�E�s���l9��L��7��.uU�ϟ�+����)�"�������Tm��cp<�e��F#����>��YO�m��������Q,2qhz���be��H��d���(;� �i�K( m{����č��)����B^@�;�W��XH���v� `Ԙ쁢����n�gb���%]H����/���a�N0������cn�<+�<��Ż�9�~k�"�"����" �S.>G��.{f�B��5�Q���Lyn����X�*A�7��]ړ+�j~嵉�ʀ�����oGQ��-`��F����-��vz�rq��<�:�M.GP�obHc0��ΕN ���kB�2n�]%�w���Lg�^��i3(v ��l���U�_�ޫ�m2r���n�����U���� ��tiV= �V.�r|l�f,,Bm�ԯ(��[�|r2��� �^p�!�ʉ���,�]bO>�r��(�����/������X�Xn��K �@������#,��_��CW�h�����M�X[r��6�)(v�y��H�R*>B�/��j�=�(��r>�|j���}�o65frP�p���"�5`0O��rb�n�u�Y�{OO��q�ӻ�P-�q;E"A���Y���b�-�i����H=���#��[���O��Q��B.���Μkv?�S]�|�|/��ߊBˊ�O^شF<����a�~�>S��� 1Zy�_z�"q#��a�5�p��)>�)�oP��6V������4 (p�-� byW�l*��A�%*a��{)���s�������Ҵa�PW�P�S��'�ʢ�`�G�ñ㖢7�Q�~a���ؓ���J6J3d�� t�������J �U�{����1*<�d9Յ���w��i|+t)Q|��acQ�p[JG=?�#8+ *�1'n��1On}nH�M��M5�a���R{g���\��-@&���qK����{�Y��;���5h�G�?5yЯ���160yƎU�����}�L�c��ě��Ln��'�S�Zj��O�#w �T�JA�(��R�vFzϨ��T|6?�'�����p�Y�fw��q���=ʹk�j:���KQMz�E��~�;4�����RT��1s��}�L���9(�Ϸ�8үc���]�r�`8/������]n��L1�ˀi�z�;,g4�z��O#�+7~gg↤g���}ZwDJ�e�PRM;���-W���ۯs����(^_A�K�j`c�C��h͢�����W xowY��9U�!���JW`E2�����n���)��+�,rQ�t$I�fP��I��9��=,w�͚*-�\/FEyS��a)�K��!���=�V�$�M=ħ9��?Қ.2e9���Ѥ��K� �wL���gi���O��hE�-��������_ǰ�^�Ȅ�� ��XE�B��T?c����l�,�e4�t�_+*v�H���Wb�����Ŭ��KנXM1�y���8L!V�LպUuR������H�¦a[< ��2����(8`=ũ�����O_���Y�ʴ����鋙?���U�s}2j� �8#�t�e�D�:����1��QT��V����q1�^7����N��<c�FE19|`�X�E~��B��c.|j]����v��)���z��^��wU���W#}�l���a�H�y�keN�-�»��K���B�I�g�D�������ذ�L������rLХtJ��5� �\s*T�>rQJ����G�oQ%�"~|�ϋ�1`k*���rF'�%��8T��� ���Jz4���'�/.v8i���N)���t�����gFf�yӜ����L i���(��vP��[R���̄��s�Su����F%��|�1�M�x�J��]��,�v����H9:Te����p�t�#�>������l��Y�o,UB��!�����o�3Tz������8�Z��+/�����0��$��D�b���oôs�{�D�`��w��H�'������VrM�,F��86��t,���]g��@D>���,2^�V���_ӳ�������1��g�_���)^����[!q��V��C)�F��X���;v�ο2�<���7���Q'�rQ����C��������+Vt#$����k�__ї�N:���W}��J�����?f �����?�v����gD*�7 ��,����������77�A�)0".G����>|:��R=&9q*��Dg��6J-�[�o��r<�L�r�@�wm��p�J�d�#�qB�q��s���������x!-&���j�j�"S5�����_�b�T�e�]��\<�(�x���=����E�*^Ȉ�(��ך�۵h?�<��n�%o'�hש����6���t���N�rr/��oO| e��|4gaᩭ��*����~Vv��������f&Bh۠WV�� k�4D�l�O4uӕ>�[p����%a�n�px�)��e JfXނ(6X�8^�o�!���F�7/�� �shԦQ Aqse�T7�٠��(�z���/%�Jrؘم�'����x��a��K�\���\�c��/%����Aa]�ȓ�����@��X�Ȁ��B?$�0b����a��եs,V�1ɺ�1�[�S�O�_����x@^��S �4K��)��T3e��W���w��=<[����0�-x����� ��<���+��-�bl���'f��T�W�!��N:��]����%hk�8t�����!k[B�<��N̲�H[w�?$��P ��VS�W��c��9��n`�t�&V�K=�k>��Iq�=:iMcO����ڎv���2��+��]E�������`���^Xf����l7K�� ����k�EM���OI<3���0x?��pm|2���xf�c����j�+k�T�^����f�7F����T(�9{�B&�!]�7�g� %�o�$�x�f�q�/�Ũ��b53���:�+l��<���Ǖl%U�R2(_��Ղ� T���\[.G�67�y��з���i�-g���G���3f:��)x�n��N����]�y@yGR8Մ���{W��K�
Static task
static1
Behavioral task
behavioral1
Sample
92afffcd3435fd9fead51df64a0fecd6.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
92afffcd3435fd9fead51df64a0fecd6.exe
Resource
win10v2004-20240508-en
General
-
Target
92afffcd3435fd9fead51df64a0fecd6.bin
-
Size
6.4MB
-
MD5
92afffcd3435fd9fead51df64a0fecd6
-
SHA1
9d4addee68e50d8b4898eab53625f1981a84ce2d
-
SHA256
0d6ca6b91c524626cefba399693752db4dac222d36442118c0457320cb029448
-
SHA512
cedc731a98832eaca543c96e504c2d9f80a4eabc5980934c68eb7d387c5b544cc7e14a3b6087a754b0bb8582775e0f10d4327afaf75e5b7243f4cbb42d8a67aa
-
SSDEEP
196608:zGsPezNNPVJv5W5t3iiFJFJXZvMv+JZDce:xWbLvc5ty29nDc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 92afffcd3435fd9fead51df64a0fecd6.bin
Files
-
92afffcd3435fd9fead51df64a0fecd6.bin.exe windows:5 windows x86 arch:x86
410ac107d4910087308622d8fabe76f2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetLocaleInfoA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetActiveWindow
advapi32
RegQueryValueExA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
shlwapi
PathFileExistsA
winmm
timeSetEvent
gdi32
CreateCompatibleBitmap
wininet
HttpQueryInfoA
gdiplus
GdipGetImageGraphicsContext
oleaut32
SafeArrayGetLBound
psapi
GetModuleFileNameExA
imm32
ImmAssociateContext
msvcrt
strncpy
Exports
Exports
Sections
.text Size: - Virtual size: 815KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TeaSaf0 Size: - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TeaSaf1 Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE