Gƃ������������J�X��<7>'~�y�+����-��6Զ��yDC�T7��� �����~�݅ğ�5���b6�Qd!��hY2���˻T7�z��yz�N�^��ǎY{�@��:�J��L�@��9FCt[�h"n�%���X��m�5H��_�"���ڏ^�ո�⁹��:�1��^7���x����yF\��b��e��Q)/�U��&v�������A�Qg!�N�W����Hi,���_�n"�4t�6LV+�7�_�������D�$�����|�bV[m���K��y�ř`�m����wB�����0;ϓ�y��:.s��Dox��o� ! ���uP�� �kd�.�z�"D,$��n�s���� UjՆ|&U��cLs��C\3��CF¨���3�j��Jy�������C�7����X���t�"�_qEZ .�����J7 aדY���g� ����<��ɑ�b���ÏX�"䂝����7�d�����$��C��Ps�� H4 ������+ی![���Ah��<$�㝧@��������}�� ﬓjTʆ�Ag1��C�(��1����;H��G����g:�9��#WB����^���:��B���8��yK�,����Ns^2^u��k)d��T :'2j�r�o����a�.zHWV��6���@&,���K �K3�V���&�n��Bɔ���r���� ۶3$I)'���a���՛��VE�����ov�W��_�}騠 ��N��ec�k�h�,��R7.�������Ka���V�ng۱ha�$�͊C ��� -�L���1��G��D�X���suZE\`��/�]��T;2�&��i��e��G:T.����� ����?J�u�t��a� �YPjj�ZrL��P ��t`�!��Os������%N�O���|�3�$�S6�(.*�{���>0�(HL�_���?G�p��QE(�g9b.K��Pᖪ��\�F�����h��PB<$л�6H�����KW�E�%&�j��k���'���+�N#�|d��O?R� ������g��&O7������i2����"�h���H�y������z��@!�\����ǎ�?/U�0n� �^1��i��5�Y�5�"?n��(��[�Q��s��m�� �M�v�i_ܯcn�sPA��8�'�e �D&R\���+���'�Ԡ����L�S�YԎh���4�:� �$vap8��F��v�����ןV���y�>�����y�c��� MģnkR�@.�)��7�]ݭ�a�x$�bӃ���S��m�t8e�ɛm vT������R]#y����Z�챢��|�������{N���S��3���˨�9Vգ���noG�IRO�S�Y&��RƮ=�}x�gt�?��Z{�<��n9�9�P��u��?\X7u,�Etҫo 9Մ��vw��4�[NBΩ���̒������勥�l���<�"\N��h�����cV�ʪW����"8���ۮ���<�o�6q�6w)�7G��z��v���?��[3�s�Q�y��A�����[�5�d����b4�I :�A+тb��D�r�y�&���8��p���k���a�����FA�����������yl=���_�� ���X��æ�wq�;z�?t��L�Zɪ%��.x��Tޖ:>�z�B9��J^匒Jh�Z~p�[�FZ�xQJ��a�Ʋs$�p������#s?�5D���"R�F\0/������*���{!�n*-�f��w�@W�I���Q!��'F����O�����RXf`-h-q�W*�`���,3/T��#�1��(�n�25#�t�� f�Ԍ,���!*��J��rlW\� �h#㉩�� �W�5����5N8\��t��oa����lX�"L�}�%���U��C-c��+6�(m��a�+ ��Ձ1�bG3C��QL�� &�_��������T5��<�y�<��$�mH#՞d9x�w�#žQ� �=����(�1V)���b�P;'%Qs�3��{Gף��8�Rlx��3�ղ����e����/��Oފ����]�H�"س5�k� ��5Nl!�|&^�t}�[VR ������ �L�²PH���n�M�z7��w؇R�I�����Yff鰑�f�hg�����?]���A��g��8|WC]9����O7��{�����sS�ut���a+�\%��i�Q�[���K�%9���T4� ܚ7�zdN�<�ې�7xW$>|�7F�4���eѕ�-;# ;�H�B� ���X#�=V��*c�L�]~���Koħ��Gb4~9�3/4�he�߂(��9eS���uF.��K�9�Vk��>�4�:KQ&}�o�. ��3PBz��N�YR�� �Y��:Wj���i�jR��ϼ`�КVa5����]�Q~hm,�������� �(<�o{�~R̯;F��[_���MR�$����R�G��]_6?դG�5�e������q�ߡ�svzQN��B=�ծ;*�n;�_�Ne;�,�l����P;�$�,���`��ȵD��s�l^״Z/�U�3f�����=�u ���3Q�=)B����4G�t� G� �Z����c컭��5 �1+Z���Mf��E=� q��� b�$�^X�Z�ԡM����+��� "c�M�*��&�I�-.J�+:E/�+���G���(u���4PBr}Qd諒���\�������I�U:(���� �eڂ����lȏ#B��P]���hr��Y؏��a�3���.�L��POVWn ���:�'$��Y�����C���a�bKL��2k{$Ud��m�U���Ϧ�W�����p]�>���)�B6��^��c�����j�~^5Ϟ�;7�κ&��3�k!�On���K�t�|Jx����fp�.n"�K[&:O5�S�`�������l� ϛg ��z&���*<�k���\���뱛s��<��yMH�EjZ_��ʢkt����%�9�ؚ!���h�UlK`g<i�Y�.j�D"&�B���b~������������k)����,�%D�A%���Ǖ�T����-��
Static task
static1
Behavioral task
behavioral1
Sample
96c34ddf904ef95b906eea14aa387192e77c1753af506d6d1bd784a481a4dee3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
96c34ddf904ef95b906eea14aa387192e77c1753af506d6d1bd784a481a4dee3.exe
Resource
win10v2004-20240426-en
General
-
Target
96c34ddf904ef95b906eea14aa387192e77c1753af506d6d1bd784a481a4dee3
-
Size
10.2MB
-
MD5
efd5d51a66b30cf6ef960619f82572bc
-
SHA1
f9f52e10103dd87a68380f2ecec7acce29058bbe
-
SHA256
96c34ddf904ef95b906eea14aa387192e77c1753af506d6d1bd784a481a4dee3
-
SHA512
a0766d627efe83ec642207581dc7142da0ad9b830ee8a6392544cc7acd67c365d4872ef76a0b60a624006f8c62db3ac68cda5c4751669877899bbd18edae2917
-
SSDEEP
196608:q0H+N81RQ1d82hKy0rdbTxDDZX/TWqOvmif0uIgJ+YTFJLME:l5IdwtZX/TU/f0uIgj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 96c34ddf904ef95b906eea14aa387192e77c1753af506d6d1bd784a481a4dee3
Files
-
96c34ddf904ef95b906eea14aa387192e77c1753af506d6d1bd784a481a4dee3.exe windows:6 windows x86 arch:x86
20cc0836b2d2a5071ee195ab35761e81
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSACleanup
kernel32
AcquireSRWLockExclusive
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DispatchMessageA
CharUpperBuffW
gdi32
GetDeviceCaps
ole32
CoUninitialize
advapi32
CryptAcquireContextW
crypt32
CertCloseStore
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_gmtime64_s
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-utility-l1-1-0
qsort
Exports
Exports
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 557KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lw0 Size: - Virtual size: 8.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lw1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lw2 Size: 10.1MB - Virtual size: 10.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 138KB - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ