]]#ZЮ����"V���.�:��c@�y�ϳ1���S����w�Kρ�K��E�p�����������ѩ����_ ^����qzN��H�d���x;���&c*�%b`c��@�V�Q�����\�rA*<��{���}�Rf�1�7�|����l��Y� kY��;�6/�6����6jCk���R_�v!u$���>�����?r�1<t���B�����'����D�����NY�.�{�6� ��s<�ӎ7����5A�{ma�?E�����}�M����Zꎆ��gBa^[Ͱ1z�=��8Nf٦��B�}�� "�%a�K���XiNL��뚰��`�1"�W^E���V^7��ٔE�˫n��M�z<��+������a�Q��Ph�N@LUtct���hh�8~b����c�V�� �U�݊;ɛi*�� � �Z����I�� ")�4����[@^�>}�Ku��\�D���o��`AƵ@s��|P��j>��~w��06<��p1!�6� �*�b�Z#��B����D��R#A�M�8�Dy�Wt���$4��P�̪p�i���.-�m^J����ɹS5����X�!?ڷ'ԝ�� �;P,��I�(��.z�.uK"�ږDl&���D��]DP���Fg-�Z����>���8���wϓ�����۩���B�v���d��C2��+(H�a�NC�d���l ���R�%�7�Ǽ�q�#A�LiVCIdHs��/#���DY6����i#�`ѰP���z�>�.��u�d���w�RU㋖ҕn�v��%���5#?�k��☈ߕ��Qe5p/�,n�^��W�ya�*Z���}�ֲMGH�����Uz���v>U:u�;�B��h� 2{����4���(ܜ�j�U�#s/ 97tͰ���2�e<Ih�Ӏ����Ԭ@�Z��/����>�����2'ϓ�8��4w��}� �n��~WH�k��'~3�N���S�{�&��P��}5�1]��*N�f<k̟5���I�~����> ��D##�3t���ii�)�֧JN2m8�9B�K�������:�����b��~n0�W�&���%��� {�����5 :�����Wכ�]+���!}�^4?U���9��w̨{#'��� �#ѐ������Z��4j���0�-�(���I#�Z/ŒF�g��$�a�mk��xJu|*(%7#dE���>"�7��,�v�������q����+���^v7?�+C��H�r���Ȱ���Jc��b\��Y���'wK�c~�"��� ��ܤҾ6��L ��W��qJ�7��ǩ@;y�T�sd����_��;%�¸�s�(x��!M�a�YP�4+������x&Q�S�~�#B��'V�n�����26��6��ĮR��\9W¨R�`;N�o`��g�B��q��ht�OU9�h�`M�������uP���Z(�ݨ�ηĪh�]�`�ηS�;\��A�(����ԧ���nO�� cX܋V� җ��Ly�����O�p��1=*��G�yHl[���fR��~hZ�*��oP��i;J��U*�6=B��#T2`�A�g����G q`�q�"��z� <��R�dk�8?�3�A���D�hIS����u�%��������f�K�\z�ۓ��Y.:1�(w������ʿʒ��#>��u� ���!�Ć�S�Xi�$����Na���P��ֈa����F%e�mi��+�t[E���${ht�GVw7%��k ���ҽm99��Oo�D��)bSc"���-z)���( V��<�nm��N���Cw��uΠ�X�� RE�/�����sM�?}��)�8E�Ւ�k��#`��w�Y���t���i�iD֘qA{�B"b�Č�ֲ��}Rn'�|o�/9n,P�#�}�㙨$���T��sOڄd)y��8@s�d��d�q:x`O���,���.�߅�m#��2C*�!Ns��M�]���K��_�� ��L�b�8 ܊̥��5E��l�^ !��n�;?���a 1�)B��V�%��P���[L!m��&����"QsLQm�便<��s���(��}A��.|{rd��3����54L��t�/��V(ĉ� a�H���<�!�� ��������R�/��hܚ�L���-����Є��Y�`��F��z�>�_��zHr�x!P}�X����p���7��z9�%<�J���\!��O���vsm���d���e������T���DO���@G�$*e�wGc>\z�����<Զ:u���C�K��k�{�B�j�)G������Y�iƐ#� )��[���:����sn-b �䭑uq9�f��^ߒ���-ֳ:����R @6�#�u�x|P�xAG��Z�߳�W[0���ɹOM ڗ� L/Bd�� ý�6�\���=y����V>}� :�͠C������ʏ����?|^�v��$s���?r��#�`�i2R��� ��П�nӮ3���D|�� !@�����gKG�B���+`�R���tp�ƞ2!'����6���"-���%ޕ����ڷ��<U�S�Z��I�D�T��xۇ* �DR�(� �2����|)���Jyٺ���F�ܽ�!1+&���Ć4���TC������FK��F�{��9Ȱ�e������j������>��|eS�t6,r�p�E��{GS���F��{���#3|-UNd� O��3~���6d�M�*=����d� K����$�TH�\�=��I��7D�0�;�@���0�[tŢa���?I�A�=�B���Z�JV�K/P��ؗ 0E:Vw�)P��"?��c�X�% gl�������0��B��c˯�Ԧ=�)S��[���^�,,���v&{�= IT\�Gȶ�� �?�YLR:z^��]���B�fR�D���<����+��}|�� r�Z[��muӷ�[@&��=���~x�OJ�I;�h�TY��З ����l�:4kW�*#1+� ||Q\Ȏ�XS��=��)M���H"æ����mI6S]4���X�+��o��M��r~�� ot̀wU�|��i:Q����R�+]
Static task
static1
Behavioral task
behavioral1
Sample
05ab07aab22180df7cc0a5c4b93f595c73eb176c0d90ca8544679806d99c4342.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
05ab07aab22180df7cc0a5c4b93f595c73eb176c0d90ca8544679806d99c4342.exe
Resource
win10v2004-20240426-en
General
-
Target
05ab07aab22180df7cc0a5c4b93f595c73eb176c0d90ca8544679806d99c4342
-
Size
9.3MB
-
MD5
7cf2ac075c55b5a7eb3b8e5b64b5cdf8
-
SHA1
32c3fbad29c1eba3486fc39736cf7c727ddc353a
-
SHA256
05ab07aab22180df7cc0a5c4b93f595c73eb176c0d90ca8544679806d99c4342
-
SHA512
6acde7ebd9f6adcf9b53c9b9755152b938c5835347ad611d014ebca58c28ccb529de8a0703be21b2c41f73d7583813724ca19f74aec6dcb31521992b98ccb58e
-
SSDEEP
196608:eR+78jZNjbT3qCyQA9U2qi7lzLZD6Akw6ryYxQd/+9L6kmjvRnWZT:e4783PT30K2/lzlDDkTryYWK67oZT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 05ab07aab22180df7cc0a5c4b93f595c73eb176c0d90ca8544679806d99c4342
Files
-
05ab07aab22180df7cc0a5c4b93f595c73eb176c0d90ca8544679806d99c4342.exe windows:5 windows x86 arch:x86
421f5427e1ee443aadc0ab8d75cbff33
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
setupapi
SetupDiDestroyDeviceInfoList
cfolderdialog
?GetPathName@CPathDialog@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
behvideo
?GetLength@CVideoFile@@QAEJXZ
avifil32
AVIFileInit
memorymgr
?getInstance@MemoryMgr@@SAPAV1@XZ
md5
?GetMD5@CMD5Checksum@@SA?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PAEI@Z
daodb
??1DatabaseException@@UAE@XZ
inifile
?GetProfileBool@CIniFile@@SAHPBD0H@Z
winmm
timeGetTime
jlbtapi
?CreateObj@JLBTAPI@@SAPAV1@I@Z
cv100
cvDilate
cxcore100
cvReleaseMemStorage
highgui100
cvSaveImage
netsdk
ord7
h264play
ord84
commonlib
?AnimalType@ExpInfo@@SAAAVCMapStringToPtr@@XZ
bitmapanaly
?Instance@BmpAnaly@@SAPAV1@H@Z
libeay32
ord78
mfc80
ord5200
msvcr80
_adjust_fdiv
kernel32
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursor
CharUpperBuffW
gdi32
CreateSolidBrush
advapi32
RegEnumKeyExA
shell32
ShellExecuteA
comctl32
_TrackMouseEvent
shlwapi
PathFileExistsA
ole32
CoCreateInstance
oleaut32
SysFreeString
gdiplus
GdiplusShutdown
msvcp80
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
version
GetFileVersionInfoSizeA
Exports
Exports
Sections
.text Size: - Virtual size: 650KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.=r9 Size: - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
./ip Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Aa) Size: 8.9MB - Virtual size: 8.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 396KB - Virtual size: 393KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ