7N+� �[��! ���|/��x<'ւ_.�����jymr�]� �* �܃����1�9���ݾ(��4�Co��VLOI{��&�$��*���?$��(����`�P��<��a�j���� rh�7����Dž��Y�e����U��ʹQ0�om��C�ふs�c��<���'P/�蔿�B0LӺ �s}I�6g����-�&�L��0���˪㴛��!�a S�����o���qa�fC�"����Ӹ+h�'��̀��R8�������,뫹��-��Wv�����3��y�5��3Aw�|$�������{���ū���ɸc�r��7(-HsP��O�i���z���59����֞ފ�D�:�;a3��z���ڛ֩3M��,�~��[,P��*�!���ZF^�=p�H� �mP�PBtk.�z2�-UX*���ff#;���l�����~�BWB�g��������S[:ͼ}?��?�MB��J���9�%&�����Q�ќ���ȕ������Ѕ�1�+��Y������\����Q3}e�At�Te������q�J���8 Z�����DO5چN����T��"H�6���ޕ���H�D�J��/�ky vlQ�|�B#&8��+SDE� q��� ���F����~�^�+kK�� ��� n8�4�,Xe���4辫mYh�k��-��^}�H�Ģ`�x���oUA;��e̘��[ ��jm�9��3h����uU��̒���Y�yo��8��f��v�F�v��d�7���y"f�M��f:�X�Rf�͗�'cc���G/8�oQS����c,���{)@�!�B<���RGc:�^<c�),w6Vex�*����w��˒�=�`Cd��i�G��4�O�,��iӗR�ҭ1��T��~T�4���72W`2��� ���7f��' �DW�8��#�ڈS� �9<Q��01��B�TQI�o��+�͌zu�t^s�ıM2 44�]���+b�_E*������Z�ٱڙ�Mv��; cwBТ,ۋ0���g:��f��5O�@��N[q��zV�2� ��;W��Xj�嫋s�_k������e���g��*1fDO�C��Ϊ�=��$[*Sud�##8�o�^��fP&�r/�2p�:y@��95Y�;m=;��������k@ �E��NC�.��op}�����ƼE���Czd;�ZW�v���`��2]7���oL�a[Q��F4V!�Jɮ}�o�n���8�A��m]{��) a ����C�A��������BEm�7%MJ�q��%�3������̑�a�e`sh�ӘOE��SQO���� )����� ���hS�H�r�4a����[ J��E�:"��iʟVV��Q�R��c��Jq�+�F9":��C"#� �N|��I��K�n���d;��}Qm�;A���5#��kGe���?qigH:�}�W\2͟r)����-@c3om�~#[��q����Rf��:�� �P�����k�{q���^e�\'���nO��6�.�u�BwZ�S���|� C�k|��>�^�f�0�LvK�*V����TWe��� sfi�W�tV��?/��� ��uk紲Cn�|��fwļ���P�����d�`�Wr,5�.,6�xN�t��I�6���W#ܗ�t_�mBm��F[@�F�҅( �+��>������."F N����s���6W�T��hE8@E��!w�����viq���H l��Mg&�ćQ08V1>�G؍X�i;�)��f�{[��y`��J�.��B�!1�����xnc��x4T�f�\�3��5��5��X*"M��K���+ƚ J�������nw���}���Ċ����>J�l����`����>wD4� ���5O��Z�����[yC�����ֿ���,�Ι���d�� �.�;,xi� SN{�f)�@��c��OSdWE7CECKi���Ԍܲ���g/��K�vy$��5E:�I�V9&��,2��d��Q��egz������|�A��ʐ�ҳ+*��x�Ms/��VOB����_0Q�h��8�[���ݦ ,�T�|ص��Hl�?��@\z��Ʃ��:� _�v��YƄ�J)��|π/��,������Z���r�@��3��z�2��6x�y�즨�uW��n2s��}�r� �����p�~&��"u��z��svMO�g�x�Q��Z�%T�6��X�4�� &2L���U�D(#��k��)��~f��4���}BfB)���t�5K�Ǯ ��r";��8� d���2o2��!�<Z�}9"�Z����6�R�Q�u�#�� ���L���V���2����ܡ����;��F�"#8��d����͇l}���a���N��yI��Q�Jb����}*�-3ڙaQ�Ц���\���Gɯ�'�8P�=�i�}�������4�NvzҖ�´QV���u�8��D (L�-�yI��F��m`������mI8ԝJ�d��U������8���zB9V�T��M��X�J���f��xC��`��U ���|蒒�ދ�i���mx�*%�^��q�)x� -J�����P��8aG��H��H������r��}B.��d#�C����[�� �|KZ���ҷ��- b�� �E zqK�0�Pqx���uQ�8>}J:1�b��a�?��;i������m�Q�(] �o�����RƋL%��\�����������tY���V挱���'��v7nWE�r�i��8(3Sn5�z{��N�:-�gX�(Ztق�y�䪝�)q�N�|�g�9����y;���Z�*���_a+nѥ[��sx %�uĵ'�~��Wf�L�O���WW�!�P�S,����i-�L/�� �������(�mk�?���WÊef"P���=}��)Jb⟛�ɳݺ&�l#�f���XdL�ag�u��-����"��|rp_n$�#�7��b'�a�m�^d E�tt�tC:۠\6AZ�W�����_�m5�!>�ST�a�<c�-��%�<�U���d�p�5�u�$�|<iL�U�9����od��-�^��r~y�w~��2�
Static task
static1
Behavioral task
behavioral1
Sample
b658207de866a179ad3a9257c97739ce195c9798b99cc4fee0f32b926764bec5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b658207de866a179ad3a9257c97739ce195c9798b99cc4fee0f32b926764bec5.exe
Resource
win10v2004-20240508-en
General
-
Target
b658207de866a179ad3a9257c97739ce195c9798b99cc4fee0f32b926764bec5
-
Size
8.8MB
-
MD5
693a67910099e1807d38a7213cfbc9fe
-
SHA1
60b311fbeeb5ba76b9735b0705b7abb47fa25e6e
-
SHA256
b658207de866a179ad3a9257c97739ce195c9798b99cc4fee0f32b926764bec5
-
SHA512
a659521be69c50dcb9f8bbcf151863c9a2f8c5ae395d300ac44dd0f27e661c38c183363121c4225929339a7f6ed664d6b22ac65d66c72a1a7ec1a3c63ae21da4
-
SSDEEP
196608:xo59rLEnlbQ2h+WBRTbWMUEblG0NvSbRVRj+LZFYBsEUXd:W59rLoNQe+W/+mblG0NvS1VRj+LmGd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b658207de866a179ad3a9257c97739ce195c9798b99cc4fee0f32b926764bec5
Files
-
b658207de866a179ad3a9257c97739ce195c9798b99cc4fee0f32b926764bec5.exe windows:5 windows x86 arch:x86
fc179892df4949e2ae68a3c341a3bd4e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
closesocket
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowRgn
CharUpperBuffW
gdi32
TextOutA
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
OleRun
oleaut32
GetErrorInfo
comctl32
ord17
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 743KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 904KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 305KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps2 Size: 8.7MB - Virtual size: 8.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ