�gN'¢-Uo��I��F���zJ5W�В�_͛c�2�8j��_w�%��5m84*�_��oAe�ڇ�JU��u�����M�^C�m2�2A����.C�@oV�~N��ОZG�n {p�z�K-���v�r��q\1�y�l7C�cM����5 �H%����������>�F*��m�d)qN]M�{���[���������J����u� ��� 9�����n��k^L/���Y��E���-7F���B9n�|T�o�a��?�?e7��oKm���ȍ�f��'���*Rgy��!��t��ö}�SҺ���� �p��tzr�`B�)��6w�ӌ&��?��:F�uˊ:�x�_q�d���[|�~|����_3ee�d��8 ��t��4I�1 �����J:硾��8W2���^�w0GC�8� W�����F�j :'��i�������|X�`�YGqӒ��a��S�x���N�����#�����o2�E�VM�b{����[�a�t��XaF�ar�#Y� ����=(t�_)t��̕��\��ԣ��:�B� ��X3�����Hf�T9��N��i($d��N6�!�6� GS�b2#n���(hρ��P{������ �0)ns���*Db�}vgc'��v��E�^�!���tZ�Ͽ�2Y*d �i�I���{������j �f��-��.��%��DK�{H������:��(Y��М���e7D؉�#��%��'�O(��)�)���5F~�m���$˽�oph�1.�������Vb�9Zʛ��h$i��3�N`�g=;� ݾ�|qY Nvv�z]��GtΝ��!�!m�g���F� PvV��W�\�H菊_�6������nr��[a�dh��"o���Kh�e���k ���n1�h������og��e7 s��թ�Ä3D��_���_/�<j�&��!��5ȺimU�n��m���HT|h �� ���s@L�����f�7$ �ɩ�[�,WB�o�λ����������$m�2m�b���J����� ��{T�(�sm�3T���;�6+H����r��'4���{aF��S��?Q��Ю[�� }��B;��#t�-!D��������4���z�P�⥒*�g��x�TȾP1�;� ���l�!�]�ϻqh݄~�8�-����a�Y4�s���v]Oh��3?��+�{��0��] �#@2�=R�W=����j/hg]��%r��8�O�ǜ ��D�-2>�dH}��S��V���۬ƫ�� ���D��R"���ȧ �s�S3r�N���d��_�P&�6#��^M�|�b yzH04�)4�Nxs� [����?�����ExEg�+�������D���tTX�J�M�����i)�g���8����×��XM�U�Ag�����S� ���uZJ�eYlG�Q>��F��k���^�Y��R��.1������,>J�ko����H������6��mN7�eI��R��u����*�7��K��VoU1I�������I;�X�|�Y���Kó ���)������P�j�GG3�����0����R�D�����O� x;���|��-�@�v�*�gH�����(����G���(`��ۓ?��QJ@%�i\h���p�1���N=�� =�)^���C�Zw:�.���� �^w�q^��z������K����w:��f�ć���T�,&��mJ7��}�^�+F���( IQ�BN�7^�yS7�3dV�Z�f�}�j~�������8���*M����PQA+W�v�� ���=k��C=�����\�17������c���w�S���cEiF$���R^�[C�%S&Ͳ���O畠#ݗ��+�#4�!��ͩ�0>�9��l�&�i���]������7�~d��P�C��,M��rп#��Ǔ��vL�=�LVj1R��n��X��'˽���}&+̀Y��yێΙ���Z�Jf��q��E�j�sW;��Ӻ��l���|gnS=!meZ �|݈�j�N u��L4�Z�o�S��)/��|?�ґ�&R�"�(�Ε�__m���u��md� ?ݖ}�暼�.���xOߙ��&贈J�8���_^�P4�{v���93���jNN~��d�^�6X��m�Wy��e���)f��������yL�8����i%�1;g4�TT�H��TǙ尝��}��q� ������'��V&�{Qܲ��^�����w\:X3��zDP���/o��<s:�B۰lk���nH:d+��ϻ�E��!\.,����z�E%&�0�ϑ��Y�%����W���`��)�#��_�~p\y��'�K�%�����pE-��Um���<;wLQ�:G��7bHG@�,�ց11n�\[���~f�x��~n�WIp�� ��(��yo��a�mr��:���$BMxh��S_����C�! �� ���GQ�%�o4��t#�:��"�9��D���e?W�{��k��IK���|c9�Z���C�U�)�!��M5ϟӌ� ;M��2w��u�WF�������^rx�)ߓ���4&����AU���["E�,u5��Z~X���_~�,�!�<'9����P/�O&��t�O���d�<�8�r�@����kT�9�!�ui#3����g��c-�:I%"/��"�m18�l�+��%d�_r�X�F#��e6���(�֜��a�@��\b������� [�Y��-`Ƣ��l�&��\j��T���] L��EZrMH۾���21aӌ�:��P�(����^�ʿ�6���1DRA��p lqr"0�{���&�#��ݩ�8z�!���/�hT�sb4T�V�Ux�T��zVu9�'�3J�cJ<�6gN��0Om��W�y����PlsU��+�`����Lnd�=�u�/�]���DH1��} Si�KA��h҈@��4������oE� I��3uO�7^<�����q���/T�>zd��t�NZ��X)i�4;]}�W����i�s ���.��M�����]�_�
Static task
static1
Behavioral task
behavioral1
Sample
aff0cc0c7bced6a0d39e550eea5bdb1ffc683688c1087f8a7d7c3485cab70147.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
aff0cc0c7bced6a0d39e550eea5bdb1ffc683688c1087f8a7d7c3485cab70147.exe
Resource
win10v2004-20240508-en
General
-
Target
aff0cc0c7bced6a0d39e550eea5bdb1ffc683688c1087f8a7d7c3485cab70147
-
Size
16.0MB
-
MD5
fa7b12e945b053b7a785f80ceba9b9a6
-
SHA1
b9c72f71f5f97584793e581f19669a82a6927aac
-
SHA256
aff0cc0c7bced6a0d39e550eea5bdb1ffc683688c1087f8a7d7c3485cab70147
-
SHA512
921f8ee1c1ee85fe8e85387c87449a7b44f800df71cb8cede9a8126aa9809685503cd2c0df153aca8df8a57baa990fcf4fa01b89cea4c5435fa4fd7728a10668
-
SSDEEP
393216:VTNacBuyxTkE/VE97SsC3YhUTmYLdfU057D1:9NacE0kE/k7SsC3YhpO5/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aff0cc0c7bced6a0d39e550eea5bdb1ffc683688c1087f8a7d7c3485cab70147
Files
-
aff0cc0c7bced6a0d39e550eea5bdb1ffc683688c1087f8a7d7c3485cab70147.exe windows:5 windows x86 arch:x86
7f1e4d8d5e1fdea0b56c583bdc8a14ac
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetMenuItemCount
CharUpperBuffW
gdi32
CreatePalette
winmm
midiStreamRestart
winspool.drv
ClosePrinter
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
VariantClear
comctl32
ImageList_Destroy
ws2_32
recvfrom
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 730KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 271KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qvmp0 Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xvmp Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xvmp Size: - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.qvmp1 Size: - Virtual size: 13.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.qvmp2 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qvmp3 Size: 16.0MB - Virtual size: 16.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ