s-�o� `bC�y�LMaQ 9H����h�څ7%Ă=盜����<D�֧X��fP��S���+�n��l/nkjh֎�#I�u� O��>ԃg�xf�s��AC������؇RQw����1V���O[��v`K�������%s�#eɃ2��`��ВӒ�I��y-�xEW/S$xj;����3�y��QՁQ��: $�#2��k����Je�Q����یp�����|��]�~b�>��HF��v�D�rT(�Q�B@>��'Ѫ]�;dӇd/�8�� �^�(ſ�5��!�î�Ɣ��m�l^��������?�h�Jޔ� ]P[5��Z�� � �`��^�Ae�I�7��f9�`��n��M�>g���czE��}�LDe��p�h6# %LB��@�Ip�(�j�n�����O�� ,.��P ���x��4���6�b|08���[V�(��Q�Wt����TM�9o�M�K�WyC��������+���=��Oeˊ�L!�w�E��>:�[�[�g�n��`��n@�d��_�xJ#���R��~7�cf#K��(��R3� �H)g"�r��]�a����R)8��K����[Ǯfp��F�����,���h{�W��B�l��oA ����bx\��c��3�%>��|�㩚?u+>��@��Q���3�Z���\YJ��ߺ�������E}�X�8h˔G�\߹�W����')� �m�ǮKK���n�|���Ϊ��8��E %��\O���13�}�w�z�iJ�?���㾢��q���IQ�fJ�;�3(�"�E�7�����]����^=�`6&�5-&�[~���>0~i'/eՐ.ۥL�濃;6'x����\���qni��%�_.����,�1��t�P*�����9 �M��}~����7i�xJ a"�=�,������`W`"���u뉮{���]dB �����i)촉 f���O���]3���� ��c;P�qO��巪��}��x�H1U=����*�xB6��)���Y�*�Z]j(�P �T/oYsm�� ���чȑ���w�x���q��ɖo2������t�"ӄ��=�P�N�*5��x�]��i+w��O�L��<�p������A&;*��6H���9{_��ˊ���h�9 _TMG�)LoĞ�g�l^�[$:�&'��o���60`T�[�_���qDE��½�x0"�ț�dN :>���et5������ji��`� ��Ƿj�4u":uX�<4 ��J9JC̘zJa�-8��r�S���Mw�-X�����H�%؎vE!�%�@nB~c��N�3��������p)�t��>.Ki�D�qע�>L��rv_f��4������v��R�ԍ��J�`�����>�rg�y�L�t)X" q �r��5�{�'�_�5i@V���81���u0�30��(oMD4!7��"��8���Chyɜ���c�s!�Q�7s����ysJq��]�M��x��#k���y�*..�)�w�8�:t�U"p>�-Wrz&0Q��}o��+\r�J偯mGz�I�[Q7u���BU����@��{��z�=)�[��S�z�@I��C��(�椙,��Vm��V�TF�C6�_C��w^�i`E��JG���@癫�)����K�'F6ܤ�OޑZq�����&sj"7B�ރ��dhr��X�f* 덽���CR���D���0\��w���$�&����o>z`qkʜ�$�o�%�oNR�qG2��kPȪ��F�V�%K�et��I�A���t3���h��#By��$���|(s ��XuxXEG]!�9 nd��� ��B��� E�D��߸�/vקN ��teU��;&� ̗���(ն����_8y(���{&;u��wTx1���8$�qw���n�d�n3�!*�f��Xb(�K!+҇8}!�'�&}����Ei������7C�%���=��K�������:-O��l,��̈Ag�܂��涂 �ȳ��b�?D[��66p�;�G>���s�Ox!G�gҝ�����5�_�5���yRʠ�MvL�K����:�� �U2$��E*;VM����[^��<+���L���D��f�=/����w+Ī��|'�q�a��l�Wp���(��m�d7��m�S��h�I����۰�@3K��A�~�C���d�P������'u[>��>;��8���L����aq/MG �6C�\Rs�� dJ�u\��/<+�ZPm^GӚƫ-�1�W�U�8����KPGT�d��c0 M���W�T�Z���i崋Ԉ�@��Д��WlVP^�9*��Fhơ3�b�2�h��"ػ*�e4|�ɾE����8�`������ԎoH!�}�T�"R(�5��-X�<'i�f>��Tɶלu�vV�f}��5X��w>*l���Ks��s6�+�>�l놺��㪏6�ܜ2Lq�̌�y8����"|vg��,���ܒ�$�����5IT�F������}��\Db)�ZL�AKR?_��<�%6Mc�p#�pk�+���8���ε��Ҍ��?��a���%d�f�@eֻ�L:����3泱~&���^IS��4����I4 �Om?��'~���vXK7Q�P��:���ԧt��8j3�7��Ќ�,}��M�3�JOsr�y�����cFP�_�My��Q�T�ii��wd �7�4r�����n����/`�r����0� _n=��28$pp���FK���}���_���O��z~m��q�Rث�%:�V#+$��*���VL:���AW�r���[�U�2��l��l��;��_��������-6���LzZN�]�|oҮ��+��6^Ԝ�O�k�a�s �{�a�M8֥�������EO�����0�A1��.�qg��j���{��r�1�Q@<>��E�r�xq`|<�s��� �|�FN���S�4|�-T�S�r��څ���`�� �yb���z����\��kJ*Y�_d[���J�8��H������Z�&�tn��D@Tٯ@Wtt���97`�}��;R�W�3F�ޝ
Static task
static1
Behavioral task
behavioral1
Sample
9e3cba5da7ec6c6b6257d2c9b285682f08981da48b678dcf4f8f437baab93f68.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
9e3cba5da7ec6c6b6257d2c9b285682f08981da48b678dcf4f8f437baab93f68.exe
Resource
win10v2004-20240508-en
General
-
Target
9e3cba5da7ec6c6b6257d2c9b285682f08981da48b678dcf4f8f437baab93f68
-
Size
11.1MB
-
MD5
33c93af1712a36263195cc95f9fc8578
-
SHA1
d64fa49584cdffc57224bc41a63fae38e6fbf166
-
SHA256
9e3cba5da7ec6c6b6257d2c9b285682f08981da48b678dcf4f8f437baab93f68
-
SHA512
438ba2c829f03659654e1592b47eb471046b39a75802fd61d2d09f0dc79629501de18ab33091a7364dd4dfbeae8358983185b216e4e335bab53f94a10f07c94d
-
SSDEEP
196608:aYvfcOsZssl/PlpnmEXvAL4zN81eEM4ENEEtkThH8G6IijLZ52AQ/ZcsIAUv5S:fvUYslHmv4zN81eEMTeT6PjZAZc/AZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9e3cba5da7ec6c6b6257d2c9b285682f08981da48b678dcf4f8f437baab93f68
Files
-
9e3cba5da7ec6c6b6257d2c9b285682f08981da48b678dcf4f8f437baab93f68.exe windows:5 windows x86 arch:x86
fc179892df4949e2ae68a3c341a3bd4e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
closesocket
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowRgn
CharUpperBuffW
gdi32
TextOutA
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
OleRun
oleaut32
GetErrorInfo
comctl32
ord17
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 758KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 904KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 305KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps2 Size: 11.0MB - Virtual size: 11.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ