��e:/IQ5N>b��6^�uv�����U�+�({�p0_t͵%���ª#���;�C�{r�<w-U��}�\ �wlP��ޕbҰ������h$!�`����LW�*FU�L�Xn :�cDϊZi�)!n����R��U1�.1>Wn�_�@?ޯS�Wh�W�=����[�_K�PM����_DJF�N���Dvapy�#~%�h�z��)�C5]�l|�[�5�(��z~�H�Ѯ����媹�|O��r�D }xf��QI�w��rf�Z��WXo�o��Tq���> �Hn��k4�Mo�No��W��� �2]i�mQPR�Q� o�T_q]ed�O�B��7IAn~:mbe]Br�9�}���\XS��V+�bt����N�=5��t���:�GE�p�K+������Ƶ�)��Q��*�}l�7#9��|t ��*���%�Xp��Q�P�r�J=��~n=U#� )���u1P����c�@��Ǥ+y pN4�aV��K���g@�$w�D�z������(d�f�1�!;ƕ�[]�Ƞ���Xu[������ih)p��K��a���"�p�����m��Q"��)5OI��jrg��2�<v�QPGH���g���z9 ��Hg��*D�n��r�K�_�#�=��Yӽ��Ҹ_�H���F�SD�����_���4�L�%�j��m�UXw|�(N���j�1��)� y>&�>�T�� �����˛�� �CI�Er��t���֥��_�Ak��W��n`�@����\ߟټ`�ﻤ��M�[YEX��-#پ������%4�{�/߂�m�yIz݅:��KM!��u�m��"3����M�]�Zƈ!�H�=���ž �$�>[L�%>>Xz�_>u=)Ɩ�������7Q�w��x�隙>'�5��"��s�*?��Ƈ T�zp�rF�C{���2�V������#Un���.oe��w��F�����ҁS��琪UL媁K�mP��TAҙ-��f��T��vp���\�}��{��;�]�]I>6tKj;�>������ ��!�ߌ������e?R1s�Φ�c���V�g�=��dΉY��Q�d��[�5����r�:���e��F���;�Ա��5�Y�Bk'GK��c�ެ�H�+�iS���M��skpM����+��"��k�RF�晪��sD�\f��"���Ǒ�u�S��z���G/��������������7�|���38��F�H ��h���3�B���]�6 ��'�������)�F���-�O�m@�7/+o)����B���������N�U�x�(t��L��A�������K�p��SIP2���7s�M����n�x.z�&+������ ���9�U!@Ę!����X�����Ŗi��"V��/�`M� 1Ec��|u��S�2*�y�t/g�A����ve'.�0�K��9(�Y� �C~V��Uʓ(�i���2�C�J�C����@s94���'"���n�L��/!��_�Y���肙�3����+O���� t�b1����ܰƤ��"y�h���s���3N;| NQ����誣hذm&�{'x��G��WS`R�}����ˉ�E)�hmSu�I��p�R]ff�F��-of��&Zr�צ �g�o�?�&�joY}2w�g���P�^����'��:o��2}P��=%|z,$�����x�[�S������fYG�(0��M��sq���N�!I�}�b�aF�#�>5�:p�6����/�h���d}����l� I�@Bd�&n�l��Ԩ��Y_=���3Y~�Df�+2���9p��b��kRY��/�cEM��,*o��c�q��>�9U&q��h��%�aI��<�hבj�;C9�L��HE�bA��џM���P��d["Qja��c �/M�Cc�ya0z�ߺ���%^j���>s%le%ό��O�C/�%;�����15��Vb�|t:��v����F���v�s��~������ǣ"H��O�.z����ф�8An��3�(j�2�q�{�c�O����M��[�c�6MqO���ҚhGZ�{�Mle�����{�4�����[zs/ϊ�yб[H#�8������1��05�P1�������N�Tz@��BҦgN��Xf5j�-�,�HqC}մ))d�sb���,z<�Y��ڇce>��DWU��\��G�lfi�"]� ��]'d:���NE8��x�S �%���D����sq�/ q`�����+���VIx�g#�Ef ��J'ۛJ���G�pj@��3�4�J�1Ey��`��L����;�s8 ��, ��y`Ye����1��ѹ��*�@�0��]�0\\oXn�Ȱ� �p0�ro���Z���2gv\��|��X�w,HQ?� o�(����'���z�u��q~�-BGr�x!zR����2��9��b�$@�㬤�Y�` ���O<ߪ����=m�Ӓr���Jh8{8�c�������h���]�n�-��x�!I��@eU���5���)/E����Q���f�t������D2@_��I��p��g�V��c�~=��'b���X(��]�'����L�tV�)��j��2�X�����F�{HA�d�B���$�G#�s ����[Mrs�����h��?/���8٣�:������f~�@�z�Dj�:����]���b��qXs뉡�8��95�,q=Fzmf��/�<w�:�v�ɸSd��Ҧ@�>�����J�.���G��q����<㰲����c}=���j6!�=��?E��A�w�RE_�Çش����r 0o�R�H��y�pE3Y?�לP%@�����������o�+5�2n���w�ë���l�J�L11ْ�鷅<Q;��Rm����F��y��.�{y(K�n�T&�21ģ���&�/�hx�6�"`>A?`���� R$�V����kRGB��0��s_� ��}a�c���p��ܷ���Maa@�0� ie�8�~^�l@DgcӔ���~�vu ��`��x��|������JW�*���e t{�[��=;1-2�Bw%r��ͩ0q|���* .H�I%�O�4k�s�`���
Static task
static1
Behavioral task
behavioral1
Sample
6011578d456e84d4a8851284335aeab7ad10c63a2563f9c8d03f9ab6da0565f3.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
6011578d456e84d4a8851284335aeab7ad10c63a2563f9c8d03f9ab6da0565f3.exe
Resource
win10v2004-20240426-en
General
-
Target
6011578d456e84d4a8851284335aeab7ad10c63a2563f9c8d03f9ab6da0565f3
-
Size
15.7MB
-
MD5
2f66e683f3d45cd62789b3f80a418151
-
SHA1
552885b7c5ab22492d9342cef3e96fd334555be5
-
SHA256
6011578d456e84d4a8851284335aeab7ad10c63a2563f9c8d03f9ab6da0565f3
-
SHA512
2581db9966bb14c24e7fdadd4e1bb3d46091ae9091ba89f5110899e34bba3c9b58382fbcf01f28cbf6462e3abf0061d4cd06c0e42dcb43fabe40df364d623af2
-
SSDEEP
393216:xIMR8neVrshrxEvk/N9V/26ipoqqR9QtzTOpa:anRpxEc/N9V/be0QBOpa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6011578d456e84d4a8851284335aeab7ad10c63a2563f9c8d03f9ab6da0565f3
Files
-
6011578d456e84d4a8851284335aeab7ad10c63a2563f9c8d03f9ab6da0565f3.exe windows:5 windows x86 arch:x86
8e97cf491dd87a5547eb170bf9a677d6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidToStringA
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetMessageA
CharUpperBuffW
gdi32
LineTo
winmm
midiStreamRestart
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
CoCreateGuid
oleaut32
UnRegisterTypeLi
comctl32
ord17
ws2_32
accept
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 889KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 282KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.BqU Size: - Virtual size: 11.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.~*6 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Tpk Size: 15.6MB - Virtual size: 15.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ