\42�� 2�����v�������a�f�I�L�Fw���g�:W� Quݥ�"���BӶ���ގe�Zf�S;&��il9���eU�Vf��*�JoJv����2�C�A�m�aʸ��|*�f�+��ƺ���l�� a��P'�+�ƭ'^�Y*�Ъ8P�w�5���o����p�?�d��U8�����Q$�.bO�+�/D�(p]*�b�ŷWl ��\����ܕ�>�_*�� �A�#-\D)����������P/��m���R=���_P��t,(�X �������|jA�D��^��o���h����8�[$�|v��r����`�<6���i�<�ÿ�� ~���&N/���1��������^lh�FWV^ 5�� +�B�Nk�>���-AX��Uh���1����+3��w��Ǟ���VoO�i��cA�2o��^w�r�y(sӇH��Ifl�q%�H���_�T� O����7B%��ޝ&1�Аoz�L�M� ��4C��o��EM��-��`[�~��1} e�/����`\��"o��b�z���J�vv�N���tTC�U���>֪u��?s�l�������4�E��Z�R��,�@���7=����ֲ̺^Y��T/�e�3�_�R�d?��C���>�F�����I+�N��>Ֆ��ᥜDz��^Lfk4���75�Kfڥ[Yp�y������XX+����O�6�ᩄ#���)�#�k�K��3`Ȗ���`�� Cn�y���Q�U�.H�qm�l7{B����,�K�������b��W��eb{�4/�L� )+M$�Nޮ8-��e�V��T� .�����-A����P@�a*O���V�5��Y�W���K��~>=e�x����/��+�h5������6nj@�C��or���roE2B���O㶌̤�����I}�<�2��Y���6�m`A��Ib� �"�M�ƿ�lC'���ܕ��x�]Af����F<��Ω3�]7��J�lK^`2t)���Qf�����zm��_�h����eu�l�3U[��`ȵ����BYrS*@d\s:L�!l�r4�3���r���~b�?�f]������Oz�o����c�I���<��ܡI6 +aܚ9�6�c�"���ó�*�5� di�Ln��u�Ɂh�c�@(�/��*�!$�l �����v��zU�_X�rތ?��,]Iz����=��kC6�'�����[K��.T��u�Y���1��9�{�=����ٍ����no�'�hO�'����--F�}v�0��^���5x���7pm�������Y���S��Jef�XߚUkC�C'�f��a��d��0��T0*��h,� ^�f��;-ca���luqM���B��mN�_u:��1����t.7���roƓ$�rJT�� d��/Se��9�p�� ������/)����L�+���>ܩx2���g�-)��"��~x��2|�$b�(oU@�mj��9���}�(Ve���s���>�1ʛrW��:[m����u��A' ��5���!���|�4�����G������\@jぐWd�^����>�D<�N��gd�7m�Z�u<k� Y�9�(Kq,sv��9(z��T����c���]ԝ�eŰ"Lh�6p>*t���W�����Ĝ֓}�u��������(c�ŋ �F���?�:Y��O�'��� �鿸�k���������I���r�f�E��n�j�z���RU�"L��\��Z.���LR�44�c_T���Od��= ��H�c��Y31*4��RFiv��Kzw���yI�y�ͺe�F��t�:,v�6�q�n��cA-v����|!K ��,���1��#J���q���U�q�̑v�U�n_�{{5&���k����.�$����?��70�V�͗��`��mx� U�~�cp�z<Q'1}����р��j3�Ό���{8v�r?&�'��}��<�=�����t�Jq�����.����S����m-d��Ƈ��+�� i�? Հ8Tݦ�9b2R;]W��n@����s����5�T��E�Y�JVfIM�ӎN�ȍ�o&j9*%�Bz2O�bH¬�_�N�8�P2��Ӆ��Vњ��|�U��t�����1x�ރ?|<�� �L*>8|�}qlkR�r���������R�����z����$v�/&2��2�dx�O��\�Wc����@�^>��m�oB/J'�|��SS z�A�h� �4.����Kz����8���^n�2�5�/��b�����5�T��R�篖ACWp[�l@x�j��p��i�6���� ��c��ݶeHwx�'����ɍ���C���;�L�]e����y9Ő��A�\(�5��"Rn���hy��&ה���t��C��ՑNr�[w�$�{�ȫO�8p�&�@/D��$Ҫ~ �D�IwVB���"����P��Hx`�|���@�C�EO�B��$��~l!G!��5�S\3��;90Ī&��NKGI��Э������y����[!�=|K�����1e� �˒�V��H<9Z�<��IQ�r�>J�uh`�������b�ﵑ�_W������NѼ��?�>ގ�7�Q�&��%�$��\�[�|q������F0��Q }|דZ��>!���3�jO�@��my2XmIcxU:��ʟ�Q4�C����(�6#{����;WN\�[s���|! 0�u���q��!��� $���6"�s��S@�5<vQQ�c����_ �,۾Cj� ��͐�fHB\�J�I"����m��@���CӤ\�����XϬd��p*(t,(�_bS���dü�- I-��D�t��Y�w�����2&}8 �����b5���Lu�LP�5��G��1�h�|?�l{ b����/��@�����Y������5�8[�+`/ʊ��ҽ��B��L�T�0����x�o϶��� ���$�:0��þϞ�j`9��h(���D� <�e�*��j���ٚ�"��@϶�D7�xz��Qw��3�z7bK�y«Ufh��
Static task
static1
Behavioral task
behavioral1
Sample
7479f9fe012d684ee75fa70fef1c45e752c7727f294cef9e25f80c5b8cdc7660.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
7479f9fe012d684ee75fa70fef1c45e752c7727f294cef9e25f80c5b8cdc7660.exe
Resource
win10v2004-20240426-en
General
-
Target
7479f9fe012d684ee75fa70fef1c45e752c7727f294cef9e25f80c5b8cdc7660
-
Size
1.7MB
-
MD5
54f81822f578527c2dd1c223b2e4cc66
-
SHA1
b8c5c584199fcd32e0e0da27716b3c4c79fd3203
-
SHA256
7479f9fe012d684ee75fa70fef1c45e752c7727f294cef9e25f80c5b8cdc7660
-
SHA512
5b6aa326b497e8601baea349bd1ad2d4dacbaa5bdaf05a2ede29284a7910714c76808082c4f1a0edfc49711bbcb690d17ea1b03f1ea3bf4300aa615c3cee754a
-
SSDEEP
24576:1FC0eqM67cRHLZkujUlyBuJmCNXI6GPdYYGqenVQ2SUomS7tfRVkNhWzDpVmcVQL:1k3qMPZqtAcFxuMShpWhsQcPnQQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7479f9fe012d684ee75fa70fef1c45e752c7727f294cef9e25f80c5b8cdc7660
Files
-
7479f9fe012d684ee75fa70fef1c45e752c7727f294cef9e25f80c5b8cdc7660.exe windows:6 windows x86 arch:x86
34ee0b8ada6094e952325657bf65730a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetVersionExA
GetVersion
EnterCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DestroyIcon
gdi32
SetViewportOrgEx
winmm
waveOutPause
winspool.drv
ClosePrinter
comdlg32
GetFileTitleA
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
OleInitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
WSACleanup
ntdll
_memicmp
Exports
Exports
Sections
.text Size: - Virtual size: 735KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 626KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 271KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
wushuan0 Size: - Virtual size: 759KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
wushuan1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 280B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 37KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ