]@D��tw�M�\�~{������8� T�X�c�D���d�+�z�h����$cnY�(z�~m�3G o�!,��D����G��avV �uRgOi;:���Pi|T���"��1���MQ�e��s��`��&&��yeI���g+��/XT\����tb6��k�pV��T#����ZMi܅�_������#�G�╣��E�f��� ]��ϚW}�a�|9>�l��u�KY��*J� RQ���1oF�4r�}M�+V�)����;��xIO���Ha�ԓ�XM<>B�?C��Zsᚖꩳ�d�f�uE(��\�����_VK|��F�X�]h��5˶��Gď;��F���?v�%7mrn�G������h=h �76�K>��Y�-��fD���$"n0s��/~�J�IP D�s�̝%|ۨ�^�� ��1�y�<�1�6�/"�f�2|*Z:Er�f_4�x��8(���IoLv��i� �l���{N(�.��ڸ�����o�I�wL3 d���*�;�����G���6���rM�M �o�5��������D 8B��[��Si?a�,��GI�b�F�����<;o�\��������>�l�7+ ��i����Tc|�pۛ�*��3��7���rc�{A��j�6��-�R �vނ�]8/�8��ɚ\}��q~�W`}IՓ�_C�r�AB#��g�M���������kO����A��M4n�ds�"����aa㬡�Lɵ�~d��-5I<|��1��a#�J�'���:��k�\�gc %�H���bn)�I����R���Z7KB[�3��'��Ե�^�;���q:w銟��P������a2�������CQ�?2�{���� ^'� !s���;�����C&�mg[��F�f��5%���A,' jy���L��9F�pmF�B6`(*��Ex?�����:~��9����i-��5�S$�����Mj��Ӓ41Ԝl}����~jP 6\�ٲ];ʐNe��%ő?��N[bfO3��s��>gk7�N�(���;ڳ%/�F�}�Bu����K��7�}}����\a�Ώ�����N���=��ДQo������N�{�`��O�A2��o���A�+��.�����P;��+�ܝl��`GO�����-���d����([��$u�>��e�K5m�e� ���ɩ�᮳<��`vo�6e��|�PigC��0�Un�֙��'����[�ߺ=)��|��H1p��V�^&[��4I�ʿ�xlL芙�a�%�,X���3��]em=t�����ѝ'���\��m�U�����~C������ĝ'Lju\����z���M��ʳ���R��44g\"����!�v����K��� \7��%�y$�>�4J�v�醐��Q+�a�gn�|U8����3�(F�Ѕ�rR��$L�����xc�SsM(�H>�\��2G���qQ0y�@�YJ��qq];XaQ��E�`~̀��gqdP�$A2�YE ��= ��BqW ��{ܵ�#����#��cD�w�kls4Py�kK" X���a_�~�1�� ��a"�i�����Uq��$��"�Mk�TO# <՜�bHn妁���Ks:�/���vn��R��61�2�9*-m@�+)4�8��C���PأnƩ���9��/1`�NB��x'¯B��p�.V�^�=E 'vh��9�Q۵�����!�,/"U�b��5�a\�(ZB�z���@��f��.e�� k,��Q'�����V��u퇳���.� �s��woO��2A�x�m �`��X�T��952ӓYid|e�Q�`�}[D{M������T]��85�X�Ql����/���!�,�]���d��z�0c�]��w,F�|F���ڐ������n )��J �@*��I@����Y��Ģ8*6î�g�߳P(��uּQ�����q�S����y��2-'�.�Y��0�W�c$���gͺ ���Ň�f�_�k�fSAY���LD�`l9��JzN 4������u�ڿ��U���d��j^�W\�aK��"���j0���e�ߒ�#�׀U�4Y���@K����n[B���m�f���mՂ��r�ǎ��M�Q+�_d�٬(�|�(${�=,�����X���ϩ�Bַ�y+*6�a0�� ��`�'"����c^(�a�~Fk���I#��xҰe�;,o��&�-�L�4h��:�皽���kR��<��0�("��ߪ�Z��;���p� TFو� ���b9=;p��)A����|O���I]�t�Ē P~DH��~<ۤ�6��BNL �v����5�I*�������M�ZO�3o�����6�P����V^Y:�UvǜÔj������w �(�gS���ԍ�J�N��a�ǫ���#e�vo �̂��4"0��b�\̫���F���7��Ȋ�9��aUa�2�K�#��&�;T{�(c�+���h3AЉ���X��mF�I{���!��u���bZ�9�,�7���� �8��moB �S�^Ntm�A֓��/�SȎQ}�ث���ҐZ�'Q+_Ѓ�D�M+p����N���Np��Z�ȧ`7xP`����l�5-��^��^���LA�f�E�/��*_� ��ÂM���?�xT�N䀱�?}\�[���x� ���`��� қA؟}mSY�BXϻ3A��&gL����C���/�j��S{E�Z�|��[�{x���smUS4;9��B�1�R��T*m�ǬL 0�se��]X�G 4Vҹ�d,֫\}����G��$ D�Z2�H����S݁G� p��Ъ{�B�eIN�5MY&����Y/O9ՊP��=�܂���XM�����SL����7���mH�S�S����8Z� Q��u�5����t��A��!��K��̪�:� q��b��<�R��;�O[n&������۔�\�8|�S���E)�.C�6�jsU���`u�ss�7mO�`����J�����<h��ONú��w������&_�� d�+c���"5{�q㫷ت�T��:�c*'1m�,��ٍ�f� QE��Z=^�%�J!���M�{����w x��
Static task
static1
Behavioral task
behavioral1
Sample
57730879780ee1a21288d9f2e4b66512fad590a12544198e6ae4d8c7a943c10d.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
57730879780ee1a21288d9f2e4b66512fad590a12544198e6ae4d8c7a943c10d.exe
Resource
win10v2004-20240508-en
General
-
Target
57730879780ee1a21288d9f2e4b66512fad590a12544198e6ae4d8c7a943c10d
-
Size
7.3MB
-
MD5
ce3343369a056c3b03e8d79c5f75b8ac
-
SHA1
accb23f3b99e59dd4c18890736b17daa748a76ce
-
SHA256
57730879780ee1a21288d9f2e4b66512fad590a12544198e6ae4d8c7a943c10d
-
SHA512
67108924654cddbd1019b3b879d6a902f2f65d190a93dc8c56a20ad88f9560d27f025c92217391d5239c6d23d5f0fb61dae3465f82e2dec028860d67b0b791f1
-
SSDEEP
98304:WPdag2WaDaxXmpdFDNzdRT1stBK8+dSoo0tOkVGCVuZujuRKe2QvoYbjuZBhKm79:WPsg2WaDaxKfxJRT1OEdDoE/8LnSBrm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 57730879780ee1a21288d9f2e4b66512fad590a12544198e6ae4d8c7a943c10d
Files
-
57730879780ee1a21288d9f2e4b66512fad590a12544198e6ae4d8c7a943c10d.exe windows:5 windows x86 arch:x86
1199e1e89fa07d8f05e39d94931a39e0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
recvfrom
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSystemMenu
CharUpperBuffW
gdi32
GetViewportExtEx
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
UnRegisterTypeLi
comctl32
ord17
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 654KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 338KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hsH Size: - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.kx> Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.NcY Size: 7.3MB - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ