]h6&��_zqV)U��]8�����Tk�րsLl��VUg���y|�%9w�hx%q4J!��$h5��!$����t����7�Q���n���T���+c.߆�zj?4�k 5�����о�؈]ً��"�����dA��j�A���ïrO�E��Г�NJf�Qf6AN����LN�n��&a������@��|ǚ�e�����i� �Ađm��D�`>O�}��ҳs[���ٹ����M��d⢔Ja�܇�x0�7@�},��d�Y��Ț�;�3~�i�hQr��c��L�C�{�h�+��|��� �̝M�L���C�Q����C�:|Uh(��:��J��q��Z���㿹_Ɨ�ꏼn�?��'Y2��Z��&y�ej��F�x��{���)�g������� ��Q� g�>��k�B�&Uf4d��4�l���J��}-��_�1{a'�B��K���$�����o7���$��Qst���ڄ��NǼ��Ü�磅 hRn��+���N� �m�����Mt�ʙ}F���;�m���� �Z�]���TkÊ�cB��Q�*H X��G<��o���̘��&�/���v���s�U�8�'P�.ߓAR�t�I�K �u�1��K"� S;�����E��6����p����lZ�@i�bw'�g���$IVʝ�O��Xe�,`x81�r�����p�lI09v������ɫ`�Gį����U�,:f2��/�g<������ɁnLO��)+��3cw/����Lj� ��߱������5 !�X4�f���D��Pݔ��B�㣛@T�� ��F�W!w�l��] - c؉\gغ� e�֏� 2�,R2霂Q��&;��Kg�q�[%�eA���>����m� � E#MΞx��/Y��J G����������K�OF�[ a+eX,/d�A��%�%��D���VpqDF� �ʕ�"�D�YmC|��p��Q]�B2T����m��v�h�D��[�H?T섵���(��:}��!���� �?�T�fY�$�/(�[nIZ ���3��G°>U� ��1���g�E����I�О�Z��h���aߊxgfˋ�5l��&s٭ wQ�9�h;�V9.��O!�5��O�0�?8`�q� ���@˥43t���Q)�ʋȜf��C��r����M'��=���WX����N��mNE�˂�� �CZ���XIhxtqvٔD��c��"� ^+i�15{Y����x�,���bֳ�r ��jL+@i���R�G��>���ȊI���*���D@Ow�ִ�g���z�n�� (,`R_J�����9� �H�6��^Ã�x��5��O5�IL�iV�! &Vu�3�=��&3���7��]P�q������[h�/��L\�Ca6i?��j�p�B�/�|��R�5�{*d�����^1������ �8���U��4ɸ��������PLi�S�����y�{H9��E1�<t�VVK��hȴrzU)ɉRֆ�"1��sp��<,X&����>�Q玌�@��x$��q�g��AWٺw&���)��}Ź_��|h %��d�챭�XȐ.jeb�s�[o(=�Ȳ��z� �%꾧��U����u��{q�hR�k��I<e�:RJ��� Txp��x���[ l�3ʼW�P�6�"�[x"�����5�ա��F4r���ň���h���s���6��� <�W5>�%S hLR=@/�Uy��w'��2Z aZ���U!H>CC������.:�����,�f�ʓ"R1g%���A����7��m=��H����q��i�|����U��k+����b�E*o��p�ZўT �r��{��Z�����}���T��9��a�:��邪%?�ܡQ]����Fg����'�l�) ������&S?6*���g������"�5=���j瑆�g��]��K�v� R鳊}�Ԝ%��+��#'e\��KiB�Z-�^%H�g���0�%���ׇ����H�]_�{�5&����`9�Z���^�KqQBc4N���sS���� &�E�.��W@���`�#�Ha�¥�<�>p���i�Q���j�ι'B2���%q����wX��;8[���;d(K1�蟖�y� �໐�Gw�8���,�������Ȉf�}�5H}��2�b�ZW���\� "c1�9 =��%Oy�k���Z�>+�I(�G��?�e�,R2�r�n��=T��F���s�����K��U���#Ѽ�d�)3���V��X"ia*����e��Q�g�> ����u���*8,Q����d�h�c��[�f�jxC�|Bp�-��7���;̐��,�g2����9[�!ݢb�Z��'�#�����aJ&�,�9�� C����G"��;�����و�6��l%e��X\�[� 1|_�J��m��Uaۧ!��>� YR�����-�T�ޑkc������0D�����RV�O�X�����2��0��E� Q֟6�M�%t�L�)��LA�H��2,T�X���r~J��2�T1�yNn�.ć�,���OC��6ˑ��4tY��N��Y�XY�X/}�phZ�.1���V/k7�+WZ�/B����~�W2�Z(t����h���}!���з�����d`�UOr�ᗵh�G��u�N������f7֫~�;�D �G�|�c��<À�ħB��=�d���G�dОgq[`���WSYc�N�J�ʘٵ�p��� �n��qk�PN�=�^ ��Uj��ߙ���v;}�1��u{E$�W�WX�{#ʬ��h�f�Μ�Ht~�2ߓȜ�7uBsOv��-{�+�N�N�*�Rrk �cx�S�Լ�'��جtcB]��������O���Al���E��t�㍜��� Bҫ}E'���yڀ��ޞ������e���KS�����j0=���?����@�l���%��G�f���0eO�^j�c���/A2���g��uj>myU_I��X�H?B6��d\s)VcVi�;��N�0t �"NZx���c��tO�Q<��Dv�#:�O-c]��7xDmnm���$�$��R�I(�uT(0�KgE��7Q ����7t�vx]:cI�
Static task
static1
Behavioral task
behavioral1
Sample
f57af251126223bbb35c026529485f63e9d0fb6b98a806d436d9ada872c87580.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
f57af251126223bbb35c026529485f63e9d0fb6b98a806d436d9ada872c87580.exe
Resource
win10v2004-20240508-en
General
-
Target
f57af251126223bbb35c026529485f63e9d0fb6b98a806d436d9ada872c87580
-
Size
11.6MB
-
MD5
f2b840da7e5ace16f0808b9a27b07b12
-
SHA1
024eb7008a4f9eaf7a74b666ca5fb59cd89286fa
-
SHA256
f57af251126223bbb35c026529485f63e9d0fb6b98a806d436d9ada872c87580
-
SHA512
40d9ad2275ba287957f5902e37e8dbf36f56204bda9e062fd16836bba7b493861effb87b668998acd0618b1cd1cb80dc29648f87b63c8a4fae438663f4ca5f0a
-
SSDEEP
196608:+u7NNAteqQiAXR8w5EQGpDwZ4WmV4GDW2jOVW+1GwtJhzWkASwSJ9DH:+ugteqQtXR9EQoZq2jOVl1VWHUZH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f57af251126223bbb35c026529485f63e9d0fb6b98a806d436d9ada872c87580
Files
-
f57af251126223bbb35c026529485f63e9d0fb6b98a806d436d9ada872c87580.exe windows:5 windows x86 arch:x86
8137d84d731fca2df30ec8f06eced799
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalFree
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MoveWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateDIBSection
comdlg32
GetOpenFileNameA
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
CoTaskMemAlloc
oleaut32
SysAllocStringLen
wininet
FtpSetCurrentDirectoryA
iphlpapi
GetAdaptersInfo
shlwapi
StrStrA
gdiplus
GdipGetImageEncodersSize
comctl32
ord17
ws2_32
WSAStartup
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 275KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 568B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data0 Size: - Virtual size: 8.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data1 Size: 11.2MB - Virtual size: 11.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 413KB - Virtual size: 412KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ