��mo�����Þ�O�4�� g`$��J��y��p �Z�Z6��?����r�����z^{Ldxx��Qa��ĨY�rT�^r����j���b�:�q�%eh|?��Х[��څ���i�1�o����������f~�נ�����P5=A��!���A!�(�yU��Ǝ�{�Dk^�Wx�QĹ����u����އ��������=zO�#��������G�q�2g���Յ6DT��,�A%��a�ͺ6$�( �N�I������) t�(�� h�`J�Ӭ(z��^��Z0����߳fӓ��xQ�l,G"�&�G��ע��Ym�^��({�"a���z}^�V��@����Cu����v��rG��jm<�H���?���Cce�l�+�=��H��n#���GC�d�F+�w�xz�q�F���~8S��Q���\%��:3� �b֦������ۓ� �)��0�����'��v42~��M�m���m�E2\,'宽�����������r�DV@�d�%ߜ�"��=/ak���-�Oʣ� �JU>�|=� w/!�'IQ�`��.��N��[��85!�k3D�4�Wu��b%�Ф�%�8��O9iը�JF��Ae�h,ƮB��њ��Õ��Ne�e&0 H�ɧ�CN;�%_~��wY���[��pe�����G��aH �U��xvl=��=��8qR2c���mJ����#�*�{���d�ߌ����6-�cHE竽}� �/|� !K=� 6����" ЫTm{U�lV�P5��W*��&�������F���(�-��d-����i������*�ܭ?�D�T����Ϝ(�c�PgNT y���k�!F�4A��J\��/�Zl�V=/��U��aP/ ���_jY�i�+)�+��֦+�6K��JOɰ����ęɯF��puKnK���+2�N)2#�)!F�*�\d���6e�˓�Cb��_�f5]���� �y����=�sΗ��z����#vL�/?[�i�;8W��l���u�x h%��n����=���m\c0|����_�c��)�����K���o:��'%�Z���L�Wݹ����P������|6��@Z���J��>�U�Je������>#��X>�e�qS�+�NU&n�?�¡��Y�s�9�1"�L������X죋8�M�8s�X`0.�ɹ�:�O�^�4XP�ơ��hu�|�m<��he��NY�;�t`���U�j`�0���]�;���@��C��Rr�]��QXh^f�GR��>#�.c"�qّ/�@OF��NJF�Է�FÄ�ף|�2e,����v��f�M�$����R�!*K�����9�����<��o"�'�]������@L�n�)!��x��I!>�}�!t��]>����!Z$h��M'�+U����4T�� �d���$���^ �U����T�ױ����l�9hdg�+PIf�� ^���{Ѯ5��FWaPd�@�N[�0 7`�o�������8��63�E@�ׄ�#3a�Ϋ���{q RF�\T��-tQ�B|DԱ�����嬕 =��؞�8:�N��.�(J�An�J�QU:5V��m'�� ��`M'!��[�p�/L\��j�h-��T�BR�b$Yh�OKٙw� �- �z?���%�����U�{��9���,��b�]���i�Y��b�q'f�?(H�XO���B��>�����u4��+)���$�8.< ��A�����T_�k�Ho����&<y[�W��`�N2FhP����dzU�U����}P�H��'���W�Z"}�Vo?��Kپ���۷�y9ޘ�b���p��pLվ�^yv�:�ޫώ��e-9��O+qN��}�/Äw�lg���s#�yxj����8Ma��)���',s _���s��R=L�Q`�Іw�L.��_\��ح��*�K�=�gc�zp�r���a�oNp_�/=�f���ٿ~����~����G,�[�!�~���]qE4Rq�H��I#Ssw�x��0��beМ��6�o�5����I�xo�@i$�`f?�B������Tļ�Lz�{떐*<K]�S�]P��+Y�Hy��8w}m^����������O�W M�7t�h&q�i5�3~J^�Yiě��b�7{�� �� �K�I]HI���b Hj�� Y�[�Jt�!V�64j�*4a$>@�v:d"����G�y�N�#���֛ $����P&0OZ[�`���S�٘~�۟� ���i��i�aCT(���~3Yc?�4��1��U����P�5\�`��n:qJ�nH�UDo�Pt��c*�_��F�D1oR�*�����`�N_�7$ђ6��<��VS�3Aݳ�6���3�ń�,Vpģ���&�ڔE����0�/���*�z [d����ճ����k�B�R/t�H�o��S�X�t��?G�nW��x�Y�ű�Q��`�+j�T��͌ުsgk��=>�m�@d��Qwos[���.Or=�ixY[�g�:)�\�C*�e����F-6X�'2�g��Wo����ҏ�8v@����i�mYk � �;�❱��ٶ$3�[��,#>���Gc��E,��I%X+��R$�����([��B�\9s���� ��/���b�,xG�/��[S��O ���ozKY�!s]�4��|2Z5_X� ܃��G��)\W�fwMiZ�h��JtY��OTÔ+�/dԮ��X��ԑ&���N�����&},�67P�%�t�1�&��N����T�n@\��JZ=�4�~ b]*���c@tm?�u�G��;�*�4 ���n�}`K��� ��%ZD�]e���\���{۫��L&�� v���jk<UЈVT���ks�2 �{��*�e��47%'�y���g7��z��E�6^S�X�{AN<O$U���[��b�<���}�^k���}�v)��Ƅ,xǻ�"���z=tRaQ��CL�^mF:g{�X�����k�±F�ˡg����М�R�P߉�z���kzc�xb� 9��,zO�Q0f�O��d��ċ��'�9�C���h 3$}$
Static task
static1
Behavioral task
behavioral1
Sample
ab2c032e550182e2ecf12b95057ad4b3dd4c8421c0f202f4f365b31c13c69f00.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ab2c032e550182e2ecf12b95057ad4b3dd4c8421c0f202f4f365b31c13c69f00.exe
Resource
win10v2004-20240508-en
General
-
Target
ab2c032e550182e2ecf12b95057ad4b3dd4c8421c0f202f4f365b31c13c69f00
-
Size
14.7MB
-
MD5
3e99c639e8d5abde97a17dcf8510923c
-
SHA1
0e3c74d02a8c0cd0849c780ca73798479e5c93d4
-
SHA256
ab2c032e550182e2ecf12b95057ad4b3dd4c8421c0f202f4f365b31c13c69f00
-
SHA512
8d5a730519e076f659550343449e7c7a1d77648da1986cb596ae3771b3a547b426c8ed952678bd257ff1bac331c45e0da6e05fc0eeb5381ec022ae20023d5605
-
SSDEEP
393216:CtKh9wwb8fZJQ+po9rq5yf/6cfR/PcRVBAq3oX2:CYwD3fpGl6cZ/P4Po
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ab2c032e550182e2ecf12b95057ad4b3dd4c8421c0f202f4f365b31c13c69f00
Files
-
ab2c032e550182e2ecf12b95057ad4b3dd4c8421c0f202f4f365b31c13c69f00.exe windows:5 windows x86 arch:x86
c557a5f7d7563a2534bb35746f5bdbd3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
winmm
midiStreamOut
ws2_32
ntohl
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSysColorBrush
CharUpperBuffW
gdi32
GetStockObject
winspool.drv
DocumentPropertiesA
comdlg32
ChooseColorA
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
VariantChangeType
comctl32
_TrackMouseEvent
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 513KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp0 Size: - Virtual size: 8.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.svmp1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp2 Size: 14.7MB - Virtual size: 14.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ