y(�����aS �+�&�x1��� ��U��ڵ=�����O0�N� 6��>����o_�ۆĹܾ�}���h�i�Te������4v%�ҍ���7F[�-Pt;�Fz=�)P������1�5�E��ۊx�T���tN�y0�)��r:Db��U��Y�yG�#����1�d�p�~I����p3'�B�3Õ�2nL�F�͛&�9�6�xZ���v�z4������P�A��'2�N�s����N8\�L&j"<��*��n��!$/J��>����_��p�T�D��['e�]����'S�Abmۋ��;g�f��S��H4���4�9"��XcK,j��{�^�Ѡ`юt��E���?po�i"c�z ���H*�?O��L�<��R[�`������hm*´����s,�X�$z�l.W`I��UaK��ӄƼ'�M��i�o�&�T/��^�I�qL*K�&�>��q��Y�L��z�j�����:e�hx��;�K/8h���a����U鋻��r���q}M�^R�; �ɂm�h'7�����m�Æ���� ��dI�q�v���l(�H9��hf~I��̋�9�a7@�\�6����/cs�y��Rޓ_�m�Wk���X��xx֟�:Z1��HTxIe�r^ݞL0A� k�֧�����0�d�"�m�*���#�)�ZTQ�>���D=�]IfL���"p%��Iz2G��Q�f�v�'�^�y���^u$���Q�(� ��Y�l�6����$�2��yY¼�uV.Z�1�X����)^�K���]�Gv�l��(��Tmh[x�Y�S�����^��{�'��/���~X�6�'0p S��}��`���oHt'��Z2�"|.�R�Ncf��S�w~5��g�d [11dI Wߎl��j�w!����L.��9�#%m�����F@a)��ˁ���M�֥'�H��W7�IU�R�5џ���N��'ٓ��� sZ(/�PI�` �*��>3C� �uu:Q�V��ʌ=*y��?! �X�����Ϭ��Ƭ�BQD���f0���"Wr�|)���<��V���j�n�~��_��o�'�Z�_#���K&�^M�:���?��Lc�b� 9��D�p�qJQ �ʖ�d[3�ٷ[�*�p���ށX�N8��JX���|Ǽ���K"#��� 5�F��/4=���^��d������L�J��`��(Iyژ>VH�he�)>�D8s��/Q��[�F�>��� ��rb$�|=�������W���`G��=)�iwW�w�x���ۏ��I�Ow�l��ZH�����MC�� >h~K�Bv�zm�ٳZc�B�ٮ��t5���%������ ��Ś^��aݙ�$[�oeY%�av!f�5���$�q�.�UU/�}�+���$��pB1X�5矢=yȶ�$F��~��Y�.&6������� '����J��|�n�V �*�:��4���F����3ҫ�3@�2�3�q*щ�I)��)�fs�uS�A.\�T�m��Ir������&��&��(��Z�/-�x��&���Q��$�ئ2_R*��Bظ!��:�����j�/##��MǦq�kr�sY_�T�`i~��EK#��+M\�^�x�ޤ/�[Em�nS-� ��5�/t�� "J��^�4��+p�����%]���j�ϳE7���c}�أqo+���DN(!�c����L�v��ʊz����0�F=��z�|��J HAhRR�E5������D����O�4t�� WǶ�zR�ղ�&n$*QLV�z�2bӊ���;��s�^��:�-��8N�:��z�D�J�6��&3g=fZ��7@��0�?�����mol�#������sm��+�+��M����M�d� 4����ۜ�$�J�Qa��� ����0��ag�QH\���l� �}̄���{(�o����6��}r?�1��3�������G���Ȕ�HQч�*&Ա:��e��zb����]H�tUçsX��9�*��AMɡ�N��O�T�l�bQBˍ>AJ�Vk�3�����`|�m�|_��)�@Wv�����ɒGEӾ�&]�<����<3��*[$&�>�j�W9�q��v���7�>D�����Telk�Q��M��qw�⌌��o�I-O�|H��mt�(Y�)�͠��S������'�A������'e9�!�=-�j��1Q�����1�� ���$b ����[�e�HX�Z�u�a^RⱮsLi�=]2<Q� 4�B�4ݕLi� A�);U�����J��qOk�R� �4�,�1�y9�u�E��(g�U�Ӵaj�[ef�f�����| �� ��E���,��ţj?������Lr��9^t�����+C�@� �W��,G��P~vҺ��Jsa���������v��u2�a�qz7h��1���İ�g����`���s���)K�s^�7��� �HJ۠F��@_�K��� `���Y��g�r����&�bv%����1���1d��@�`0O>��CB����v�6)���R�VHp��;��y�{iA�_�P���V�I�hA �Q���?]X�T��C���!DtOt�?Ei�s+|��@<^�#@�����:!v���O�o �^�.mF�h� e�j��&���~Ô��1R��?A��*k���H�Q3���<�`�N�� >���DW���u�M��L�}綦�T��y��Q�1���+i=-���� �{��1)e��\a�} ,��O��ׯNe?��9�ʴ�dф]*�#���(y)��� !�6aje;�o��S"o5}*i$b�S�R�U���hh�c��3�j'�/�j�����u��EP�\�yl�I�>M7 {�]��(bn���L~PGn�����u~�M�˔n�B�pK�Z�+��W����Y�p��P�����Iϥ%�,��[ɻ4�u�ޚ���V(��� � ���?��x�Z�7\l%�w�LY��S˜�{\Ӫ-!SI�����z�2�>���:w�/��[�����e ��Qa��;�
Static task
static1
Behavioral task
behavioral1
Sample
b8780c6d987dd404e34d296c9877b2bfdf6962b5e51d89200fc21ff2314c29a5.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b8780c6d987dd404e34d296c9877b2bfdf6962b5e51d89200fc21ff2314c29a5.exe
Resource
win10v2004-20240611-en
General
-
Target
b8780c6d987dd404e34d296c9877b2bfdf6962b5e51d89200fc21ff2314c29a5
-
Size
10.8MB
-
MD5
a6080d2503a08f1b5ce4010b448d33a2
-
SHA1
41fc1fe164a5fb26a11dee0ac303bef070cb0d41
-
SHA256
b8780c6d987dd404e34d296c9877b2bfdf6962b5e51d89200fc21ff2314c29a5
-
SHA512
e121ca020a24ad65be2a787e081f71bd86a14251647740b48ce72ea833d2353147bf17d98553e3006d7da5cd44ec284c0e5bce03e04adcd33edf9fd3f5b95d97
-
SSDEEP
196608:w5uvFj0eIht2baTZpstjlWso2mQBwtM5I0XNyMsR4b7BwM5GZbgG0k3sk0gfn0bD:taJhwmTstpvmqF1PUmwMMlgG0k3R0gyv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b8780c6d987dd404e34d296c9877b2bfdf6962b5e51d89200fc21ff2314c29a5
Files
-
b8780c6d987dd404e34d296c9877b2bfdf6962b5e51d89200fc21ff2314c29a5.exe windows:6 windows x86 arch:x86
4a885df5a74c13ad6e09e23af2203ef6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClassNameA
CharUpperBuffW
gdi32
SaveDC
winmm
PlaySoundA
msimg32
GradientFill
winspool.drv
ClosePrinter
comdlg32
ChooseColorA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
SysAllocStringLen
comctl32
ImageList_Create
oledlg
ord8
ws2_32
recvfrom
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 430KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp0 Size: - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.svmp1 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp2 Size: 10.7MB - Virtual size: 10.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ