d��W�z��n{���`>ʧ�z����v1�[������c�����3w&4`9�:�KB2?�����O��ȓ&kg��d�H_>ay���� ��Ϳ6F��&��'AZ��|�3N�㋯��>�&��}X��} ���UZ�fX����1�1rc��GЧ�=s&u�˄����2_�%B���o��Z��լOGz��yT��N�ʉn���Q�z��C����rSs+j�ʛ��H�/��t�ٳ�e�+�'O�Z;X�g7��]�����H��������`�i�&�E�����$�4(�"Q�vyzXn��_y�,��v�����{�������JB�؝�5$��B~�VΒz�����0�FD��⤭FP��:/�]Dx+�̰�=�����ϣI����9�ե R�ց��/N��w��'�O�l����Jʐ�g�]T@ ��"ܓou�3����a�2e�`ͺ��NGA��KQ��w{$�opJd���s}i�_��~@�$��Y{�"j>uR�T8/ �� yRM��F�����ݢ�Rf��QV$\�������C�����#�˨�����Y�f6�|����$i;x&0T�}V����fhn�هc��"�B�&��a�w��(k��w��!Int�g��XUF�dwg��zp�z(GϦ�ldŻ_��Q�+�9q@�2����jb�ϫ�A�}�d�l�:��6�aa�FZ@�C��\�����h�^�#�����f�v.����}��5�B �Y�5�E:.:��5�o�ޘ)���! �*\.��!�A��,�Ζ�< %/�8���$���^�nz���b06�9{�Q��b����*ӱ��!;��Ha����['_����eU3[NC��y���eG٨��Ts�U��?�{�2��ցhv��.s��I�/�rrJ#_�������c.&\ ����;��I|�%)��߭3��9�����)�G��]��҈������]�O���~�%�OW�V;����?^�����Vb~X;�Cԣ��P�K�BDߥ��mO�W$���ˢ� ;�x�ũ���+��y^�����->�/��J����w%��_��P�|�|[?�ܦ�����l�-���е�K��Z��m��� VЍ���4<�{-����� �����%P�nG����Z#k�� �IJ��@�Ù��)�0Vr�N����"͝0����)���CԴ3�:�vC�R�#9"�S��z����}�\)�$ʿ{�?ى�@7�g^�X< >�R���s��&�9wh���|)J�dE�b���V��D?�D'�K�6r�Q�v�~��{M6��9���7�=וX����*�~c?�`�=��!�!wġF�QO��pu�|� u�3�!��g `7��V�y�mj|�~�T��xh9�����_���֝�N ��ҟ�/���=�8&����~���C�,��.��pr�Zt��D���H���}0G�\F�>����ܺbf�mV��0VY��{Q�t��n$�).���Ⱦ��Mjw�72� j��nU?�Њ�oS�D����W/��H�8=�J�V�˴��_{��*Ȇ� k����v\�o�>�6 %W�� ��2�5>�D+���$��ZrfUs(+�����T��'���~����?����t�]���@�ud�63�O��؍}Ȅh�8]Y�ڔ�R��"��F��\15LQ��Q��e�d�"!՞W���(,Z�����%��y���r!�D��E�C{j����̋t��:*�gJT�w���S�'��j�B:��@�rx��fe4�ʓ�P����"̊YS|���e�h\$���A��\O�U��$$���O���%�5y�r�Z4V.A�&+��`�Y쳐�\�^�=:�~L<���!/��p�^�|��������a�nD��ڥ�D�z40l�G�k`��md�;����O!������"{)b�[B�^K��`�R�L�o�����4��1_D{�%�լ��� ,_�=<�ޡ5>5��I�͑�{!V����q�C�1��}A?�rȖ��@��{��G�B��3�(���]��Na5.OOO ��|y/i�8�U�*�c�L�A��(چD_�ٚ48O�C���WA*;�Vݑ�IP��g�k���ߡ�kM� ����"!�U�9��PX�4��T1��d�����O�Jǣ�LJm)�(T �v���7�7���%��K�2����ۿ{Q��!�B ��A ^� WY����H%S�|���XwH_��C[N���J���mI��*ʇ�dP��h졕���@�l�@�?�G�t!���#e\Vo���d��J�z���d:���� ���"q�xΘӰ �u)�J�V����[� )�G�����qnY�U��=&���%{��S�����/we#�D�~����%l3�����b"�2�����B�,'�[���JH��[J�z�o�6e �c�G�=v�tGZO=@ohT�y�0�?�G���Ֆ�]=� �Xgb��:̥��Z�v�J� �Ԓ5�kjt����VV���<t+���� T'<��u�ڤ���d�a:8輦7؇Y*����^ѷ��qQ�+]_GS���|�n�ީ⡴�h�ww3��hj���4�=�D]z�9B��,0n%~�ahCݏ*��7\AVږ��Z�R�_�TT�w?B�(j�D&�W9_��%���ӵ2�w���FaJ�4�bY�i��My��{��������V�ZfP�<���k�q,x�ph�v,l�5 �dg`���Ҝ��U�!�dA�D*�xg��3S�T�St1J�R�פ/Gv����9W����������(���l�" �\~��q���^<�V]�ht.&H�-�Po��Q�����iUǬߋ�*������W���5z�0BC��ܘt�:@�(�&��ԗ�' ]���Y43�̘{����[&�3�z����)��2����\��5�l)��f��=��?Œ���+�vvDZ���ڲ����>�� ����C�ơP������W&(�B��̲�^�}�WZ��WGT-f�)�&�v��^Q�p��ԑ��sGCS}ꯆs�8a
Static task
static1
Behavioral task
behavioral1
Sample
50766f44c1c81bfaf418b1650b5e28185023367b05a62822ece75a2caa7328bd.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
50766f44c1c81bfaf418b1650b5e28185023367b05a62822ece75a2caa7328bd.exe
Resource
win10v2004-20240426-en
General
-
Target
50766f44c1c81bfaf418b1650b5e28185023367b05a62822ece75a2caa7328bd
-
Size
8.5MB
-
MD5
cfa441c284ff70dd573d4d1b43beaa4e
-
SHA1
5355a6dc5a277d1977d0881a3a12dbaf1e489d34
-
SHA256
50766f44c1c81bfaf418b1650b5e28185023367b05a62822ece75a2caa7328bd
-
SHA512
91ff14afa54ab9a42b4dd0dc5885df13046a4b487e17803001eaccfddda9a703308a92938c734449f75339bc977d9ff4785cd3e84c4d699d197aac47e1dc6e28
-
SSDEEP
196608:TTGgPaNsMTfHzGbJLXYIqABcC/6eOJH+0v+T:TTGgaNsMebJLokBA0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 50766f44c1c81bfaf418b1650b5e28185023367b05a62822ece75a2caa7328bd
Files
-
50766f44c1c81bfaf418b1650b5e28185023367b05a62822ece75a2caa7328bd.exe windows:5 windows x86 arch:x86
a1787ba15168360fb0f2bfa0058a5d40
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord2414
msvcrt
__CxxFrameHandler
kernel32
CreateFileA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadCursorA
CharUpperBuffW
gdi32
CreateSolidBrush
advapi32
RevertToSelf
shell32
ShellExecuteExA
comctl32
ImageList_ReplaceIcon
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: - Virtual size: 262KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i`9 Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.RQp Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gN| Size: 8.4MB - Virtual size: 8.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 84KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ