Qp���P[�_�b%1�KW�����S{�u:����J�n��*�aSC�k��SAn���n��OH��>v��iCM�?~Ѡ���A ���q<�����*xN���l��u`�vk<ڥtO��'�GB*v/��z�|��"4��:5D�꽎����qg��h�ڊ��o"f����G_�O���:?�T(��TRG�K�,��#�u��O����Z.��k��_l��6<c��m���9�$v�����a��ؠ��|u��P��c��ud�RTm�j;"�<r'�~P}Hz0�a��2In�n��E�ƽ'/��gG�3A9���_rӟyJD�n��4�dV�L{���GLc�<�@/��6m��BH�<Ij!/� ��iV�1A��`����j���m猑Z$�u:{��qJE��m��v��"���jAZ�jE��[�꒹A|����� P���xe.�ڧ��� :�F\{�D�g�\�ц�����(i��dNz�~! )M��?{�^�Ne I�,?iP�{��}�2ez�cU���~ӳ{�vT��*<ޔc�����<I8z�o�`l��$�����)��'�Ŀ�����f�&:t� w��}VپL��"_ N�������.ǁF��2Hu4Yw"VU��F��tUfמDvzKx6��[Z�.%���i�Ôg�-���ٞ���Y����A��9���.J9���243�������vd�x��"�g��{|��tO��f�[n%���� �8����ݢ�HE����l�����.��T-��B<��W�� Dv��!�J�H*�_��&9�RƻӐ�rUC,�])�u��~�K^�<���;cӆbA��_���}�,E2�UY�������A[6�)o�1�峓 �3���/=\Փ�d�Ut���JJyQ?^f�����{d^F���d��@ +���^(ȁ����t~��4�w�nY�Po�9��^D~qK*bd�W#Ţ��I�T��K�m�y�[��+yQ�d�OY�������/�n��^Pc�S��|W�~�=e��*u ���B�����o�y�B!��a�9�1��B!G�� �����jt���Z���綝V�P�d<�ߤ0�t�h�B�5;0|�/DcY�1MP��! ��Fƣ����S@�]�H(�J@�k�4���4�M ��aq̑�"uz�6���Ѱ�7����a�ZP*���Z5��f�5��I����t����p&UΪ�pL�������� 0���ꄤ:1��W���};�&}�yH����!��6�;���5��!-��e�� ܴ8�f�b�0 q�}�?�cV�G�UQ5>�F�F�s�?�d�Qh}�"�3�������]�=���s���C�tʫX��J��I���rX�͠`pݭ]��mٗ�����\*|�� ����Ѿ���pa�{U�we$�|����n��fޮ\�}�aae��I��3�犑`{�b�����K��F@q��Y=V��P��b�e��j�T{�%�|�b^��� ܂�^�P��_�fh�HF�%��٨�[�����wޅ�A>ë��Q �!��I�����~۲FP��.������E��� �7�h䤁��T~����|�� �J�UJ�����\�� 7^����:�]Le�J�g�������"����_��0�D�ΔV͉9y�]�d�:��ڸ�|�A��W1��I�$x&�b����L���+d�k,�� 5�:��&^��5 ���X��$�b��-9�i�hn�f����ݟ����p��"��p]Y�`���`L�=��2.���z��Q�0���5�[D�|�iʙ�@dԞ#�%������/D�s���,*��>t+�+4�|��=�8���3p����ַm]V�4���J̸�zs�:^%m���m�r��l@ ^�m� ���S:���q�=:���>6�]lr%�^���뫺4�V7vf�!��4 ����������ҞX��);��'�Ǫ �A�f:m�Y�L�R_�G�ʗխ-��`h���;����k��� ��K��T�����Ċ6�\Yװ�5�>e�!.U�Z ����8Y~/c@=�+��HZ��<y:ٸni���Q��V�ǝ��;h �(g1�X\f 6zo�!�%�I�1�_���X��� /R��A�����2�T�������C�`�n:������)@�)�~�ش��H'@���_"ύ:��zvD�0x�j��Y���."�(6�` ���ύ�'�@�� ����%���6`�/O&�n�f��^5?��}�0W�ߠ3v�q]���"������4 ��`� ��a�����[�e�- I������i^�89��V����d�5��O��s�Ȑ�p5f�)O�+'��rn�Sڳ��7z���m�U��Ƽ�.p\��p�k�Z��]gϹ�����A�B�0�&l�G>D�F8��o"�3n�z=O4}~��q3W�ſ���f�X£�̔� ��9�����%@R��SF�M��x����_��{KP���@��#��A6|���?���b��P2%����Y�i���]�&M�/@��Bh�0�F�`RA�CcSK�i+hJ���F㶉�����|�w�������I� �I�fY��N�N���=e<>�n� K�ă�֬'���\�v�V���E~Ӂ�+��ʿ7�R��ؼY��\?o*�#���̇��h.hP>1z�Ӣ�i�i�'X�x�0d�I����E�'�!�صN=�X4=1D���-���+՞��QY�N��O�r����3�������n(��UB]5����lO��/��M��?D��Ѫ�r�����ǿ�H�~� B����'�I�͡�!��K_����5�R��,�^Ke������|����A�)���R�k�֟��Qӹ�no%�/�L� Њ�.L�ڲ���\���rd�G~g�]��e�bg7v��^�9�R͎�m�V��Д��=c,�r��p6/?ԙ@QX�ŕy����E���v���斍�5{�x��[i�;�s@��7f4^bJ�����i�A9��H�fGe���y�!�"���g}
Static task
static1
Behavioral task
behavioral1
Sample
59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6.exe
Resource
win7-20240611-en
General
-
Target
59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6
-
Size
9.6MB
-
MD5
acbf4b85e79cebd64f71f96ab4e08edd
-
SHA1
41b7dfb70131b9fa7826345950624afd98bd9dd9
-
SHA256
59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6
-
SHA512
137c1c44df642a686296b67a738e9242094c9c0fe6203b426d652522e7bd16dc24361d2cb8f55b484d5858303a5cf8ac1f471c83022c13e625c576dd9f27025b
-
SSDEEP
196608:9vdZfuYbS/XV5o/7xM7LRRm/zuKLvvxdF6TKKDas+rYn+KMTKbi:t3fcXV5ozaRSZLv5tZrsq2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6
Files
-
59c882714ebbe3113113ea323aae6fc0460d0af2af046972a6383597c0e4aef6.exe windows:5 windows x86 arch:x86
efd71e507bff78e155e9e4421b585d33
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SendMessageA
CharUpperBuffW
gdi32
CreateEllipticRgnIndirect
winmm
midiStreamClose
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
RegisterTypeLi
comctl32
ImageList_GetImageCount
ws2_32
WSACleanup
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 731KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.=3c Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.>1: Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.[Wo Size: 9.3MB - Virtual size: 9.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 264KB - Virtual size: 263KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ