�:W͟�P��NY�M�'�{�Q:��u�\����P�R"`���@���@�ZF��l���*[l�,�:�P&�/<� �Ô��?����ĕA�� d>A>ZP�����Od�rMe��:]%u�����%�m`|�'=Cwi�47��O����i��I����!/h���n�_��>�'�Z���`v�q�d��RJs��Ϻ0�p�i��]X�$�����-�o�a�-�ӚJ%�C�G3�O����M��X�u�Y�~)zY�K�+� ����ۑ�6ـ�\:<�G�W�e��G���?���ܒ�N��'�+�d�᧫����$�BfAA��0��I˓�Z���ݠI,/��������'ghi��;�k0�k�D9�ࡃm�"<�w@K�D����61'��^fa&��paj�0_`��d��Y�ޟt�w��M��j�Ŗ��p��D�4f�@>������,��p�9��1�u�L��d8fXe��w��!R���N�Gm�XM��>�X˸z��W����ʴ*O&zBˀV�+-d����p�'��q��7i-~�n�Fg��e��O5�IWЫoh��>V(���^Q�#rJ(��V���ml������B����G�:��%���,����%Y��֠q��t�ި�e�t���5r$�C� �UQ�$.!�K}t���v��SUI��u��l���`�>-)N~!�9I��mi��?4�J+;���*˄��A6�C�y�����I�G(˗&�7�3oT#���U���|)�����D�D��f������Aڟ��L����3v��ּ�����B�BA��!����h2k��8��KP;��^r"I��90�}�[��>y1�k�7ƃ� X(�Yh�����L��+W_��gh h���OO��@�D���\�S����\L�����p��}$��Ώ*���4dH�|J~Y��[�lOȫ��'`�P��dL����a�edV���9Ի�����6dDw��_^�4bR��a2!�V.K���b��t ��ci$��=������b#o�\~�Y��WyԎ��o��Y�r���*h=��|�a4O`|,&��}��r��M���d�c��<M�|0��#0�i��]�������E�L% k�� �9'C���������ɚ��I�,�GU���:��ZN��LG- ��U���{���5��|d�P��f��%����"���qX�t�u05������C��4��X�œ�yY�:�?)�%����?���x�q]yxmh%��Qz�<���=H�W`<�'�P���ۏ�� ��]�@,�党ur��������IH+ӓN��B�]��|#�E��>�Ւ�Ud;�=�a�ف�@�R�r �\����"��ƳT�uh����������w�0�dc�N�}�����;�0���4���riJ��!b��6s0[CokA��֬�?�[��ƺ��)w�Q��zބ��4�Ƴ�7x�:(�=)Yǭ���d *k�K�w`CS��c O�AT���Vi��8T��L�|��r�:D�p�n�X �[���5/������T66�@C^%8u�D(��s��W���0�۾�̏գ��S�rd��JK�xO����J�E����9O�M�����$œ��v.���H���~��k��>;I��6� GJ�����z�ԕ�`DŽXϕx�)��oι�� c*:�ýF���nE��K�g���+Z 䄰T^�*w�L;\*>�Ê3kz�Fv '��KMS���o��,\�PʄF:]4w���Ɇ�G�'�0������m�.a����[��hW+,�հZ�\|�������7�w��w!���6��V@5�Nu�Jݴ���5����6>n�w�Ϙ��#!���6If�pǫ��P|��� �܇�t6�|m�#O�5�N��ɿ(�`��SK@���LW�j�^������džӆ����k>����? �)ﯤ����C����0�rt��;�J��3�ѤS�����Z}�9�����,�Q]Q��z �8"���нD�So�'�u/(���кC�Ļ;/�Ny��?ms�� �gӘm�-�\���e���H:(˵g}�����~���$�7�!=���.u�s�M�܇� �� b��A���?�������O�����z�a�Pn�sa���H����栙�B���/��A1���T`BVQ������I�l�����Zu��#�$���|���;U�F�4MA=�Qr[պ��O�RJ�=���4 ��"+I������ٰ���r�� �ު�1v�Lq�3��,�[�r'(���|$6����Gv�J����kns ��X�]Q}��BZdq,e�m����4�(�����؋Llne�k��#p��&7-���p:�u6ftQF��#�{MW��q���BfT����a_��r�"�:x?��� bc���]t)���,?C �;��L��o���&�c�p��lP�����O|� ���`$C�\$�����p�<�ٻ��^��� ��hg7�L"�n����纆u@wU�����`e�ML�h��1�Y"18)���Pwd���n7���i]��NJ�����������xĪ�3�I���"�Ď�kh�H��i�^�'�6"��p`Wafe'�Hѣh�i8��8���M^����F�]�������������.�Y��a|��w��2{�}�3)�+� �.��:�����~ith �V����㓥��J���ˇ�.�@�T��q���?��ձmǔ@Q0&|�9��qPz4�����+Kbd�Ϣ�â���i#Jh�C&K-��WI+� K�(�L� �mП���M��X�bP����*�>���{����YO엨\��&l!� �)fc�IL�]��H�F�3nB�3�4��ȧ�EVY�p)e��,�eZ��F1Y��@z��q'Og�9��n\;A��/���?�*U��ȹ8O�5�B�-J̅�����yj2��{�]=o�����҉RipO�-4�6�r)&?�SZ��J�[f���4Ɲ�����i+�� �}Y��*�d�Cn��Ńq��A�GW�p,�F���y�߄9�mmzK(� H�
Static task
static1
Behavioral task
behavioral1
Sample
22e553d63e15b23c9a11bd6648c56e304eac95fe5a1736359df6c7cbb914a2da.exe
Resource
win7-20240220-en
General
-
Target
22e553d63e15b23c9a11bd6648c56e304eac95fe5a1736359df6c7cbb914a2da
-
Size
12.9MB
-
MD5
cb5ffbaa4f8fc9853f479e874ec46a7b
-
SHA1
a3f022690f00215219cb2047bf33d97a7ced2372
-
SHA256
22e553d63e15b23c9a11bd6648c56e304eac95fe5a1736359df6c7cbb914a2da
-
SHA512
99e952f070cb0c361c8ae11f7016454f4bc5eff131e321a77963bf8b23e7e5e33a5867d1f3ef039582cfdcb54ff872aa3f360d9407017f89c5641076f5bac12c
-
SSDEEP
393216:oNKtNhJXh0HgO5Lmif0RsHgbEQ2e77cpYwyTa:Xfx0B5q00MwEe2Ywy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 22e553d63e15b23c9a11bd6648c56e304eac95fe5a1736359df6c7cbb914a2da
Files
-
22e553d63e15b23c9a11bd6648c56e304eac95fe5a1736359df6c7cbb914a2da.exe windows:5 windows x86 arch:x86
36b596f263c58d7c211a98aac3a97ea4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSAAsyncSelect
rasapi32
RasHangUpA
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetFocus
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetViewportExtEx
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ImageList_GetIcon
wininet
InternetGetConnectedState
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 785KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 526KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 12.9MB - Virtual size: 12.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ