�2�D7��Wl�������D0�CI����k�����Z�_-~���S(&:��@�:�/��G�f�6�z���r��3=3Q&F���yP��WE�;Ux��m���G�|�y�O+�������k�.�a�C��6!�9#������v005g�jȓbjF+�ǪP��ɗ20m8ɹ�c��x�6�w�|�Dq x��:Uv���C��1/&),V���p�zC#�n��Rk��r{��,�oI���ta��@���V��a4s������b Y �8B2���e����u�$�2��G\�jx�s����җ���i�I��s�B���n� �5��g�g�.����K&�`�e-�TQ�0�^�l��#�D��j�#.P#�vK�?�0�j<!��V�Ҿ�C�i����ػ���(�o����/��2�h(.4�wN0j�FP�T`��{8j5�S�������R��yK�Sޯ�lw�t�\? �p�o�0�3Ǔ�F_s6�A����Y��m�7�T��쥮IW�=jX5"\�xotX�$ Y�2aB�8����׀c�z{�%����MФ��h5�0��Yïa�ȁ~�l�5���0^�d��:�(���<I�v4:6��3�&Ȱ��e����G\P��)C7��K� ����p�P�P�(�N�2�E!�;��������U�*�I��|�J��G���:r�uW����F��"��� ���Ҏ��aDʩ�/TR&���Pe3�$1K�y�w�*��X��lGU^]g� #���#��ڄp {^�G�"%����x���@�B��H?6����B��"ޑH[��!^ i�����9�V��=��_��C"�eȊ ��:2>�����6 ƅ{���1�zH�=e8Z����)�����%�� ��vЧ㑌� WU����^i�]�����<�� T�����^����HD�%��I��\�r�irO]_Ź���xl���{Aӧ"��#��;j�6y��9�스�z'���?ܸ������35C�+9��WyAϪ`�L�y͐@�^�7�M��'�� �J!�bV{ۜ����}�֠��[���W��.��L����(3�濖YSO[ ��]A3����\G�M�$�p��b�[���K �x8},B>�g&)m��%�Sx7��3�=��g�r�J[53y0�QZE�/@2"s�q�y_�J� �M�����(@�����i�_ҁ�����u,DpE���B�*)�'M�N�p'a��0��8�d��Rŧ�6����0:��2��b-"�;�Key˶�81����H���P-�\��"�%���#��h�U ��B��8�Q�{��'� G`�C<�;y��=.>���y���ǘ4���m�u�6 ^�c�.5���F���H���|�c���u�|�y|�������k��E����Ή�y�*��"��5X�}V��=�r��IO��%T�Ȱ�6�&�P� Os�fQ'�����,��߬���y�ݵ��1NL���?�e��o�tNG9���e�(����i[�3n.M����+�k/o��d��������U�J�����&�EC����& %Fw6H"�s�1���:�( ��GQ��e�]GZnw*yu^�2�]n������/� `,��Ɠ�go!��P�/ k{�@ƢE$r%���f�}�r0 51V�S���)��r�*h���h��g}������&1dV����LX� Rk�S��~��S���ɜ��9�F�I7p��#g��r�����]��7�2�g�.�J1}y�$�|7N��ߑ �v��~f�+@��z�z=��t��@z��)�Paϯ�O0?GΨ� ����,��8�;���ڴ�{�d ����]��C~��ƛ���6�C��(��@�]��)ҫx�7�Q:g4�* 3��r�6K�oN�����}���J��6!��e�l&�+ʧx��I繚� <����ы����PG�Vz�G!cB�(vQ�J6�&�)���$')�I����@h�V�%��r#纼¡f�"x�2��%���[�`��E �i 1��������z�҅�����K�τt7���f��u��ʁ�z;!Pmr��GN��y(��`]9��i�m��?C���B�Wu��L��,��Ywп���/��#����z�Y��-���a<�b������C��f��džJ]L�yL�v��b#.%�Σr� .��_c�U�ˆy�s{ٮ�.�C��pw�SID�|���j� .u�|ͻH�4bG�ǡ���ܽX<D꼕b��9��\�~��F�qQy����1Tm�_ݚ�yOw�����%�8���fv�lr��Ȕ =<s���h�38���*,6�cf)gJH�\�͡]�#MpM��h��5��z&>��v]N�:���/��aq���i)�Ib�~ctq`�AkLZ�t^��7�94)�G�jyG"�<�a=*��1܇r������w�v�X���8!����U<�����T(�NsG�GPN�G* ���oO;OE6R�AK3�B1�$�o0l+���������Ⱦx�g���Z_�+C�����y��9�x�u ��l ��8��On��M�[t��2j���F.)�@�:8'dd,^�5�@Ġq�Y��G�!D��M�5?�I���تX���S[��#S�8��>���l4��P��\=�z&a��������֮�#8��� � �bJ��W��(�~�s�E*���NB�&�$��1���x��e�K� ��[��]��g_�Țh�m�5����Um �(UL�NDKn�`<N۟��T e��0¶vNk��[Ӟ��ؘ��3�^��w�!T*�t�� ����2��;{�����bV�b�?D��֨q[{��xR��Ps9��j\���p��%�]p^Z�he�jr�h��?�u��b3V9;�|�&kX������2=ʥ�1��2�5?�)���p{��$�'��������1a�i����}ccǣ�����S<|�Z�&����Y���q2%Id]�1��P4� C�x#S��Ч�������� ����-��L��%��s�Ηy&}-
Static task
static1
Behavioral task
behavioral1
Sample
478893f4f21d11c4308e7a3f4a3f2e40e988a018e59da34ac5c3e62237b9ced0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
478893f4f21d11c4308e7a3f4a3f2e40e988a018e59da34ac5c3e62237b9ced0.exe
Resource
win10v2004-20240426-en
General
-
Target
478893f4f21d11c4308e7a3f4a3f2e40e988a018e59da34ac5c3e62237b9ced0
-
Size
3.1MB
-
MD5
4bd29cbca63ebd2fb1ed4a08b5bc93f5
-
SHA1
d37234caed6d9bd2c20a193150d21f020a5f3bdd
-
SHA256
478893f4f21d11c4308e7a3f4a3f2e40e988a018e59da34ac5c3e62237b9ced0
-
SHA512
a382a7405ae94c243a5be3dd8df8fd6d9485d22c2180ca77741836aaa4d4e85a586fd3319d697bcbbb19fc07329e13046689449c1f44d2e21494f591d99b8c2b
-
SSDEEP
98304:X+dHVrBaURmjWzwpSbWOCBaBjrMGjYjuB/3qK3wm6E:mWTjWzwpGXCANDNqK316
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 478893f4f21d11c4308e7a3f4a3f2e40e988a018e59da34ac5c3e62237b9ced0
Files
-
478893f4f21d11c4308e7a3f4a3f2e40e988a018e59da34ac5c3e62237b9ced0.exe windows:5 windows x86 arch:x86
36d3628a75d04d3b3cde045d2a491c88
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
VariantClear
advapi32
OpenThreadToken
user32
CharUpperBuffA
kernel32
GetVersion
GetVersionExA
GetACP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msimg32
AlphaBlend
gdi32
GetEnhMetaFileBits
version
VerQueryValueA
mpr
WNetGetConnectionA
ole32
ProgIDFromCLSID
comctl32
ImageList_SetIconSize
imm32
ImmReleaseContext
wininet
InternetReadFile
shell32
ShellExecuteA
comdlg32
GetOpenFileNameA
wsock32
gethostname
iphlpapi
GetAdaptersInfo
gdiplus
GdipCloneBrush
shlwapi
PathCombineA
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 153KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 56B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 408B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 140KB - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ