�X�f�����:t��l����nX���E�w)Z˫|Rf�M0��4G����`�<�)`QU0x�y�M�����01��`�q� w�K�݇ߜ��vs؊�����Q\-*D��36W��e����4ixxR� N�n,Us�LcL�`�Z��^��*�r^����8s!D-�;O� ���$H0��4�ܩl�K{�M��U��n�r�r#Y .ܮ�;�P����~K�J��Fb���B����[�@K����8��M��Y���D��U�� �����#HG�ð��T�¥���o%t��������yI�M-��t�Be�{},��O�-f��fܺ�6"��7�ފ&��C�]� K���]!^g�H�����\`�V0@�|S�F\1R,f!.��i[�s�rT]��ñ�yZA:M/W��w�E<�L|�Iij�\��t {Z�5�;��7�>k�yĥ�2��6��xh=-�$M���������c��1�Y�Q�q��x+�i��a�햨p���Mw@I��:��(��@��f�gKZ�aP���]����\�W��,+��nM��^��H�� ��c��`p�j��Ғ��3m�.+�K5�I�Lj%���Fc�� k�'!9��;��H˾G�55�>u���&M�Z�ߥ珃��0���Gs,�e�� ��.��R��f�I��~%|J��,j�.�.[=�8]i��Ԉw%��ZyUD1:��M}�/}¸C⅛�yU&aq�Q�r ��j�wI5��^r�����65��䘉�E�\�t�B_Wm U "o_�{T�K×.��������WCR���a��%<]���f��m�U�Ȋ?��1mcbU��a˵�M�k Y�c����v�lZN�t��g�Ɲ2g����v`��fS�HUlӨ3am1p\�ƕ+��Ӳ�8 1yl@R���tI:5U]��1݃�[��3��pk.|0�b�IԈ�ԁ$5C��A��UY���_k�l�K &�I�3��\���%�(t��TmGb�d -~�J*>h��R3&&z��&5���x�f?���+fS0��'7 l�D!����L���/�G��؟����ק�J� \-���|y�e>P�B̦�"i%�7O�Nk7�c'g�Jx����-<3Z��;�G ���Hei��\����=zr����x�/l�Z���� Y �V?�M���/��=C�q~���/�F��N���u��"6w,��s��7��N�½�Ҵٕ��U8@�!�t�Ʋ�|�A�p����Q��ĉ�[�"��7��'��ԪzL0X�1����Y�0��t2�PLt�=�²����S�&4��φQ |�%0ˮ�O<5o�;��(���ꏏ%lc�P��]&ߏR��h�|��0!l[^r��/ ����tm�{�L��a)bjQ�%#-SZ��/�j�'7#�M��D�xn�� ^��e��(���![�j����M�Ni�a��6�� Xΐ�äx��4�En��B�J�y��Ǿ��K��4� �}���qh���;�{��=g��"�e� C��?P�zVr.�Ep\�[6esU?�M�;E�8�F+���y݂� ��v1��ޯu�LP��-M��~��lh=�Ę}�#��Ȫ��:ҿ��;�������h ��X���6vqK)��� k^�F�ځ��=���J2����M=4����a C+p���\��bw:>���k�_3�*B��w�'4t�p�CF�C��p��4�}���j�?M��7��8���s�J`?�7����M�)T����C�����&��4��aW��d��^zl��/��0��"���Y���J)Ɩܝ9��*,�V�$�6*zH�%a���+1=To�� zG���#����Z���ۋ8pqp�T�\qZ ��vWR(5�M��9� �I�L\Ņ3���ˈj�z~y�����;������l��~1�x��@�����'[Xip�_����nY�" [Ӻhvy*�0L|I.���'[D#{��a�b>�f~�H�bX�gį��ʏL���R֩��ʰ�,��ѕ%@f�3�,�����oYՉ�9�Y;]N%O��'ik������N{����Qy䥔7�!�aw(���#�X���bH?��u:&m�m�:#�V�X�����fi5N�?�2d��~������p���,ό��/�4�g����r�O�n/O��k#�-��� Qhח|-ͫ2���hxԜd;:ӭ1�c���J���v��A�G����-mq�ҳ�\���<����GG�`��-�� ���*U���s�}��Uf�G���O����bk@���>C���žC������tn����OK�3�n2����_#ћ,�%�85 5���bjV3�a��� tܪBy��P?���q��r��!pa��2�~a�+)�ğT���&4uQ�ț���#)��Ӹ��if��}�ǔ=w�j�ݮ6iE� +}W � ,�$Y�,'JN�� �y���az~0�C>"+}��9��_iz�hk�(z�_��\�>����ru�n"1vЅ ������9�lԞ� Lw �jdc��wR�ѓ�*DC��ǥK˟��Ɏ/�o�0���P4�j�Ÿ6oa����D�4h�mW���`*����{��r�dNJΗyk�˭_����&�*^����� �Ȃ��@���z���Eq�s��^%����v^jO��m��C��W�iɽ��g�j�GP��28�E���1|��S�z�y ڿ0�k��VM-�B�~v�j�V��%���+_��'�%����er좷���B�z ��e=��$z�r���[i4�Z�5�$���rA j���\]n�����4��|��?��'��v~E�m#�A�;���'�� MX�L�ݹޞ�*$Qޑe_ rh ��k�AK,+��HfJ�N�j+(�P�jz�i��r5E�%BXD� ��$�F���KX<a�]�������7�?c�� ́��D�E� +IE̔�A�Ry�~�%E>��S�R_'|��eHeh���T���Gv���4?��@�0�R�}`,Աb�}�/Ň<Ȗ��o�A��$��v���`=QA�Ws#ےo6xcW?k��L&_]��9�U
Static task
static1
Behavioral task
behavioral1
Sample
d233cddc220c7af38f97dde5882eaa25b53dad53103b30fa01f86d97a82abe21.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d233cddc220c7af38f97dde5882eaa25b53dad53103b30fa01f86d97a82abe21.exe
Resource
win10v2004-20240508-en
General
-
Target
d233cddc220c7af38f97dde5882eaa25b53dad53103b30fa01f86d97a82abe21
-
Size
10.1MB
-
MD5
a49843fad8e78f743e5c9ba4cfd6c9bb
-
SHA1
a7f628b9616875391d0b74e6a9c110b75e550ad9
-
SHA256
d233cddc220c7af38f97dde5882eaa25b53dad53103b30fa01f86d97a82abe21
-
SHA512
373f7f49144dba5f87e2a2f0e9cc3fff8a2b640c157ef6a5d9ce4727f9f17fd30b1b228bfe5205a5acbcac9d404546623c4636c78ca5199b58dca70a720fb196
-
SSDEEP
196608:A3Eri0y1CA23TnNxM/5FiGy+0MTcYkthWX1RXyv3S:TrN3/MM8TtkyXfi/S
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d233cddc220c7af38f97dde5882eaa25b53dad53103b30fa01f86d97a82abe21
Files
-
d233cddc220c7af38f97dde5882eaa25b53dad53103b30fa01f86d97a82abe21.exe windows:6 windows x86 arch:x86
f972fe97174d50011cccbb22e0696779
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
iphlpapi
GetAdaptersInfo
winmm
midiStreamClose
ws2_32
accept
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSysColorBrush
CharUpperBuffW
gdi32
RoundRect
winspool.drv
DocumentPropertiesA
comdlg32
ChooseColorA
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
VariantCopyInd
comctl32
_TrackMouseEvent
Exports
Exports
Sections
.text Size: - Virtual size: 671KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 349KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.+lm Size: - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.=|n Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.<L- Size: 10.1MB - Virtual size: 10.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ