�����r��9 �m�ҖL4���ވ7�����G��|�����E��%�J��gT��1E�� ������5CMq\�( ų����B�Wd��3\�7�;����G��*��S�3̿d��-h���B۞~���VY#N����r.�X"�úF�V[��P��}��t���q���3��蔭��:)����1�$4ż�փ��*�,�n�{%�|?�Qh��O_��c�aʼn�9r��>ۃ�X~�&W�,�����<���4$��ȼ֠V8� ����J=�Oa��&�^��{)�:bܧ5�}n������Ǥ�WL���&@:�T>��w�;֑In���O<riغt���_�$�����N�_�*��⎷��cM��X�Ř�7%������`�q@��_��]�&���z���Q0�q7аN� ��F�=�2�t��e�q�Z��V�Z0Cx��ݏ�������%3ђ_�W�H߉��o��Nu6������ @l�:��0p�(7�ps͵��;D��ё3:({�p�Ư�����������Nxy4^a�d^� Q��>0w�\O7���+���)��HNk�U��7VB��0����id���H�@BDҬ?����^� �\��+F ��~�Dҳ���G�(����rUL?�v^==�X��wFθ cՍC(dbʱL��Ͽ�y�Fyj� ��1[2��'I��Ԫ��u6s���bz�4��}�9��/��s����MN�rnt����#�[�axчP9��6l0.ecY�RF�^>4YV\ϩn���>Fo]�X��lf�������Kq�b��r�f�ݷ���r���� k�WQY/|x��n����H��.U��(��C��`�ۆ����s��)�T�ꠑq�m��8DcW�K�_�/�(5u�!�^� ��3Y�p��b��!C�#�<��;`�0@����T�RzCO�W�{T�u�e�w��^�5TP�y��@ҙ���.�h|��[��A�38Ŋ�%o���V�H������K�e�WL����v��d`���T˒����[X]4L���)_ܒ��h���k�HcY����� >]?b��� ��?���t�rڠ�Itg#�d��gĵ,�=Th��d*A�\�1�K`V� ��Q����S���=������mp1)��v> �3��`V�hw�[0`b7�{]q����ȐB����92S\���P����Ƙ9zQ��.�IQapꬬ�i���c̛����j=��~iOX?���C�:���� ��vR���ACmu���c�0;{��[����O��#vD����M<�-��_������;�U��-T�m�T<Y��� x����moE8�+�����>]D�u�X��s�Ԕ�W_�� 8��,���a+�8n\�0���g������N�I�mV��D�5d~��1��Q��D��� _=�1�:Plk�$F�Ƥ�����i��6fd.�׀���ۤRj_���~��m�����%�ބ�h,����V�Qj��D��U7=Q��!;��s���L�)p}3��^ �\8d�N�������������2ӔgʆyU�X�ӏ:�8��Q�F������aT�����`ن�1�x�!YZi�?��"����#����U��F1B��j >�߶��Ґ4�W����r�<l90 2��z��NtI`g��?��5-��, �3�nE��� ���S<U &�@]�G�����J��}$z��q����p�:�v�ǭPТb�RF6 O���;-ÛX�I�A)=�`j�tYw!�.O�Ӓ�N}@�K��|�1����bh�oi�,X������w�V���ŋ>��+q�ȅ��3a3��<z�}�v�=q�b;��o��u~�^Hn,9���}G����O�R�d�V�9�P��~ErzާY��gҕ_Lv�\*9D�>�c�#�):7[�%��x�(\��#Nvj@Ck����2�_��pY�`o� ��j�`��J�duj}��(�xT�{5��Al{��s�N�ྌ�����1b'�k�w�k����u��a����)�(V�����z5�nw0״};Wks���kb����!}��#~�Fg�<ȗd�_���9��������.��2��θo�a+&��U+KEN�ِ,���g�z1���"/w�$�/r+�7��8��4 0���<x��?�wqwv�( �zM�Ñ �hvX�l�3j�uVZ�vʖ����z�{/��f����u*�5����CV#�y���%�A��·rx?9^6���k���Mk�r�)�����Uɍ5) ��*��i,�W���9C��� W���sZ��Hm�G��B��}!NG���;�HCL��T�����q*�[Su�+��ڭ�&�r�5�b��5(���P}H7q x�����q��Q�y��YP����Uo"F��(Ұ�ߟ)Z�T�A�m�8�-��W��bh%�)-���2�,~f5����#�O`�a���-ӀX��&��������Ai��[�^D&� �]��檕�����>zɲ������u�?�lQ�aw��s�(�� �g���uj�=���8��^H��a���:�wU�`�g2ֿc�Q��q�V�ly姷�.��m�h�m�i�Z"�ow�S8��9�f�"6y5�r5�=&�4S��}�i|&^���T�e��}������I{. �V�����;�7����Q�� Y_1��� �͔�'Q���M}�e-s��}"%|��!]�]F�葱~��5Yi}�Y��`U�f�v�uڵ�{��-���S$SD=8��'��\Cz��M���/����Q�N�����M�={*���|Y}�$7���uhQBKGUw�c�\0[2^��ƽ�$����wA\N�뚠��x*uP�0���9ŕ�K)y8�^VVb����U��]��C�귤�.]d�\D3M����`�U�%a����m��B�(Ǵw{�cR�ˎ�u}$%j���� ĝ�(.�͋��UEt��[%S��h>�693]n�dAIt�#q����(�4#��ZC�.��Gܗ�<X����5s_K�W-#��^1V��,��
Static task
static1
Behavioral task
behavioral1
Sample
37b8cfd89463f594b8bb4683f4c02c6337ad1344ae312e221b548ae877c4e131.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
37b8cfd89463f594b8bb4683f4c02c6337ad1344ae312e221b548ae877c4e131.exe
Resource
win10v2004-20240226-en
General
-
Target
37b8cfd89463f594b8bb4683f4c02c6337ad1344ae312e221b548ae877c4e131
-
Size
8.8MB
-
MD5
945d70810070328071a28086a9b6a813
-
SHA1
e89ddf53b9be80a96d52aa8950dc45c0ddd72792
-
SHA256
37b8cfd89463f594b8bb4683f4c02c6337ad1344ae312e221b548ae877c4e131
-
SHA512
e6caa3131be64d79f1e2a0a9cf2c25776f2a73e9f444f54ae6f5d0f869b66845e846741097d5abd7a354ad1373ace5936d14a3f2fe084d5b59c73169e00b0943
-
SSDEEP
196608:VxCJO8bpmaFdUr8YYx5BcnzvnT2jHy8LSmG/bYr9d/4+:98FmaFsRzfyry8LVG/a4+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 37b8cfd89463f594b8bb4683f4c02c6337ad1344ae312e221b548ae877c4e131
Files
-
37b8cfd89463f594b8bb4683f4c02c6337ad1344ae312e221b548ae877c4e131.exe windows:5 windows x86 arch:x86
6f1cf76e53e380cf60917f70c2aeb084
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamStop
ws2_32
WSAAsyncSelect
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindow
CharUpperBuffW
gdi32
TextOutA
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
OleRun
oleaut32
UnRegisterTypeLi
comctl32
ord17
wldap32
ord29
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 903KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 332KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.uH( Size: - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.'t" Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.S'B Size: 8.8MB - Virtual size: 8.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ