y��E[�z��*�k�JՁ��������GZ��$�q�( ^��N�#������L���j�a�2r������3��Ҋme��K���`PJ=�� ���S�g7v���N�G��d��N�!Gt% %���7���`��4���s#���7<�ԓ���1䋢2K44`���Z���~h��� �n�3�ŭ��ж-Y��"X7��N�"OW)����c)_����%�2Q����!(3���POc^K�~R��������`�0��fy1/�/"�d́�}�F|wEg��vY��3>�H��ԏ�\�q�V�FL�ɜ���)CrA�H;�>K�?�6����&�>�`jm6��j䳣���.��䗢��~��rL~Z���i�dr� \h�ː<RH�j:���D4\��L����}r����%O����T�"dyd������{��,�(��yAo�u��vJ���!���F�+w���3R:���)�8�"�rhyԌ���O�u�+@�*v|+I��\4�}C�b�`�����{�t�����%�>˴ARJ�� �n�.�����r:��*�� -��m2���|��U��M*���73�Ȃ����U�:��E,z9w�x����)�i�����\R}���#O�l a��ۯ�Z4qM�<6����06GȔ4l�8���?����>dd���b5=D9`�JeRɏq��{���[҅o~d_\]8T�X"�S�Ë� ���z�"�9-yR�����]��`fb��$/����z����2'�����>�-�o�jڭ�N+�\�s��t���ۑc5z�%%;X�y{s�v��2�G}��]�Q>%��)�P�Y�LZ���̈�tz�S,��o�Sx�sS���� c$��@�1JI; �N�����V)���N q?���a9O�����"QD�W����̭���[�(��Pr�%F�t9�M�f#��� �o�7�3 n]���� wQ�Qi�K�F��%�ݓ��.����(w�k>��ئF ����Ý�q�'JF�rG��_�v6���Jc��\kغÕ����Ы2r��h+�(�^��lr��0ǔ:Nn7� ��=Y��oZ�Y�f�e5}۹��\��M���w��կS=]�F����M4d9��g����5������,�����g�K���Khs n��ΰ��7���Le/�ʗC� ���G(���=E�*<�Q�ؖm�/�ڔ�)G�����m��8a+R2DA$�8�/��҉�)���d @=c���i�o��U7��>ȶ,\$8��"1}�������BW̏�A$yA�$�Gt�=��uԉ"K���h_�xa�R]�y\!u�q��oD�T���TjW�vʟ����[L��[h���u�z\ pa��o��(S`��_[2r<�,�"�@L��z�q��7'W d��PX���C=��53^T�����++����� �a��<%���/�Z���΄����}O�9�.��&r�;��dg������ =\���l!�����s�����6���<ų9��Y���q���K�I��P�Ҥ����S�X�t6e.�y+��`Ctf�����N�������E){.�;J{�B'8��ݯ����$\�v���,"�rݤ�6J~��D��3���`��:}�ߩB=��U���8�KRG5,� R�k15��>O��.�U��][7��A�Z'�\�����u���}��[��A�$* B�������lm��p|���(;uP� =�X��6�r�Ӽy$3����G���-��S6ژ�Ā˾��[M��YC~||峾'������� �aM�7-ћMeY���LIQ��ə��e��N�Y:Ix�>�D۪����,���O�����U�{q�=܁(���
Static task
static1
Behavioral task
behavioral1
Sample
5831198fde679547dd610b04a0594ae75de884ab84fc276a604fcf1f231fa4b0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5831198fde679547dd610b04a0594ae75de884ab84fc276a604fcf1f231fa4b0.exe
Resource
win10v2004-20240426-en
General
-
Target
5831198fde679547dd610b04a0594ae75de884ab84fc276a604fcf1f231fa4b0
-
Size
7.5MB
-
MD5
2ae120b5f603efba346bab29fb68509e
-
SHA1
d880075fbe65f1239e2a39ed8e63a32b19940851
-
SHA256
5831198fde679547dd610b04a0594ae75de884ab84fc276a604fcf1f231fa4b0
-
SHA512
d9994ecf6ac8ab46c72040b2530603d7ec602d71f667cacd8fc6a9ae0b9892f82d95747a06bb9a1e9885f0cbd5bbe734f2a8608fabb7f17470d6d6ebf0b2e7eb
-
SSDEEP
196608:bPpFm9WK95nta+HjzCk29lpiUyQ5eCoQQ:rpWdta+DOlXiXiedR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5831198fde679547dd610b04a0594ae75de884ab84fc276a604fcf1f231fa4b0
Files
-
5831198fde679547dd610b04a0594ae75de884ab84fc276a604fcf1f231fa4b0.exe windows:5 windows x86 arch:x86
d27b76b6bf59bcbad7e8d50ac04031ca
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SetErrorInfo
advapi32
DeleteService
user32
EnableMenuItem
kernel32
OpenThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
GetEnhMetaFileDescriptionA
version
GetFileVersionInfoA
ole32
ReleaseStgMedium
comctl32
ImageList_SetIconSize
urlmon
URLDownloadToFileA
shell32
SHGetSpecialFolderLocation
wsock32
getservbyname
winmm
timeGetTime
netapi32
Netbios
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 50KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 396B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ