�!Ne*��� 5O�<f�I����mF��J����T�ੇr˽ɝ�I�����l��b����I_�7d��o\�n� n�����F�����K�O7p4d�^�7�5���:�-#��Cy�&tC���n&0x.۱��_}�r`���L�Y1 ��1x".�Ш�x�?�{H���V%�3�%��j�T���M�1^V�R�?Pl��=*_b;���K��Q�[����� ������W��P����d��@�5��\��}nn��¾R����4Ct |z�I�ܔµ3�ї�U�� }���"�O"-\"T�?cs���:��Ϸ����5��l�����D��=_ȰI�ۈ��7�2�yt}|�/y9t��㽰���*�J��Y?ˎW�%���*'LǕ��c��1�N�2����I�8|/H�+O��ӳ��3Gq9������-o�씋��7mS7~�kr��tRP������c<yP)�#k���X+%��lʩ�Rז��O��y-����D��&=����3e���EH���Q4�r���ȦHV�ca�k��+��Hs<�څ`z����e6Y�7mw�I�%6��p6C�[_�' ��s��RSp�������/� �L���jzmL�-��$�� �<�"��'ݩ|��i��Y��vۡ4� dU��,�}.�={"����N8<F��qc�a����}J+��{)_�����B1%��l��A�9�5��*�K�Ķ�k?9�L�:+��SP������x��R��l�<3Jٞ��I�v��� T�p���%���K�P�����Y�5��M�7��X�����;?�����J��G2Gb9ֈN5�� ꩢ�Xe�F�x�el!�Vg��a���_�L�Tlw;���܉^]��g���nM$��\� \��_o�?r�TTN>��*��q`>���:ZH��ߌ�� ���J�ď;w� �p.�h�kHC��C�,���Ձ�#"i�R��`xp� I$�� ���k���H�`���*O/�.�����W��GYTM7��^�[Mꌔ����f�k=������~�)�y;:/mJ�JH����LZͮ�` X�ӫ�R�:v�� ���rB���L-/��~�>B��5L�7/B[Vs�! ��Z��\�5E$֙����_�d���3�y%\q�>��N���̹1��h �&��*�~,^����W��M�Q�\]y@ޜJp����R��3�����1Q<��d��9*k���el�[�ߒ��������D�Ș��mK�()����63����B�b�!��\$B�v��C�����t���( 3c���&O/97l�%��h��d�6�y�*�� rȼRy��'H���o�QƝ/I�7j٠3}FF��'�)x.�Ur��ˇ���X٘�����YZ'1���M�fHwcP��ǽh<��[i��C�%���<Ƃ�~�X鋖�~�7Sk ��&�9���A�uȎ����pJ���)@�߂#�jx73��5��D�b\-R��>/��9��7�a�-�]��ư�znM6vd������(8 ������d[A��V��uGx��F^HgUQșZBv��2o*r{��I�� vO}�o��A8=CG:\Y� ��DGyY��Y_�v=�紎��>s_����l�&!���|����+� /}�N�Ŕ�Q�%��}w:�|� ��Pb�fh�lD�F�!�/Q��4#�dd�?��<2%����ľϒU�u88��o �p�N�s�"~���ޞ���Ȣ<P=ׯ����T�2~���<�B�31��'�z�>��a�&�ok� �������F���93E$F�g��aj]�lvBPxê.�O�: �a�'�܂=���51l� x ��l�ۆ�%�G0Z��M�O��P�S�f���X$&U�*��U�������3!�M��S唁�i`����$;���Bs>l�UJ\l���^�SڵA/Fo@����ݬ�< ��'c�祈�bBVn���e�ܜ��?n1j�5K�Bg�T#������x�_%�;Z�M!�qB2c�N��F.K��^��s�,*V�Ąa�� ����٢k�_�s8p1v �j������g ���ML��3��*�ۀ�N�&<jYd������ö��m�*\���4�Ƶ'�->}�W�2ɵ����%(V��<<��:����a��z�����Y������������Y���|��Svzs� ����/���F���◀j�q����|�o!�b����\��ݴ�(}���R�^Kj︀�����=۩����%���/;���T�fV�|����J�Euڣ��Z���[?@�y��>�^;�1O���~@`�t�O���P^ZTF#�o5�m"k���j���h�%��T�b�b�20~*Pֿ�D���so(��^���=���TO8���aIۀ���kÕi̠*P��ݞ�$沊1U�7_�����R��*X�����k���w�;����"�v ���k�AgU������5���aFc��Z��] K��{$v ���}W���B:��gaz����W����h�7���^:q����� �_��-������_� =H��65������Xum����c�ޓ���ڳ��M��Pv#b6���8�%��Zt��1������9�� ��0�084��j�dY+ᣪr�<s~��t����Kh��XCw����Sn�)ʬ�����q�8��\r���� L ���")7.�]P��ͽ���5������J'����z��)��et���{�e��+�7�Ej��k�D��Nn>+�oI(�P0Ƿ�r�i�2���`�a�mw�zX�X���8�0#��N �]�*��/t<��x��a]���]���߭�l�`$I(vWS�n���ߨ�AH]��X�B(3{@����rD�����u�[���˜#+���t����D(5�U.�烧r���.���� :�Q�Q���<�L��x�#�����S��1�0a�8��sz�c����8��]@��W5�8�N�8�C�W��IpKͰ&N��K,F��dcu������l�M
Static task
static1
Behavioral task
behavioral1
Sample
eea7bc7fa15ba8f720d9bb9452d4b7c76c82de26dbbb293507ef05c9e6d84233.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
eea7bc7fa15ba8f720d9bb9452d4b7c76c82de26dbbb293507ef05c9e6d84233.exe
Resource
win10v2004-20240508-en
General
-
Target
eea7bc7fa15ba8f720d9bb9452d4b7c76c82de26dbbb293507ef05c9e6d84233
-
Size
7.6MB
-
MD5
29b9ec8ccb4181b5aae7d5b4f986107c
-
SHA1
7365e9abfcd2149e80cad69ecaa272911bc54824
-
SHA256
eea7bc7fa15ba8f720d9bb9452d4b7c76c82de26dbbb293507ef05c9e6d84233
-
SHA512
bb3cfd70af7f07ddeac59af1496a672c4ce432096e64fe5e180567d53da32bef68b31f8d45363d36f231015e9dbec1308d390415e04b96650107a344a38c3bea
-
SSDEEP
196608:avij3oDff2pztofy+avkZv4y2lJpFyV2ie+ftHRPlf23LDtqE:avKYDmpz+javc4ykFy0vM3f2v
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eea7bc7fa15ba8f720d9bb9452d4b7c76c82de26dbbb293507ef05c9e6d84233
Files
-
eea7bc7fa15ba8f720d9bb9452d4b7c76c82de26dbbb293507ef05c9e6d84233.exe windows:6 windows x64 arch:x64
a1b66b6507c9812f1d34b2e4d2e4204e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostThreadMessageW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
ScaleViewportExtEx
msimg32
AlphaBlend
winspool.drv
ClosePrinter
advapi32
RegQueryValueExW
shell32
DragQueryFileW
comctl32
_TrackMouseEvent
shlwapi
PathIsUNCW
uxtheme
GetWindowTheme
ole32
CoDisconnectObject
oleaut32
SysFreeString
gdiplus
GdiplusShutdown
oleacc
CreateStdAccessibleObject
imm32
ImmReleaseContext
winmm
PlaySoundW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 642KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zaas0 Size: - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.zaas1 Size: 7.6MB - Virtual size: 7.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ