uJn��{ (Ds`�� �t�jfͰ�"���=� ������3��~�� hQ�Vk���=�d;��Y���t����/�u*�h���JN�Ľe���oF���.��^�d��f�LB7��V�X�pڪC@ yF]�Cy�n������ZҝF� Rӫ�q��iâ�zZ %n` �aO�J�(������ �DP�#wY�ڡ]tЪ�Z0Z- �ߍP�BYꮡ��k6�SRt��W� R���ok�[�6T��J�[��>���o3I����MԒ�U��s��������'g��m�(�$�#)�J1��9�.H��|r�=�Ъ���"=�^_�\�;�xG��� r��o� s���&��:>���6�ũݴ�ھ_۹�,�XƿA���<��Ydw�zD��[A<�P�<�`�n�0]*��-���CԼ�!�t|r��Jb���8 �4�ϒƼ�������?�"�8к���I�I��d'b�ƂQu�aZ'6X�>��҃J!�ՏW������Fڕо}Pb�W}�L��K���0�3�x/��#�#;� �a���t'�L�l����3��L�����}��a裮'"-�~��R�8!�-VCp{j��!Ai��ĕ�@�� ���'{�����/48|ؤGY�f�8C�����,%j���=�ek�MM���1��"�o�J lq xX{�2jo�&����H�6������烾���52�0����mr�eAoY@��;�r��v���l@Nx7��P�RU�V:"��+z�k��U�����i�ï�n�uգYn��:ɤ����3$���<�Ct��t��Ja^��X�EX�p����#��V��� �z�w�E&��D�t�(� ���4��*ڝ�H��u��H�۴�i)�>k�/��� :^}k����[�qvuJ�����i��T'��E�4N�<l�Z���F���r�Q�"�������r>~y �`sS4Md��OI9ߪ_�\z���TB,'y����N��ݮ��Z2 Jd!C8�\�����x�.Q+"��p�9�BO��}�0hW�Y��K����1uCM�ڰ���U߷���,M ]16|���ƍs��xh��K�nF|�W#`�QsBAa0�裫 ��#r��b���ue䟿�4�ICY��!�>���#�����e�}���o-^��N�i��2�F�Fxz?���3��Ӷ&�(8���y{?����r�7��Z�MN.9^ )R�d9�5k�� r���*�ά�Z�~O�$�3"g�5��l���ĝ��a�ɸu1��"���*�%z��X�!8��-�K�G&߅�7_;'�!�QtJ���n vz���lQa�T�[Ӹ�o�j�p��JB �Q�!��,G����x��z`z}�k,�<q|��xR��(��1��H�& �6 ,��$��k�����<��x,)j;���`FLSa&���?�ӷ�=��"?Ab��w���K9�[l���pIt��u�@{�Z�u %���v:"�$�*��$���i�i%�����=���~�=إ�����[�\0jg�2$4��.I��v-�^�2��{F���>������V4�Fk�R ���Kl��;PY�Gߨ2���f��-h���p��v�� Òb� �d3��1�4_��1�=By��8��t4��R-�௸��g~_8ty���Bs1ܥ ���j�s�X��/3V+w� [ⲇ�R �/�{5�@���D���hs3��yW�rW�S��p&�?�3�B��)�[x���~Q�����ꞷ3+���l/M�w�$�pg����d%�,HS��ãJQ��y��=,f�2��h[���|;�gP�I۪��R��VvA@t}g\Gʅ��lCP�zUMĩv�r̯��Q8i�}D�X�g�z�w\q-ص$�A1p�C�����^eMt��3�u��~�����H����_��eûA��{�w���34���{�����nAe4�㎔�(ιk�|;ÌE���5�Jd��' yb�`�ݝ���O��a�[�#c�w��ksF9l���(��j��{M>�v��/R<-�X��� �����S�_�L��%l���/�z!F8�X���o�E�JC���^��3���2;1u��< 7S�k�v.� bw����s�k\:ϨM�F�HAL����n��YB�A�m�B��y�d�0�X��v�tJ�ԃ<���ĺB)�s\��D^��Lxn�B0��/�Ks��"����7� �#�>����K��D�[�v���GN1^̠���ah��C`�,�����Ү_�2���'|�Ge%*D��U�⭋z������v/��������?��Y���]�+����t��V�X�ւa;���^�No4���>Vp۟�F�O}K w�����'��S� �Z4'تŻf��k��d� j����RH���U��|��d�]so�@�c�]��Er�_�x|����z���F����n���;�`h�� VX�&�%{c�R��і@�p�l�C�7 ����I���8�E�h�����#`d ���Y�P��3� �u��s���#�Z�%ZPu��#��a�����^ȍ�zO��m/�Uٓuw=���D���u�(�?y�&(d�\�{gŸ(��1{�6&��kc�X"�ru�ղm�E��^�3�:�B��]�ZɊ���S�9a� ��&��L��&x�J��^��0����c����b��{���l��m{7��qg��5�V��!E����m��C�a���HnT���j�4��S�BZ.9�}G o��a�rN�jT����LX�P��h�m�-�����W��bE ����U������O�"m��"�˪Э�L�E-k�à!Y����L�i�(�jn��6��+�h�o��>o݅Sztn)H������Tg�����L]U�?yŎ6o4���V��Tn<�Ȃlox\6�Y���%fEZ��%�����^t%�_�c��4����ԍ�����)�=��8����xQ�=qJ�s\�dp?7pN u<�#MI���VF~��a�p�V�hSIi�{7�U����� [6�iy���3
Static task
static1
Behavioral task
behavioral1
Sample
fd1958f8abc89d1b243f6a0c2f2268686720733ec266eb226b7d591c07cff1d2.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
fd1958f8abc89d1b243f6a0c2f2268686720733ec266eb226b7d591c07cff1d2.exe
Resource
win10v2004-20240508-en
General
-
Target
fd1958f8abc89d1b243f6a0c2f2268686720733ec266eb226b7d591c07cff1d2
-
Size
1.4MB
-
MD5
e462d31af593f7f0d9da80ffe7a579a5
-
SHA1
9fe1f579e2903ea7d7fedec34e85327e5fabaf49
-
SHA256
fd1958f8abc89d1b243f6a0c2f2268686720733ec266eb226b7d591c07cff1d2
-
SHA512
4873e79573fa87d650de165bc564e5b21cbda9fc5c5f8db8653215fca7e4eb86641dbdc827a49dd02bbe36282bc702cebce1771d8a7147b7c30273eb19f84bfc
-
SSDEEP
24576:dF2OXsUgWmF3qt0ZymffF3VjTv+YEGnbqfFMrMSJHo8lTAV:d47Uy7ykG0e9+MSo8lTA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd1958f8abc89d1b243f6a0c2f2268686720733ec266eb226b7d591c07cff1d2
Files
-
fd1958f8abc89d1b243f6a0c2f2268686720733ec266eb226b7d591c07cff1d2.exe windows:4 windows x86 arch:x86
244a5147ee3900d5dd5228c5e5c76968
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord6375
msvcrt
__CxxFrameHandler
kernel32
GetCurrentProcess
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDC
gdi32
Rectangle
msvcp60
??0_Winit@std@@QAE@XZ
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 416B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE