LW��}���O';, ���O��Dž5�~ ��d�F���+�w6d�;��lDq�:x]�a��n�oE�{5���h5��d1���{���Bzn�OR̋D|17I3������� ���p�n��8����y���&� m�'�㗧��:���Y� ȷ�V'Y�bh_�ۘ�r�U؋��g�+�g��pʚ�,�N�Q~����.�(�봴6��w�7c��RA49,U`F`˹�{�ޯ�����08�eO��ȕyO���"�c�O�#�����h#�a���TgP*����|��j����7/:`u��YQ�����`H�ʥt�ם��!|<�5�fq%������de�v;G�� mh�zn&���^N�P��!B�_�Q���Sj��y��|\���'��P+�����-��u����#(�0}2�M�������U=ء����N�d�l�.���w/��'�,�(Z��tӃ����d vx�ꉝ?pC�A��qc}"� �1�ŷV��^����ǟA��� ��+%iK��P��i^Vk���}d�~�GM.I4�'�/v`���?�OA�Ѹ��t����i2%ݸ�4N'�0��먁�c�/����-SS�Û��FS�� ��ӆ��K����Ն=��ZB/��`;�a�����Y`["@����)эL��19�-S��ܢ� ��2��q61�C�A On�M�9g����wVf����6���cg�8���$eB_y�@�O�����ͤ��M�� ��":�!;�f�@>�u��ħq%a��% ��K��ԭ����c���!��ѓ���lm=�G�����*�Gf��Uݐ���#qn(����|q�K[��r[�re1����b�4ɚu�L0���X�����g�~�5�,�8p�A�:��e�F�q��os���0n�Nj����w����ݠ�T��������b)Ca؈T�P����������������m��a�1>�4ݠ-.�e��L�f9I"�v#fq}���3qs�r��@��5=�G���"�x!��"�;����9��*^�ߘ/*6�Jb�q/�K(&N��m��2,(*��[��k�2�_SC���v���/ *=+4J|�]�M��ɱ%db�Q`�M�f��fc��EȮ�����I�;ό%o#'lNntĤg>Ƈ�'�I㬐�7��4/u�EŐ�o�F����w�����37�ke/������܇����*h�_�|\/�0��s�,�{Ӕh"�P��.�Hѳ��<s¡Toj/!��+Ҫ%P`� �*�� Amh�յ�aK(�Yc���^�6���� f(>��kc(�%�v����[e�ojy�; �}2K4�6��Z��+p�.�Iv�Ҭ��b�~��h�;F������0�I�@�..�j����ڸ��/l�A�ex��F1��b��H�0{��H[�7#��!������������Ő)��g{�ZG���f��C�A��� �'��ϴ. 0^Jl�r���Ȅu �Ʈ��.��v������R1��{:6��3u���*� �o�.�n��|�@�Ws�'fz�UP�k U��ݜ ^<^�91����?Ht�r�d�����h�#P���լ����^Щ�����6��DZ���Hz��74���9v}���uM"��N���HE�w�.G:TQR#LwP�& ���� ��v�Q|�`�� �� ��?����8�S\���V��9��z5J'��~{�٭�:�g�N5�i��.���QP}��s+s>h�-�����̊]��(;�)�~3�a��GA�R<���h6 ��+X)�:p�e��D��J��q�N-ʉ��.0�����yt��a�ř����="��np��������"���Ա�)IcW�(�*'�ϥ*����� 'S,�m;Ͷ�Vq�Ղ����(Z� ;��Y>1Q�J�>�O�o���I��̒��b�;FQ�ѣ�u�����ٵ�JÏ�w��� ;9��0�>=��wK��j�O��m���b������ff,�x �[,W^L��nz7#k�&��z���"�˟��)�p��z/or��ؼٍh��[��8y�Ƶ�eWՐ�p,/�Smz�`HC������Yh;�Rw{�(���[��?�h$���j�MDj��D����paA��-���॑�n�ı�t�o���ۅ,�*T�EdY�gv3����q���w`�7�T�͗�?F���'��T�_��#%��2�m��P�p�ݏ�հD�5h62�4��ǷW;Y1ŶΖ�MD�YW����d�M�tyv=�� ��̐U����I�9�/DV^���� ��N�C�� VQ�X�R`��"fl��@��i���'t�ad~yF���p�b��s�ǘ�J���*O�`�S��Q'��U�Y�1���Sk��3�(�jj�G3Ԅ��&�V��%b� �d�l㞇�}r�|� ��ʌ\�� ����Z͵��_���d�'������ƀ.<6����4�#���G��j&��m�dy�����k��� F�uD(��VSΝV�;� �Ó�:�^�������3��.����?IV��j����V��U T%��T]"}��j���E� �r����e2N� V�LJ�mb�&��1������{�<��x $��������p�am�T�e�>���7�i2��wF���B'`9���ˑ�zx�y�]X�T��e�It*G9�.0�o������=��<D��që�l�6���+���4�wq�Ψ{��(FtG�t }�!�R%�����/������l�;��5 7���4\-�78�?�E���ZTU��bc�ګU�����yD�rԠ�\�6����{����Б�Cp�ƞ���|q�o�\Z:����O"���,��/O*}Qʧx�3Guts�yp\�`�5�0x85=�x�'&zD|�[���-yJ�����!��}�@�3H�/5��q�J�S�Ec����� ��o�Br?�հ�ʹD���ͻ���B1���3n�dl.Z��[ע]��Q���B7ZI�W�Ća���� [s�-}T���B�O;�3*8%��������iW��kЮW�2⋝XB���9�@��h�$�uf���݆oB5$+F��
Static task
static1
Behavioral task
behavioral1
Sample
f7e42a889c38d190fe6ab19b6b2fe5214faaa6d7358906f4dffdd9ef32a60077.exe
Resource
win7-20240508-en
General
-
Target
f7e42a889c38d190fe6ab19b6b2fe5214faaa6d7358906f4dffdd9ef32a60077
-
Size
9.4MB
-
MD5
1e13a2c8658c586222fc60facdc50e19
-
SHA1
b695c2cf8beb572fb2783742298b62d1a034efae
-
SHA256
f7e42a889c38d190fe6ab19b6b2fe5214faaa6d7358906f4dffdd9ef32a60077
-
SHA512
e490daf6063068f3fb27372d857c3d51677f4d744982a4a8d5e0fd3b3444287e5d67b91623baa16f21267262148ec0c5c5b4a27b54fbb37f90ef054356c702c3
-
SSDEEP
196608:R7bREPzZXyZ+n25iBtIzqNwmpOdRTK6lr3fimWDLlEQVZbtV:R7bSPzZCZaI4ImSg0xlZW3XZb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f7e42a889c38d190fe6ab19b6b2fe5214faaa6d7358906f4dffdd9ef32a60077
Files
-
f7e42a889c38d190fe6ab19b6b2fe5214faaa6d7358906f4dffdd9ef32a60077.exe windows:5 windows x86 arch:x86
b99301344e5e42bad1ca124c839d7119
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamRestart
ws2_32
inet_ntoa
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
rasapi32
RasHangUpA
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSysColorBrush
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateDCA
winspool.drv
ClosePrinter
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
VariantInit
comctl32
ord17
wininet
InternetCloseHandle
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 553KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.YearsM0 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.YearsM1 Size: 9.3MB - Virtual size: 9.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ