wlZ�!�s3�:�ƨ��huA�VȈ��lb�1�(���m<�Mo�I�#}c���I6�Q8"COu����43F��>��ևQ/>�C�K�{t^������^�Hj���ߑ���=4��37���H�. ы�S#�ݵ�>�b+ɡ�W��Y��@��\�K�{�U|�=)����J����J�:V���ug�*N��Ϝ } �Z�au�kUv���� �_��X�w��Aт����t^&-�y�8u�r_�/˘�ȿ���._oe�'j^H�d�z`�{J��љ�o=.��v���d>z��9�T���H0���pU��ø}w��/�rZ\���g�#�U����������|iW�.{�-J2��p7H2vl�KQaW.4?N�������[��g�t�lQT~UN��ٹ-��e�ґ��p��F��KRe�K�Ġ����r�?Ok���a�G����ĨX�M�d��V���c?w��Q��, �a�w�uDžw�/j���%�`1b��dll(w&������=�4A���чew�� ]Y���X?���w���깥���Y�"r>�<��~c���[Q��U��d��XI����?��3���l�6���Q�y�����V�[��[�Z�Ēd=4_{��\M;HT���p��6�Tauo�d!�[����NY��*)S� jɩ��/�\zl ����VK�ƶ�t�4/M����zoٔ�!r��$��!,9��~��X���݆�,|���� �N�N�f����_.��R.��j�jJ���đF9: �%|�%>^��N*��6�=:�^����( [5�zΞ2ˠ�<��F�"�=��������f:�0�9�w�)��=���% Rc�[�Q��on4�QG�,s�VA� �Y��/FnZ��WBS]�ݔ�ڈĞ �1�v&� �"�`y:*�B\d�F���$�#S�B�bz��9�ߪF5��ш�{�Ͷ��)��ӊX��0�>2rjm�jZ�9�)e��[�z�9�Lˑ�@�ZR,G�SQ`��u6s�Je�;����������5�q3E�B��|�r�[H �où����+��:.1p�.�t�o���a��ǎ���sh���d9E����O�����+���ukW�)�!�`��ߢ��>�kL����P*[vO0�&Wl��M����X�즛<b���dM�n���1���-$�tg��6�VZ�� ��0�kW�H81;��s n]h^�_�j���F�leP7��XN䞄����W�dG+�����������愸�ٞ�����ȩ�%ɼB�3�P<���}4�&@w�wj��00�[� [��b]�r=�"d-H�lA�$q.W��'���x�S�6 ���qL��7i;����>�m��mI�mqP��5ڷ��l��@�Ǚ�����ݴ1��I�^�Q��~3#�^�9�HA����vKOYg�iXm�9�#������� X�Nl/ ��]:/e�z���#S��"!H3P�h���� J�=�h �_C˪�I��5��Y6LLj �2��i%c}o� ' O��%�AFg��(���"D��a>�;���2u~� ֫^�(��#mi2><�|��2?_�\CA�UG�t]��?,͝��gS����_��f��$;���}%=��q��hA$K��fv"�@�5���6+���W�4k�m[�;&��@c�x�MwBo�3p\��(&�Aw� zɘ�������$Ď�����,���"I�G���t;"9`�{�s��5�FR�ˁ ��@�WV�x��8�N@6�7����T�%�Q��*M������:�N���R_ G]dc�������*�9�ܖwMG����O��ùT���&���,�L���[��`7��6�m+j��(4m�����>�'슏�t����a��|�E�OMA�)�I��J����]�0U~#�.79(Łך�Y��k_h���rwz4�|�ܷ���`[V%5(�!F~�q�!8'S�a�����&0��8l��/]��U�7�*����|o�O4T0���X{�lP�r��[?,mp%R duߐ���_�_�˧B�O���\^R%�G�t~�3�֎�{/ ��4�^"(�&��d9 2/jr��V B��8�U1�-6�/��]5ò{�)~��" �Bo�lM�n�� �4J4�[6)�D���}[7��#^���r������IF�0�*?4���ǖ]��Kf�NC}�2ɲ�+� /D�`6zY��T6�$�w�V5�}��s��T���]L+���~��*��X��a�T ���.��j�ڝ�tEz\�h���Y��, ��N"�i]�g����D�b<-lI���*��l��3ԋ�l"ˍd��`�i���uke:;���$};`���#���P�?bA=���y��`�������q�cx������Z4��C m5��>Z%��mOA���Hܨq����MS��e4�Qw�fC����mtz|A���CC��n�9v��}�����N��D��ΐ�.B�S�5<w,���C����y"����Lj����p�e-.K|T�v�B� 0�u҄�����y�mG�ȶ���k�����po2�'"0�5̵��PH~�ǓqN�`����gZAD�y��ju�1���W�&��� uK6K����R0�6ݚ>5�#�.i���B�(���%���w����v�v')1���^@q���m�[ BP����*�����XfN���v�`����H�`�f��tn9�c9��1J%e*2��!G�>&����k��:O0��nU��T9��,jH��8��D�o�#�0�(�n��<c %��lm/`��c�ٕʳ�W���f�%���Ҵ���6�?,��(x����O=L���溨~�z����uĘ��Gf����Īdw�9{�}SPٔ�|U�%sU�����B�v��b�\xg�o����f)�����T<���?�L�${����1��g������� �m�a4�2�c+KT������#�H��]���g{��b*�8� �j]u���+�8R�Eq�5HdF9��.�\�������ڪ��l����Ո�~�< ��3���Mۊ�c�[i~�x�
Static task
static1
Behavioral task
behavioral1
Sample
4f6e1fd36209ac8669bf1fe7b49cae4acfd46a7a14dbe9a44c2f200e6dce5973.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4f6e1fd36209ac8669bf1fe7b49cae4acfd46a7a14dbe9a44c2f200e6dce5973.exe
Resource
win10v2004-20240226-en
General
-
Target
4f6e1fd36209ac8669bf1fe7b49cae4acfd46a7a14dbe9a44c2f200e6dce5973
-
Size
12.5MB
-
MD5
bf5cba8e39ae8f7b97271f78e50086b5
-
SHA1
c5b4072baf297a94b4e5b58908d45bebb740aa2d
-
SHA256
4f6e1fd36209ac8669bf1fe7b49cae4acfd46a7a14dbe9a44c2f200e6dce5973
-
SHA512
fa20d3355b823008785c26dbb3d41349065c70d72eab809a6753c672fef039327f1a0a63aa463c69f8e9e8919b82b6493106aaf62b59aa6dbf18675127463593
-
SSDEEP
393216:+pZ3Hq6lH+Eh6SCuKWwFPN8jTOqjhclW1lD5Cz8X:Ahlz/0N8Oq8W13Czu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4f6e1fd36209ac8669bf1fe7b49cae4acfd46a7a14dbe9a44c2f200e6dce5973
Files
-
4f6e1fd36209ac8669bf1fe7b49cae4acfd46a7a14dbe9a44c2f200e6dce5973.exe windows:5 windows x86 arch:x86
102aecd6bb840a2370c8356cdbcc2329
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyAcceleratorTable
CharUpperBuffW
gdi32
Escape
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ord17
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 647KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 328KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.j K Size: - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.1Sj Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.j{] Size: 12.4MB - Virtual size: 12.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 60KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ