�^��[���zy�ɑ�̤W��w�6D��v�˜N�l������ �Q$R�F�)�~���ZEZV��$�xqk�'D���Px�8+.�L�����[})��.U��w��}�/���DM�4&��_�F�`�gk����B��x�����ݟ��ؓ�X��I�� �g;�K��>K��6�ދ��y�"����:���&Z&��F�B#8f����$�L~�Y�!��:A�P�[��I÷k�b�)��3R�8��w�g֚M?�'�ƿ�`k���J��oc��iZ$�eõaJ�`2��"���u�*�/G>.��d.|���rk����@~؏Zc�S��מ9�����>�c�^{��u�j�B��AG'�\��~䨴��`��P����BР���W��`�aw5n(X�`%��/�+y{�Y��D������;��W(E8Ⱦz,3q�*�lX�ز��Ž,�lE�yk���w� ��ә� H��Vu�n� �����"%�~�p�D��g��|�r�G�g؏��p��0��қ�c#�g�[-+�0`ߏma���p�:��tq �����#�SƩ������h�Oz��t��j�⍪��9+<�Kn�Í���l�խ���ǖ!]���^ �S����f;V٣ಘ1� 8����7��� D�TC��C߫��:���@k���<��5(�^��M�P������!� �'�3������T�V�ֺ:�P0ѧ�lj;c�Fb���&����!vn�+?,����!r\�������`��mc���D��d �#�AC�_�پ��cF��P}��l���#9s�a�#֧RtI���� i��f�w��c>ϟv G�s ��A��p�\[F8� ��Ԛo�����`Y�r�'�x�%R���?�2p��ž��9�-��뀷��YTt���N���r�*S��$�j�*럡��S�fg(���KL�ډ֖����l螘K#j`�� �YD�n�Q�1�ګ�me����ҭ��6�4XH�nJ9&�Dj_ sN ]wY����,�h��z�C"�UN���*Z�[o3c�m�����]D�g�<FM}�� ʤ%P%|H7�xηL£@q��d3b���o쩃��fD��� �kW�x|[66C�z�K��k)�2 V�<�l%��*"u�N6��?��e�zy��cE ��N��g�c<��J�|Us�ƻoY�Ѭ|w/V����AX1����k����GiE���9V�_L� ���(z �&<-B�â�������Q�{���ǻ��L45d�?���z5�jcK��Ͼ����z�����K���xr$z��sW��� f��q��}�dk��0���Z��)��LK>���Em��cK�l����a�����Hw��e�r@��)�K���d� T" ��hB����4��2��4�Ь�8yk:μڤ;o[��v ��ʞ��|�':��E*E[���oz?̭��Pt�H�G�#��E����v�6�}�ϡtF����ֻ�J�� "�N(�� ^ݡ�C�\�YS�f���0Z>g���(�P�\?�#����_{���XH �;�B�2�g��+2��J� k�U�6�ϛ\��E��q��~#�2����������S��p���5���U�LY� Y��i���;�8�W�1!����'x�J�� ��`/���8����~z���LU��|�� ���c�ϗ��v�t��V�px��:�I.N*�J!y�E̙���8Xs~g&���rM�M<��;��8� H�N�eH�����h���|d�KpmܸlK� �^|�QO3���6��`��OT�h�(���V�k���wM�fEr^5�cr"P=� ����������(�-����"^�6sn��x�$���g]s��?<~�^��m���}���YN'Ƣ�nG��UE����z�Qr�jjl�UF�U6�� ;6�C�����iΤ�t.n�8t�݃: %����s���h��;�4�-t�=n�K�+*�A0喑Y/ ڳ<x�b���4��5��ݣ����� 640^}Z�/#]���m� ���r3� �>C�6�V��%yl��R����ˣ�l����~�`�����Ӌ1�\�93S����9�G����C�d]X8���z�:�NH�!��v� ����r�.�v!=�'�r ϩP!D�R��|�� �Bx�$�>����3�z=Q�כ6lL_c���=���}R%����q+�-��(�]:7�}*D�6K敟�p��e��Wc��J�Y�eg:`����>&�8]�E$R�i�n-j�"��A.�p,S�#�ѣs�����fQ�~i�S ʇ��A�߀E��zV��zv��:k?c:�+�� ������]Z�)f�V�;x��ūVQi,���c"��!^K�&~��=������=��(θJvZ�8*x)�(�D����8$h����"�g���:�Q�!ơ[#\'�������-0�G�dy��\�9XͻYǹKf��E1��ƣ�w���A������-�/�.h�2,���?��t:G���OśR�+��T�0�u�*5��I�*�>t���0�V���Wk��f�0O�`u�:�8OQ���Br~�N��]j��+��d�9Q[�m�pX���uݐ:��^�mv���|��l0��m}[��a/��re�e� �;3�����>���U2��CL��+?,Q�U�W���������p�����u�y;��9W��D��_O��Wk_��p��b�d��|)�H�eB��@��FN�L��Q��� b���56�h"�i��;E��gC�����J7@�rE��fJ��A�Տ3�D*~����5����� �Y8�_��;FIF16?��kO�7�1Ub��!��g��QB�o��e$/�E���w����_��=���%9L��X`�;n�K��48��L����qTG#Ӆ��U�^��"�y���e����4�`��뭙~V�[��>�IAo� �u�����}���-Ȑ�B�yܧ��j9�0��'�U��lR�ϡk��j�`�ۦ3���t{�6���PL"�SS9���2g�C�|���v��J!~��zGUG5���`ѿُ���9�h�S
Static task
static1
Behavioral task
behavioral1
Sample
5760dd41256ebaf20ec0115b92653fbad44ff2ac4b12c2a41bef3500b61e1510.exe
Resource
win7-20240419-en
General
-
Target
5760dd41256ebaf20ec0115b92653fbad44ff2ac4b12c2a41bef3500b61e1510
-
Size
2.4MB
-
MD5
29df2802bb21ab7eabc0e7465e2ccf79
-
SHA1
1aa6f83457dce729cd267929d033dd0344ef1958
-
SHA256
5760dd41256ebaf20ec0115b92653fbad44ff2ac4b12c2a41bef3500b61e1510
-
SHA512
917db79d24df27250c7b3cd3afdd7e25c9ff700e561041d5ad05b3cecef36ca15a49d11ef822b1dcb5dd4adacb3a58a5ec66f44e3f5c5ff246dc787ae7eaf8d9
-
SSDEEP
49152:3BYI0nXdv5VOoEdh73RLKnrspLz0ao94Evr2a2Wg14ClwY1KKp2K:3GI6XZfuh73RLKnW8d942ia2W2ZyYsKX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5760dd41256ebaf20ec0115b92653fbad44ff2ac4b12c2a41bef3500b61e1510
Files
-
5760dd41256ebaf20ec0115b92653fbad44ff2ac4b12c2a41bef3500b61e1510.exe windows:5 windows x86 arch:x86
d5fb340474525d2e1fdf960aa01cfaf3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
GetVersionExA
GetProcAddress
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
shell32
Shell_NotifyIconA
ws2_32
WSAStartup
advapi32
ConvertSidToStringSidA
psapi
GetModuleInformation
iphlpapi
GetAdaptersAddresses
secur32
GetUserNameExW
crypt32
CryptHashCertificate
version
VerQueryValueA
ole32
CoUninitialize
oleaut32
VariantClear
rpcrt4
UuidCreate
winhttp
WinHttpQueryHeaders
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zip0 Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zip1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ