����0�$�G�U4��k�����$zz�8��ގ�oO�A�ے���|� ��a��ҿ~�+��[I���!,=���g���Gy�v���p$�����0���n�j+/O��L��7�lo�|e�W�㝈7|!��������m+c��r����Xb�jM��|lwq�^.��ء"8�����b���~�kQ�XDz��ŤoY�俪h���l����Y�����% �ύ��S60��P���N��o¿� �TC�g(��AJR���O�ꡝ��`��E����k���ٚ�][�}0��T��O���G��z�]��d5WW�GY%�4¸��J��މ$a���?.��79z��%�Q@�)�.���p���z,�#1r _����%���K,<�s�XQ+L�n:8�F�r����oB_3A��S������������ےe��8�~�%Z�N!��y��|u��|v�Ǭ0O��s�X+ܮ�H.� �����Ɏ��^��bEft��'������곂����_�Q������]|[J*��EώE^ܺ�;QBE�5=td��]��e��Mz�Wg٣��{I�C.Fe,� xwO�q�/��������`�2��N���s�w��������la�S�[�"�UHΗ�}3���|\�'��ٲ�AxM7��4,T8��Y�PY>����xc���l疌�V;85,�`�9{�Xw^G��3�iw��Ti1�Oap��ҽo'�o �UK� �H:Г��>Ꞑ @9�Ӷ5>m:ѫ/k�ytf�PsUSE��?����6r�bg,*��[��1�5x�-���؛cў��������H�����,A�pl��q���;-X.�]�7�W�2�9?�K�mb�B4e˺a����^L3���;��c$�ou�5=�ھA�w�fƬ��®I�v;O�W̦�B���\8������@��6�~���j}V��� ���2���x�6~�lP�L�`�C��ʕ��y6���2�����߭*pZ�e ѵ|�G2��O��%�(���o~נV ����rcv�#� �'� �}τ2 A���asA �q�������|�{�T��/�j;�f/�u��D�E�B�f/�Y���a�ۜ>� <Y?�r��Q*�Lr�Cv��MO%�F鐺u�(@Nu�l�.;� ��Z?����X�L�4� E��^ �kyg�����w�0�.�ϗ�e��HA��P> ��u����rW���_��"�wG��nǎ�#����C�S��n�0'J������(X�2̚����5Y�"�K"��&z�o���Qk� ��n�c$NF ɐsg�����,��Yk���^��h"&��Ѫ�-1��:f��f���Fʈ-����d����}��F���d]¶�X�l�1��Ln�1�rc� 3����4�K�������Ͼ牒�BR2 ��NW4�<T�2ʮ%���������������w�i���\���������IL?[%��!�I>-�������w�B��Ͽ���yB�Y`ju��K��e�����ߞ���E#�f���ȪQE@�9XZ�iKyqՎ���µ͓�M��A�9s�yd�1א,&����G��'c���{4�2���F�SՓ�ҋ��yET��L��ʥqݸU����7?4�bi�ͫ��P�����D߂�.yxŁ������ue�fҤg5�����i���зUw���:�ԾA�դ�ql���l�L\�ꙗ^����܅PRV�5>���(��ҝ��i,P4���a����;U�v���V�jf��ǩ(V��5��M���*��U������2��ZAF� V2���DrQ��!N����1}�jv �qي#i�B~����*w�|a�<gB����S�����m���8qpA��B8����, ��� }?I���D�HY�ho���v+��:���BKˉp a�,�&G�H'��#}X�nB1f< ҙ�턅{�*Iw0�,���p{\��ϐ^Vʞf>¥=��v��s�=QnES� �ձ�r��r� X4�EEJa<�r�"�p���j���B5j��TT4��2An��k��X�4�6uL�n���'��<V���n��T���u�i��c��mk���} ғ�q�$�m ��L^چ8g"��i�|�1?�>z�p�������K����G�t�S���Y\;�n��ݍM"8��C�$t6�� `�E�B���@E 䪉�դ��(�����o����=�|Ў4R����[f���yq������3�g V�bT���T��F�� �5+,f�ܵ�Z���r>�]�����}u1i;ѳc�˫�٦�Q'���Ibk\�A�Q���-|;�}(�$�;N0�v\�wd���=S�������� /��Q���m����NJ�\;E�~��Kr� ��Ɔ�]F0�}]��^��!>)8���ۦ��[{��b�y�*C&V���x��|%D�����LM;��Co�m���%���~ w�Y��:Ʀ�a���w� �����v)U�6��?&$N�U����UGϳ�{|1����7�Q+�}��[J7Γ��U��O"��C4�a5�`N�j%ԏ J����2`v��Q��߭I(��ă�<쒎�B �ӞђÑy0h�T17�7�4{�t�q���P�D%�����Ϟ�JEٴs*[����(8H����~σ���6!c@�3�� EGp����\��C�X4uB�5�]ؑpԘؑ��.f�z�ܛν�F����B�hz����_/�aK1��$�t˂l�_�da�(H���\�~�)^5R� a�8� 8�W�Y^C�.� �f��9�����f�MQ��b�b�����:m��Xlt�/Lu��_˷}�ކZ&<_�#0��6~�'��l/����8ќ��]�>12@�UΟ�3���S�=�oV�)��L�%�tC���v%kШ�ӈ�u�Be�=�#_�f��W,*?$]���J�'W��B��}�M�@�2p|S�c�35�b��f9��v��D��h&�/92x?���5�S!}F�4�r���������Â>'�I�
Static task
static1
Behavioral task
behavioral1
Sample
5f5d29bc8da827e5c757ff629525de74cc120b9a3cc3b6074ba6cf5da2da35a8.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5f5d29bc8da827e5c757ff629525de74cc120b9a3cc3b6074ba6cf5da2da35a8.exe
Resource
win10v2004-20240508-en
General
-
Target
5f5d29bc8da827e5c757ff629525de74cc120b9a3cc3b6074ba6cf5da2da35a8
-
Size
6.4MB
-
MD5
fb368f82be09f2368bd8d779e620f16c
-
SHA1
8b5f846ed7beb21ba704510d2d53b38e9aed1a1c
-
SHA256
5f5d29bc8da827e5c757ff629525de74cc120b9a3cc3b6074ba6cf5da2da35a8
-
SHA512
c0da27ee56fd88afe08e2737d06189bf99bb70f059d0bf383ce30fd7c19bcb6a480d8bdb9ad720950c3ad4adfb4e7de24a4caad7a42a671e20a4f91624743bb8
-
SSDEEP
196608:INzoBdCLNpaxvKuP4La2Tt7jTefwfTaQG:INkdCN9R3TlqQeQG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5f5d29bc8da827e5c757ff629525de74cc120b9a3cc3b6074ba6cf5da2da35a8
Files
-
5f5d29bc8da827e5c757ff629525de74cc120b9a3cc3b6074ba6cf5da2da35a8.exe windows:5 windows x86 arch:x86
549002051cab57166f3379613b50180c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetMenuItemID
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
OffsetViewportOrgEx
winmm
midiStreamRestart
winspool.drv
ClosePrinter
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
OleInitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_EndDrag
ws2_32
recvfrom
comdlg32
GetFileTitleA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 568KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 793KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 223KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ