2eP�)���H���|��E�'ߐ�Y�g��sڨ �&R��<�Z��iP��c�Sy��^�8݁0FMA��*�Ͼ�}�ɨ �WjUL����}���F����M�~VH���d_������"tj�p���3C[���i��{\9��Vy l�2��0�4YC��8�8ME�?.q���� � �na�uޝP?N�Q�.b�~'XIWNFX������Kϐv��>�[�H������ܒ4{�0�3��#B� Cj�݀0�#�J:=�Î�z~Y�Ȯ��b�K��Ǩ%�(�/�ce,PR>0��ȥt�L��?]�w^�ѭA�-��o���{,��t�Ps�u�$ϗ�n̲��{ொ�Ad�>��L �`r���ԫ�xΞ�ǿݶ��\�B���9 8O������� �y�~���!�� �K\9���6��F}���W3H�^�X��my=b<�u9j�e�̩���(����勫'Y�����c�9��YWޓ��g�-\�������u�U�P.m�0j���+���>P��m������!YD��mgp�.�t�WwX�ڵ�?̣��x��O��4����] �P�52�|���Й_|F9@ �o0<{+ֵb���0TH ���g���|����]�"���}�g����!���=��^{h_�"e�� H�uVbg��+��!=�yD�9x�e,��Qq���t�~��D���lV�-�U'�Z��TMx�/L�C��(�GRn84��qp.���"�)��d�G��]�#+����s�������a{��%@��վ���J����j+���?i0���K�rM~��B.�ӂ���1��>�2ɱ�mf��4�N�v�՟Z4�N��/�L�h�R,�Ζ,�nwjb��!;Jߪs] ��(�fv��܋1��1_�匨R�W �E]��n��������D�ʭ[����f�ɶ�.���$Ac�G=�դ�"Hb��F����g�оwR�k�a�0����x�^r ��t���|�ơ�)���.��=�>�?!�e�G�u#�g@�5.�L�CD��d�����:�`�Y�y>��T��?�_ʙ����4���f,q`s�</���RW�j<������c��,H<�f��b d��c�(PѲ��è��c�ȕ�y��Z�^.��5�AR�SC(0�E�9d, �!�K��s�Lx���p�OH�c!z�.Ak^�,���h�C@[5U/V�g�"��nqLq��[��H�u���!��-����"q���_!��`�p�(�(��9;�Z��M�bN�{Y���s��̝����rw�^��y[�]�x��9��K�H;���B$�,����lƺ�ئ��*���(*/K;v,�>z�'�Ci��$w����cPB���j��g����.�z.M\�L1�&IU���|"e���7:^��=���z[�I/�Q�Ɉ�t�������������p�����z�-�q��]��f�^UI�D��3� �N�����,�"~���"����o�5�@�8�w� ��i�k�6�5?A�����<��QM�S�3]v�����#{6�L-"k�l}XT��t�w�EcѨ��9�qA=M�_EP���JNF���P%�@NJ1�� �):_��:�[�L���b�U����8�ZD�ٵ�!7��w�1"�U�j\��"� ���h`��&Ja?א�*�`�0��A����#@�GV�COd0���u������^��VS�̕�n�d�|#c��U%ĸ���X��Ȥ�8�ݏ��M�E+��Y�@��+]؝���e)�5�����眩�7�[a��[����=nђ�D�-H�U$:�W����=!���j�[�x�n�'ؙW�e\P7�*��Qf����2{��ɂA���e?�q��v�jR��~!h�(���=Ƞ�ṯAL cd�F+�C��/L�iM��6��A~S7 ԕ�-+x�H}�R�g��F�$�?��Zs�����{���e=�Ӯ}�S���4Y�5��^q ��^./���7�e=:�{Ďq����B~7X�MK^e�n�@�#� ߖ #���w1+�ỉw�7b��X-��r� )4��xoF)5�A�oD�:��qB2�t�C#K��6C���Y#:Dp��O�|���dq������9{�+{���>�_���<89.����\CL������j��tZ_P��S�8��%�Py�b��� �۪w�Q�wu�7 N�q=l�V����Wn�!t(����±n�op�qR��,f�r��w�6T�8g|��vM�m{�vR��7RVZ}� #%�V��X���9�τ¹Y��s�q��FV�l����'�Xb�U-�X-���gV�ZA� �����('�����K�����Mf���U��*�>�D[� ">d�`?���oا��y�hwCx��Q�V<�Q����l0�Y�+�]���Te��7�\��.�u�&E]������s� Y�$�G�f��0,�� Kܢ��pZO�g �-�N ��6�������w���Q]���n�(2[�M��0� ���n�5:)[}K�-�,QA :�?*��3M���e�[2QX I���UoAo�%���MTV|���B�B�%,��]0�N9X�Xh���l��Ʀ��ӥ��6�Of�!�5:L)2��^��߀Gk55%|�_� �����'��ݸ'k@]�����TAZ�ξ�w2\ײL��g-~���ű'A����������l'S�$��V.�U#)��.��g�-o}���hM�߶_ke&�d�j �e��gue������Nf4^VwS$i������vPP�7858+�m�j���ذ�`i���Fajq��lb0���e�+QҔ!���A��1��^� "sr�h�|g�ŝ��6�Z`����,]V�aΛZ�2+sR�Oa� �3ȥ��H�g,,��%c�G�}WoR�/��I<Ox �h�����+��: m`>2�*�1�����e��J�~�g�o�FSM�z��JS��'uI"�>�.3,ɉ�����1Yr�=`�B^��\��:f�_%���͇���S5HA��3�X?����F}��
Static task
static1
Behavioral task
behavioral1
Sample
2ca1d706466d7525a9c2869366071225f838b397066d073b1098c9f7d9453c84.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2ca1d706466d7525a9c2869366071225f838b397066d073b1098c9f7d9453c84.exe
Resource
win10v2004-20240508-en
General
-
Target
2ca1d706466d7525a9c2869366071225f838b397066d073b1098c9f7d9453c84
-
Size
840KB
-
MD5
9c242df8dcc79309dc7b944998a8cc67
-
SHA1
cb6503d336adcacb0eebda480e9ea65ae9d6591d
-
SHA256
2ca1d706466d7525a9c2869366071225f838b397066d073b1098c9f7d9453c84
-
SHA512
c9eeafb0c8f79218830cdd3e8895c9d768273d6f4c2e862dc66f1c50ae8f461ae524b6eb2c128ce7ec2c5092fb7d382a67fe2e23d8b6ad16c8a9a745be5383c7
-
SSDEEP
12288:yTAM9CuqO1LBX6nlz+qeyhH11kEGJMLY0hBIFWmJo32QgWV4MN93n1+RiM:yTPHq6LJ6nZbR7k1MviFWWQbN9XyF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ca1d706466d7525a9c2869366071225f838b397066d073b1098c9f7d9453c84
Files
-
2ca1d706466d7525a9c2869366071225f838b397066d073b1098c9f7d9453c84.exe windows:4 windows x86 arch:x86
5555c0adebe40b05b093ca58fc5dd044
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutUnprepareHeader
ws2_32
gethostbyname
rasapi32
RasHangUpA
kernel32
InitializeCriticalSection
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ModifyMenuA
gdi32
CreateFontIndirectA
winspool.drv
ClosePrinter
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
RegisterTypeLi
odbc32
ord46
comctl32
ord17
wininet
HttpSendRequestA
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 680KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 403KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jpo10 Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
jpo11 Size: - Virtual size: 277KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jpo12 Size: 752KB - Virtual size: 749KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ