��O��v�)&r��( N��Ȑv�T���ZA nw����N���:^V�߂�A\}����qq���Ɛ_a{C ]�%��b6���>S�Ui�N�R���oC��f��|�F�;w��R����I`/���1���0N�I"C�cw��y?��3Z�?A�������,�)�o������kdA��l!xc����k�GX��3GQ�j�����|n2��k�������t���p9�'�w�����0��b�f��1�(II;���D%��|����� #�j6A*pw�"/���m�s-��)h�������P�C��O�w�Ʀ���а�?�5B��]f�j�"v�& �g�mE�y��Eէ�P�~�I�t����詍�ԌE>i��3s̢VĪ>jD� I�~/��\:A�g�&HD�&��7�Q�sP�@�[M+�^:�����J���LZ�u�*����U�șGF���96Uϲ�*2���PӁ�^ i/�\A���&�"?�P ����=�+�`6_~J��"x���p���+�+B'�[X/'ɄgZol��F[o�Ġ�C)(/�����7ה��BCݭ���(��{T����v�D�����Ȅ�,�M�ާ��`����o�@��u;��e��yn�����X@�J�d)C���wy+jok��+8김�TK��"�.�0č��Y1�Ǩ���� Ɇ$����ճ��W �/P c�o>&�t`6�K����r�/M��8���S����C�B���.�'7#ȭ�u^��wA �zIl����#�sf1ֶ�gX�I �^�eZ�����"½��{��.�W- ��\D3Qd =>�_a"p#]��5�F�g��ń=Ĭ~�bSU�CqwۓJ�����rP�sm6��7w��Yt�������Ew���1��Op���ʎBZE����� 9q�f{H�!m7��c��c�Xb���ʰ����3�X�i&p$g�V^#p��=\�y�5\�Sfay�砶v3��P"O��1̄M�&�P(=�O�?���U���ʌ��3�M�Eb���?���K��%��� ���y���Rt���6��KF_�����b@����wdF���qc�pĪtl�^҂M��KߟT�HYF1]Pc�yQ���E?z�Q ,�P>�J��6�������{���*99 4� �\�n�|�Fl�^%`@�?6�%�"f p'��U���^���JV_�T&�L�@����3P|���<��5�"^����^c/�yirN��gn�mz��tˬ�T�*���9� &u%R�n$����`�_�iRр��a�r'�b����1���f^���䭀���w��uFH�]Z��a9lOv��V}d�-ђ�i�g/tm#cx�8a� >�\ W!�P��a�A9���2�h.�\E�E���)�NB� c�N�ZIY�ui�k������M(z��*���I�@��#��]���� S �����#ӵ"����}6_�I�/� ��`֨��ڜ[�A/R b��a]�V*8�u�u� g�T���.�������`\눉�7��[{z��D�irn6\��W_��R��5���[�U�v嬵-H���u�쥟�_ ��P}�;���� �R�;I�[����Ꙅ�d��/f�l�}�SO�(¿z"2��0�R�l���3��j����^'��^=�e1�3[���ᔻ��Y�Cr�R�QW�/��FII�Hm� 6,�����"_.�5�b�g1S��ὄēe��]�+�����W����^-�)��aax����\]f���/ ���ДyO��t�&d:�K���/M�e}ڰ���.��(�Ǝ}�L�4�g�ɓ^rLS>3�����<gy��cO+�<���ԏ���ʦA��x�4u�����1�*�;6ؘ��]\Yԩ0�or���Oz����ض6��u7OΔwU�?���y��+vv��������3�_ɲ���PG�,�[�F ��u0j����֏{�!�yk���~��q�0��T��/ґ����ws���a�a3i�&�'tap~!���:Ǚ���Ė,����\��;�� V�\���\F�V���vL[�Q�]y��葾��fa�)U��p����/�HX�m܌������T��|(Iæ�����j�? ������#�4�O�������r���Z<��Dz)��v�^˞��SS@cfh�I�wD��n� �H�~+��ðVn��D�Z���S��猺��nf�R/� ��k�D kۓE�S�r[ ��C[�'�j��b9do��@'h9f���x<Gu�`��g�.�T��@(ue��؊Ԓ���IE \�]���>,���� Q�K�)��B�6���߱�m��x��ДĮo��1Tp��9�eWV���a�V�U�w���v�����~�L����lT����C��t�S]K�hJ�g⧄Nv6��iQ۽�~�Wܠ�+���?����V�]R�p�$���z��ՙ��Ø g�M�.���D'[yG�F��*��|��{u�����wi�TR]c��a�/��$��HF.��,Gp�ֳ�L��2��R�H��=��!kP�ߙCXqpZOU� ��W'~?�~��H����K�O-9s�4��6ț�vF������i(s���"�����x�rź�L;Z�&u��H>��C`�~J�E, T�1!8����-]�dm���]��"�f�$ �� #G_��4nu%؎s��h���0)L-���HFYv������������!kT8 ˠ^ �"O2M�,��̌��rR~�<s�A�g��Y��|�5���ɐK�ځWr��l2n�<0� ���/]�9��!�%q��������{2���y֣M�G�\��=�$�w�4�/��h���T�r~�����;���r���s���PwX`�V`E�Ŝ�2��{5��DI JL��f��-��<a!6��{5J�����C+��LçuWdS0�|F�-�w$��k1 �6Ÿ ���Vf��S^��Tm��Ye��]1- �Fs%�!_�������釴0�q��S��,���e��t���?<�e@�L_��T]��c� �,�iO�J*��;=�pӪ DJ��BE�j�&�b�dq ��$Q�%�
Static task
static1
Behavioral task
behavioral1
Sample
d6217aa8790c6bc082f52940be39dadbbc831fccf4f6d57bd1621b913eba1578.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
d6217aa8790c6bc082f52940be39dadbbc831fccf4f6d57bd1621b913eba1578.exe
Resource
win10v2004-20240508-en
General
-
Target
d6217aa8790c6bc082f52940be39dadbbc831fccf4f6d57bd1621b913eba1578
-
Size
7.1MB
-
MD5
9c034fef983cb9ebbceb184d8dc20efa
-
SHA1
c2129fb2a8068d81cda66fa23387e4fe3bf829fd
-
SHA256
d6217aa8790c6bc082f52940be39dadbbc831fccf4f6d57bd1621b913eba1578
-
SHA512
b2d306e31ed7efeb7285f3131bd0db57c99e0376692e6a11ce22c3f8133be1c4dd62636e8cf344a9cb0673b9a051b95f3334af0e6124a42f9c8760afa54ff5e3
-
SSDEEP
196608:CrlMX1zK17FcMr+3rPdsizAtPSMZm7WNp6jHb:C2XVo6Ay5sPtPlm7WNp6j7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d6217aa8790c6bc082f52940be39dadbbc831fccf4f6d57bd1621b913eba1578
Files
-
d6217aa8790c6bc082f52940be39dadbbc831fccf4f6d57bd1621b913eba1578.exe windows:5 windows x86 arch:x86
ec8fa65ebb25fed2432005a5a716b8dd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindow
CharUpperBuffW
gdi32
TextOutA
winspool.drv
OpenPrinterA
advapi32
RegQueryValueExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ord17
wininet
InternetCloseHandle
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 663KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 297KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.=@F Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.mu. Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rmz Size: 7.0MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 60KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ