lY�����H! �=�����{�s� Ԩ x-��2���a���3�Pv��j � {��t�\I��"���"��l�]��.�l�m��I:N2ţ��ڍ����rt,��,��K�t|1��\�=�������,�8���K���3�d�7߁DW��n=_�xv��v�.��s��8���)0� ��X��H���{�E�N��s���42����`�>���i]�kk@�+96v�,��L���u�Jt>m�J�v���O�.{��X¢���[pW8���I��\`Zm�����>qx�\�V���D��Y�o��$�\�Yu�����2jk�Nڮ��Ȁ���A�X�����*0 3A�p40R�"���w��ƭ#�������Z��}|��i <��JW�uxeg� �ʇ�ӵ\��k������!�.}���y�Q����Qp7����DH��ji�J���g-e���=��o1AK\3˄�}H�P+YV5�5Ն�R�t_I��0��������-��Շ�y�vѧ��Z��MP�����C��0�f��&�&���)����逓��E`/�6p��e9h�E�úx|��7��2N<x6�c%W|�`��\�1e�F���w�TuC�u���=��Y�ǥh� �:��n����]��;���`:&���uk����ꔥl� L{.��o�(�t wT��v�N�d9�_=^��������[>� ��T��A�� =��o�v��Qh�no-v A7�:&<��WR�V$�~"��V J����L��f:';���7����s�3�\�j{��G����24ޚ�9���,Ƌ>�:�<%�Q�(�����cV�}�"zƘ.IW.�҂�����7���������Ⱥ�B��t�(�x0���1�?�~y�h�Z�﹣#��e�H���N���T�g�ҵ&Ԧ/����_��g>�u�=ay�� ��.y�AF�?mM��VRiK�f�� >5�n���L��~"�����9/*m{���*F_��l�gCʼ~���\k ݠ��<7�E�S��^Wr ePJ��C�~�O��+���1�)fTgk��`�FX��C��%.9F��rIH���@���$�@�x��΅�f`���/��(rtT"Ӓ(�z�W�%�\�g���1��U�-?b�F��>����E0z�PbmG��#�`\�_PH���踕.��y�X�B��ɸ��&j��0�[�6���̜�Ӷ����*)� k���m،�m���r�!?�^�}�]>�&Ҍ&���t�.��׃��'�bފ����kYH~�˅|��I��:�����t�){�L^p�,/�K�c>֡��v��1>w��u�!�f��v!JskD^�DP��X3���7wL�zu�0���ȞE�C=k�Y>����2�j�5��-��[]ey�������9KȹX�!e�=�m�f`����T�s'��J��(�ڌ�ZҎ���z[X��d�L��տ�\80c��-���s 1������Gŋ1n5��ڡ)tG�q��:�Փ�h�%�d���\^����{�0!T��%��c�uB�=��@{������ś�i���3iշ^y��k�<Y���Ez�B�$7�EnE�p�h����yG��ˆ��*������;��Gr"}��Q��EJ�m]����[�,��L�aK*��8~0����x�������e2�w#8@`��i �<B�}� :�����F�<��<a����dR�]=� ����ڦ�����,��������_����a{�"%OJQ�,ZZ���#�*�>���?��'Li��1�z��R���E�+�3�@�|����?.gM8u �<�Hl-��@I ݃C�e�������t ��l����"n`�z��X�ܓ���<Z�Q��P���M@� ��JI>�P��;�~��l�=�K����;n�f�`��1��-jRa�b%���jz���d�*�������u�a�+�մt�2[�>vU���ÚND���¹���� l>�c�3h��l��6����*�n�n����Q�W�� Op�64�tf�n���x���Er�"��x�w���u��ڻ�>�GL|��EWB�_ E$�ҩ{_K�|f=�KOd �CU�w�f�gl���\�#��/�x|1m��fn-�t�d��E֥c��[z'����-�:dҢy�<z}����"h*���SmO4������|���fՍ ���\�S�ܝ�X��M��:fLN����1���m�<��T�������ks�PF�9�J��aJ��(� ��d�0 *0ӷ#ڻU���+����1���-��>�� y�gPQ!.ʎ �_ƌ���� ��Q������ۦ���v�tSr� \�V��[Q~��Dyg>ӛہ�D�ݡZ�u]��<_[sv�M�ٿ��g�+E6�q�aw��p������E�t�~�fU�h��'@�P����N�>i?�Y�X'0�:��KE���l��I�� J��S�0-��H���װ�s�~�%���{�⹁&��1rd9oY*O�W;�09Zuܦ�/�oK� � ��[��)[���Z����ƹ$c�ٺs��*|@*S�T/����3���8-dA k��w���`��yйS��?}��?\T�g�Ci�(_�Z ��ٵ��K�A*O� l!���Ά�L�2���f�A�f�V����{�(B����_�@زK#҅�3��B�rW��{���|_x�xb���%�9�J,<�*��Pw%<���� �G�P���]���F��^�%��0+�G�4�������t��y��vi�)���\C0B}Ts��@����B]���~����f��]�ʪD�^|�50-�?8�]��T�@�/�����k �5I~�x<��-6�����R9�����e��qho�5�`�����ve��ä9(PXf����2�>b��!��x�Ӆa�n��}~ry��Y�|�!gԒ8�x�X����3�iQ9.wH˛�w���ʼn/芠�BX:�2̇"Y%�hXj���Աp�V�PFK��E�$v�=^s��-���!���Вۓ&�)j����~���O7
Static task
static1
Behavioral task
behavioral1
Sample
2d045ece99d6972f2db30af717b5476b3e137e8f64220f0dedc80fce8b662d2c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2d045ece99d6972f2db30af717b5476b3e137e8f64220f0dedc80fce8b662d2c.exe
Resource
win10v2004-20240426-en
General
-
Target
2d045ece99d6972f2db30af717b5476b3e137e8f64220f0dedc80fce8b662d2c
-
Size
4.5MB
-
MD5
70b3cb4cc8c4ee9967d61d8eb45d27f2
-
SHA1
f3b798c330966bcf5475db8c603f3cbe5c3d63ff
-
SHA256
2d045ece99d6972f2db30af717b5476b3e137e8f64220f0dedc80fce8b662d2c
-
SHA512
c5cbdaafb236172bcfba029e3d01e5332df0cf49b43317621ebfd15f1391bdc0b843f2c5bc08e64d36e2e2bbc4f48650ee0f60d5f8bcfbd421692b96844012d4
-
SSDEEP
98304:oTdlCFfh9YSnf6Q4c2N+jy5bdCsaUtiSV4LQNVozxhBG:oTufhmSnL5mhdCSipWWzxh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d045ece99d6972f2db30af717b5476b3e137e8f64220f0dedc80fce8b662d2c
Files
-
2d045ece99d6972f2db30af717b5476b3e137e8f64220f0dedc80fce8b662d2c.exe windows:5 windows x86 arch:x86
bf6a912fd2893537050ac1adbf7d894b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamStop
ws2_32
WSAAsyncSelect
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsIconic
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetViewportExtEx
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
OleRun
oleaut32
UnRegisterTypeLi
comctl32
ord17
wldap32
ord29
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 685KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 345KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 164KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ