���0<���lG�f�~h@E�|�<q��c�=��*�}D�TF���[f��@���/�4o�ſ��Pd��x������&)��/+�b�%=o��d�T>}��{���NjW9W�`(�y�_��ݾ��A����$��h����W��!GU���$(B���cy�{h�d]̚�u���6�ӗ]�sS�s/{���*������N,���tZ���;��v��Y��]D�vc�/�E��q<e-��H��߹ݻ�o�,�����2��~;cv�c��2��|��+�}�W�٩]jN0��F�+��Wu�J�%��1a��|���Yr~����c�˼r�T���y��Oת!u\���&�����Y����-�787��΄�Vk?ɣW5���kT��z�5B}�S�hz�^�J�Y�1�&J�4!�]p�>�+�������e"|��Wʡ杻��"T��bd�=�R��/ʱ�qN-�����tȱ�{+�`�h�dQ�S���gPW?�O+�^L}X C��� bt"jr��= mɪ:o{ ���<{��s�9�D9Gʍ�w� �`dW���&m��o;ME�_�n�f��Fj�, >�b��X]p�U�ݐ�cqQ�d��B�t��d�{%v٦��VPa�I��l�Hb ��%Wh.�g��y����#��2�/R"���}�1�<�<mje�t��-t�cZ:�L$��T7�^�*�}W$�����Yb�'�-�k܀�I�� ���fp�ۙ�<F����AJ��U��������x� ~��EӍt�]wD�������Y!��[,1����Ȗ19�4��B������M&���]��y��+T0Y� N��K���� {4 �@z�?�J��X�ʏX^��J��8[C��'(��z�h�6�� <W@�(�D���!�98�òL��r�4!���%�qvS��;���`=U��azjXC�y���#�)�Ϊ�Q��@3AMy�G��ʇ˞�`�����ٷ&gE�mH��B����t8�9^&d��� ��4DU�X �BF���X�T����&�e$��8�߲Z�v�V'y+<H�v^��jh�n[7��9�k*f�D?W�Ng���Ԡ�w��ަ�1�Nɪ���9y� ��!M���0�qY9I���!Yb5G�(8����~�̬I��0H4���� HS7V.yx�f�}�c.$��|u�KpYh�^���ѕ�?������#��ѐ�|1����KP߆�pcf��'�3E�u��#�/�p�vS*s��py�[��}|����E��A9�g��2��U�o�M�4�.뾛��?W���?C�8mh�?|c��.�Ѐ��KkF���1溽��"�֝P]c�⡮i�ؙRɆ�^��h�R�E�Ljwč�����(W�utjzG� �G@��|��{X%61ܬ��w����˧K�->����`�h'P�`)�bb��������T�}.T�C�-�,�Dɡ�@�TY�e�A=x���� l���Y ��yi�Ri4@1��uz���m�\���|�$�m~���h���Bc��)�G�|���ǴXu�u5�k�ݽ��՛�<����X�!����,��u�>�@W���ß�˥�i����4�a�^G�9l[ ZD�9�l�xjx����p������ �o'J����_I��2��.3dhO� -� ��Ä��-(�8����O2x�o�E'V{ �\ު͓eӥ/�A G����/�Dٕz�Uu��?%���`����Dp� e��)��x���нNu���"��Caێ����e����l�t�������*?4� F�*�{�˂f�t�lN���].�"����W��3��&�?�&E��Uȕ����Y�_���P�Gig��4�Ī��Ѷo1�#���n��B 3[M8w��Q���Ηr|H�ݴ�:P988�}v�PyЫ�r�ѣ�m��7�z�w\�͛&K��2b���� �H�<��|�o�0��|�щ]�q[�����5W�71��e��d�σqm��ax�����{�ə^�#�t8�N��l��&c'����ϕ�A`T��{�cQ�Cb���R��Fݓ�F���<C��d���ܨ�O[�h] ��W���[���7�˿<�����'��D��λ�vs��M�>:�\����$��magۭ�y�r�^�e��Ϛ��!z<n}�Y#��׃�.��U��$�������;���������W۽n��w~��5Dfu�7��ױeAV���b_&��H���4u�Doظs]�d�LwTn�Qh�-h\����E4l^����|��k��CQ�W���>�=�ˑ�ӄIe�Tea�����o�B�;�].s�>����e��� ����8+�K�eP��v�S���|���Y>�x..����l��yν��)>cd�(� �cH�l��B� �FZ��L�,vh���<�m�w� y�dQ�0z���M���Hj�+����" �&�D���vl�:`�BԠ���Z:2�/?�����.kҿ��t�_�"�l�U�/`p�5I�ԻF|�b�j!��3~��BC��0j|Mu�� f�fr��,��b�%�j��ޝ� ?>��*��~�7�����os���`�E�qT�W�� �~� y�&���M�^�PM��0��]L��-�$�A��:�Eٴ)-���.���g���b���A �u��O�6���.�0L���E���ĒE}��(�ׁ����e�E�"��]v�-:0��$����N n�/Q�<� Lp�z!ru��l=�V�#�(���D1�B-��:�-��T<�e*(�\��+����-1����'��U�7�&�"1�˔��C�� a��Lb�.}�@��w���*��[;��{pS4���3�cxB�zc �1A>S��!YZad̲p1S�^��ϖ-�L#�%@�k�sU�"��)4x~)�|�� ��T���`���cu9�-�!���ww���iw2C8R �F���s����h��t&'�^EW����9b�F��K=��Tl���h�żs�a�<�����^���9Y��8���e�v�Yz���2=_C<Hbo��a$�̀�r`���G�pw���s�
Static task
static1
Behavioral task
behavioral1
Sample
19e3c6624918a23d6014bb48f403a9d4af8c44088c14770cb7278207486ba2f8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
19e3c6624918a23d6014bb48f403a9d4af8c44088c14770cb7278207486ba2f8.exe
Resource
win10v2004-20240426-en
General
-
Target
19e3c6624918a23d6014bb48f403a9d4af8c44088c14770cb7278207486ba2f8
-
Size
15.6MB
-
MD5
cb2f3418405af755c95a9786e0a87372
-
SHA1
9672caf27c25b8d2bb6e4c6e64cd7d8a49e240af
-
SHA256
19e3c6624918a23d6014bb48f403a9d4af8c44088c14770cb7278207486ba2f8
-
SHA512
0585618cfcb457811f5103fe7f9230850f543930f697aa36f2cf6f4ca72d8f3ae47e747c1308b47309fa409723400a140f146a07d8233f9cdc814d75dd01714b
-
SSDEEP
393216:s4JQl+xxeNzi5ovSJnTg/6Y328bATmhJe8oFsTCwHO1jua905S:9Q8mNzi5XnkCC28UahJfdTHRv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 19e3c6624918a23d6014bb48f403a9d4af8c44088c14770cb7278207486ba2f8
Files
-
19e3c6624918a23d6014bb48f403a9d4af8c44088c14770cb7278207486ba2f8.exe windows:5 windows x86 arch:x86
bb3124ad3fe5eba217874383f513595b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
midiStreamOut
ws2_32
htonl
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
RegisterClipboardFormatA
CharUpperBuffW
gdi32
ExcludeClipRect
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Add
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 524KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.#!, Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.E/n Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qLg Size: 15.5MB - Virtual size: 15.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ