["��������k/vr���P!� x=LS?زD�a��JG`������Qlu��7�B�:"�����' ��R����*�Qy�ČLx�5���\f3��ut�&{J�?�����6e����ۻ̪�z���m$��,�m?�w|���u�����W��6|��@����wYv�ŏPZ9����e��h�����?���L��c������>��3gx���c��<��H���+%���r�Y�����$���y��AL����� �歃>�s��ů%��B,�G�������(c��E�M�ImM� �)���q�m��}���;a��Fx���q�J�������̻��z�#o�([1�h/�R8k�(��O�W��*eUӔR�ݣ��?1��I�����٭�B�zp�B��\����d"�v���0��� �/ݟ�E��u�>�^+���?6"�~�����d����q ����絑�A��[��b*n��N��0�5.I���p_&��r�q��M�����YѶ�B�G��\2H����)z������z%c~"S�eT38���#�*�a��y[�EilH:��3M]����^T�*;�i����'�lO�7�2����V������8�oN;Xʊ���~�sSv�Ȕ���Nz�)�Pi4B]�4�����˯i]ro:t�y�<w��&x3#��^�����[�����-��>H��_[[���th�L'�T��<Hٌe�(B9 ��*X:����z�Q���X��u�����6;����hɤ�s��j&9L�̌�{�+o}�i�+��:�X��j�.6ֹ�w$S.�3D̛���.p�B�l!Y01����M������m*_�?Mp ��Dh 2ɕ���������%����g���I������b#���VX�Y1��m��� �S�0jV1�44��RQL�ު��K�stH���ò�����O6��5�ԡ�t��$���C�q�=צe/i��@D���X�����'$��_Ǩ �'��0�C2)pH5/gl2^Fm�-��#i#���X�?`;�R��-�Bh�G[�Q��#�&�� �e�Qm����������\u�ۅW���a�:�r�3�1�� M�_H�n���l7��ٳ��d���/�����k��*��HTŊn��bY��j�j#�zT�����-�}��٩oz�*70�Y�mҫ�_��w�H/ qD�[u�B�"�M�(�7G��q��S���Y&��A��WC�������\����5��/!� ��� �˥�W� ��q��P8l!K:�?���1yQF�1�p�+�l�y�`��4�{tt�t�y��o/�o!0��z������v�C P���Jx��c&�bBll�ƿ�T]���4���?�!�)��6�"��t �y���J���);�5`1Ҫ�+ H��1;���e���Z嵑���<�<���>�#Ÿ�MD�ݎ�\�5�a�O1X���.��/� /�w��e^0h �ZY��SlV��K�D�\<�6�^��fq�y Z/-�$n��?��"�x[?�2���>�}�"6[��5�Y�*9�{cG&C�S��Q����lkb�Jd8CX ~7�&VmB��D�q12�HJ����roy�фldz�匉�,���9C#�˥������3��z>)kj�~5�jTs}��6��**�m[�h����k.��`�xlW8-�T�p v%��Z��� E��.i.[�6� �E2���Vw�f��a�?�*'�b'����������W!ڣ�؈(��f��{V� b��l����V�M9ZK�oh�F����Y6�¦R[.�J�hFʌM��t����k�Y�;VH�{ C�++ӶD6��g*�A6KkJ�+*���a���Ӷ9&N"%�����c7�u���>vcmѮ.���/�O,H J��/��c���<�7?��|g��\���x�&�a���4�����Bp��0O�b�_�'�8��H��q#��5m�N�DFӴ�I%T��U����}/؋g���ɎO��/�\R�L�P���|}Xg��5u�5N��oHg~'��gj���R�xdn�A"�Q�B�\�}�q�,Ǿ4�� i?��q� ���������� {��������vR�^(�p���+DL%7�_`$�ƴ�&N��Z��v�6\]:,�0����U |v�F�����h�(�خ��3�_&/��x��P��K��x�ϱ�� PK�m��2�")x�fD��1�b��ljq���2��_E%m�/K�S����x+ `i��)�a�Q�(�)Hb�|S��Z �E�����2�?B�5YXh���X(�#�y��+;���iG9T�ls�G���B[��L�c��բH�s�.�(mu�@I+c|�]*���Ų[��꤇~���妥ڄq�+?ã� +�1��-��q#����Ls��*p�@�Vۓ��]�v�6}�}Ē���V� Q<,�eB�M>f��������J�{��q�u�>�r�d!��).l����ϫ�9�A� 0��e導�9N�2u��k��<v�����8���P��Fa]y� ���>�"U��;�۠4�H������ױ��Θ#�?�j%"�^���p��c ��,10��VǏVI����<$i`D�vL1�/&[B��$������.��c��R^�~��Y|�*|/�FǬJ�ᕫ`�+of8�s��T?��:���fAj>a'��t1q�-2ޑZF�y�_3��F/��k���=����^�g��XkIuD�֑�e�$b��:�V��7i�$ �����(����ʠOA�-#4��+��2�۞-b�*����/kD���ѻt6�#����q�:3o� ���ى�om�A|6s#u,�3�A���Y�?*��r��sW�9�*�f�ܫ�Q�v�P��|�T��;����aOʥ�����d >�9;kk�m�=c�߭.��{��%(>�j���ҮE�6P&�����n;K�� T���C�F]��~�y0�@t5��-�>+ߒ�2�A�0���x�z,k˥�������Z�� �xX����J�^����4� 2�_nP���40cx�_�Eò��NT\��aa�_TG�4/�
Static task
static1
Behavioral task
behavioral1
Sample
54daee68252d33b9eb5988f8cca5208a10425e601017538e48e3daf413b81155.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
54daee68252d33b9eb5988f8cca5208a10425e601017538e48e3daf413b81155.exe
Resource
win10v2004-20240508-en
General
-
Target
54daee68252d33b9eb5988f8cca5208a10425e601017538e48e3daf413b81155
-
Size
5.5MB
-
MD5
10180ec10afe96de15db1b2ebd090f18
-
SHA1
e8b1832f87f49304a601a73da4c82f73398ffef7
-
SHA256
54daee68252d33b9eb5988f8cca5208a10425e601017538e48e3daf413b81155
-
SHA512
622b1f218dc3a2e83ae54c8bb42921b14270efb4c2999393522d7158fd8d9af065038575d95f357cde608c0f662f64a8bd94f60121cb84f7d0bc658d2f492b0f
-
SSDEEP
98304:97KaJuNaoP7y7sbrCedd5vDJxxaIBNZwA3GSSZX6qjiewmrMpmwdu1BLy0iUeu75:97K0uNGobG25vDhaCb3JSZzTwmQYGu1N
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 54daee68252d33b9eb5988f8cca5208a10425e601017538e48e3daf413b81155
Files
-
54daee68252d33b9eb5988f8cca5208a10425e601017538e48e3daf413b81155.exe windows:5 windows x86 arch:x86
a9d7e32a5e4305c210bc52c3a0f6f014
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
GetErrorInfo
advapi32
AdjustTokenPrivileges
user32
MessageBeep
kernel32
GetLocaleInfoA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
CreateCompatibleBitmap
version
GetFileVersionInfoA
ole32
CoInitializeEx
comctl32
ImageList_Create
urlmon
URLDownloadToFileA
shell32
SHGetPathFromIDListA
wsock32
ntohs
winmm
timeGetTime
netapi32
Netbios
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 48KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 316B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ