pU�ッ�.<U|�q��v'�_?���p�^גa6a���s(ɐc[�ԯßǧ���2���1�=q)���(_*�Y%��|��M��#�6D�zrM}�+�HqE�?������c� ���跗�q6hN�Օ���覹�7}�c���)g��kn���Vh]�ea��CB&�Q�>����+a^�Ug�e�S0�M�vɱ .VƠ9��#�|���+v,�-��3�'���L�F�yST��yˀ�X����9u����y}��)���-��m+M��c.�V�k�r�L �lzDɯ��"2C�rG�!��KD�Z�|���ZG�R�T����������7����JD�bH�O��������&ZH���z��(�>�m.���ƒ��g��t�/�e��9��1�K n�����?�>�L*���z�D�ngIV�2j�=L0��z�/�M���\&��Xjp�7��O��*�Z"tߛѬ/�������L����b��Ę��%'1�u�8ѐ�1lB|�ȴF|����㣚�NQNM��%�s��O$��y+G�{������0A�0��=3��F����:a+���ҭ2��xl��ܑ*��z���F���='�T������z���o=�� ˨8���yj '_7�J��qM V��r�����hs<n1"X߳x- 1l虛(��ਪkh�DAޛ3����gϸ�70�<��Э����N���H���k�$��x~��C��G`.�.`�S��-��G7�oZ��=��9���L�-9"���~��3{�$vʃ�w���^��[�m���s2ec�%j�^�C�[�K�`�A=�أ�AtGMV����{�p�Q�᧙<r��A����F2�� .�r$�k� N��C�W��v!w2�.��l�v^�R:R���M�"2�\GOW�HԈտ�L"@O� �f��(��`�>r����Z�%���c��b��I~����;s�XIc櫖nNN�t2�����|�5՟#�X�h]�=� '���T�\�����+� ���oJ�9�Z��l͋z��c��I���ɟ��U9��wH֑<>Ө�FM��Ub��â��Q2W��$s9f�24Ṽ��-8�q��w!XV���Eշ=��mŊ��Јv���.G}�.��H,D��pJ9*ʵ�܅�]����^��h>S������s�$����f9uD��"�д�&lBMu��ƍ`�F4�W�1�m�^�d�(g&������E�5�N�c��i�\�8Y�w�A����[X)<h6ܝ�8��_l�d(@�*얥8>2��;�ޚ���b�Y8��0��d��[�UY�ap�~q�hH+��Pd��˟����8#�@��~'1(}��A�w�6Lz9�t{"3�#����|=����%O��X>Zi��~�� w�LR�ڜ�X��9]���&m�ڂ��Q���Om�$� M�('wN6A'�/?�Y��J��[D�i�Tp �?5q�@�oo��Ǧ��^G�lw�q�}7ڊ!=H1�_����� �M��{��:!x�w@��pm���������O��}����}N����a=�a�e�r�l��!ޒ��v��U7�dU%[p���S��n�͢��'It��v.��~!��j ����WB���n[%�h�~-��*,+o�P�/W��<^l�@.>a�m��8�'�ƾ�=+T7i����N��ކZx�O�]d<���mv07G��+2S��xDžKoJˎ����n�9w{-�@�5S��Ñ��1*N�� U9!6o���UC��Z=�wES��ݛ��0���y(�4���Q��r�>εg��s-��<�:T�\��c�����U�����-`�i�.b=�CZ+{�vV��xU.��{C�2"u@j,�TNJ�u����u�v�����.��6,-����:�L �������wi/��8Z��6&�ܸ�����.$��\ۗuLy�?�~=�bI�3ڳV�Y��(u�M[{��Z�~ �Ն�ۖW^S�'�In����`�^�dj�ڲO�{A,)j���sI-����fZ�~;z|���'ߌ~�����KT �N�.щK��Eq�u�D�����QQq�*�>�W~��R�.�U���Dz�}��P��Z��>g$��؇���]"�~�Z�,�g272Dib#�����J����$��o綾���$���y5��U�N�C�rW�IN ,� 3��}��:kڷ8e��;�`e�'e�_��nj��[K��h�}&.�ʟ������ݒt��E։���H�;Z<3Qb:�F(Jk�z���4���K�aI��&� V� �vj��Y����{���'�"Y����k��t[��v�H�H�0�Rz'&��u*Tǃ9�¦�^'���N]��8LZD�2Jz�6����� ��sw�D�J�f�z������@�)A���p�����c�wzS���� ?u�mjMX`�ʝ:�F�֬�u��̢86d��%��4�H&��_H+�3\�������e4�x��H�������#�ﳐ�F[,�,�O�?G����d 2b�|�ϝ�3&�`�f}���V�\��B�SF����=�:���`�n@c�e0?��-R9��s�r*x:� .s�Ju�D lݫ�xd+(cˀ�� �v�|-���K������#�;���&��G��S�p��-�6���kR��hE�!�z��4�̞s��'��/ت�@��u�-e�иd3w¿ESXI����5O�'Q�歼d.����n���K۱�/*$����&gI���a$��6�e YӃŖ]�$Rj<G��X���/��TM��x����f�c����9�w[_���1�q�_�?sA��0J����G�n����Z^��J���o�-k�T���b�Y#�]IB�^ט����Am'��k��h�s���ce�UW��llVT��Ƿ����!�)hZ)��^�ǵ���z��!�v�k�%J�EFª�3w�6tX�W7���S���)w[���g��7����5�����������8�?�1����<�UX�̜lK/n4:�$l��Q �����f�M����(N��p�4WQ�h3���aoЊb����Ƶ�#�IT�u1OQ4�(�Z��Ҍ��@x y��B*T=F<(a�3
Static task
static1
Behavioral task
behavioral1
Sample
6dc8f91bbd097068e4a858392c9d28bd73c9d7d8cde05540d297cbccbf4aa4e7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6dc8f91bbd097068e4a858392c9d28bd73c9d7d8cde05540d297cbccbf4aa4e7.exe
Resource
win10v2004-20240508-en
General
-
Target
6dc8f91bbd097068e4a858392c9d28bd73c9d7d8cde05540d297cbccbf4aa4e7
-
Size
3.8MB
-
MD5
92ecee43a1a0fa3c9741359e4c398778
-
SHA1
817087be735b906949b8a7c415a729630308a6b8
-
SHA256
6dc8f91bbd097068e4a858392c9d28bd73c9d7d8cde05540d297cbccbf4aa4e7
-
SHA512
84b27a718846027a557b76a485213a7f0b5b271ac6ea48c49ec1cb2ec58b4cfc0681e9819d383be7e8d4059849b89aa22288e123c793bb85d261e79e3da87598
-
SSDEEP
49152:a0Ee5wOyvqMeI9sg9BMXaxHMqufzyAaLtuaoj43juBQGQJTwDQ1EWpZE4k:a0rO//OgcKBuJsC2JoQRpZhk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6dc8f91bbd097068e4a858392c9d28bd73c9d7d8cde05540d297cbccbf4aa4e7
Files
-
6dc8f91bbd097068e4a858392c9d28bd73c9d7d8cde05540d297cbccbf4aa4e7.exe windows:5 windows x86 arch:x86
314ef74e7883df972658f9c3f46505d2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ord17
kernel32
TlsAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetFocus
comdlg32
GetOpenFileNameA
advapi32
FreeSid
ole32
CoUninitialize
Exports
Exports
Sections
.text Size: - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 180KB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ