W :t��L���g�Q�˄RN��BW�K�Ì3��N��B�8������������=C�-9MW�\iJ[g�y��c���(��b�TDF���̔�!�+i@?�6�.�^{V�6i�m�{�$�������;x������*�o�lw��P��$�>_��YX�q���ʽ�v8�璣<��gD����A��=�����B>ރzv��8�]�˳��������o�ey�E����?K�7�Z�ER>2:i �����D���q!�#���'v3��w7���o梾���y�7��w9Y�F��"��J��4Du ��rc��x�i!���/O��]��n���)�BH�Z�-�b=�P��g���ʂP1nI57�:>���@�KZ���#�X�nm���^ +^�\�>�A 1�KUy��-��N'�9$ <N($ ���*:��y�$<�����F���� ֞���+�ldͮ{EK`3h� $��~�E��ĹL2����B3ʑ׳�G&���f�I�=^����J��=�Hhw'���=� :�cMA����?�_ƅf��O\���g�-ơt�7�5��@�GX���,�'��<�<�U=���)BS;%�3�����Nf����棷�����X�9a�XE����X���Zg�G�[I�7M!A���-4�r���~�&1¯�H�)I�x�݆5��9�73�<���e�� �A��q���Q7u�2ɚ����#C���>@GT����ɋ&Y��� f�ΓH3h\���pK4i[��:^ 3�$�'���l{�pB�X����㹬�^��&2�S�w�Ak-�a�!���R��1X�25���)[u*�� s�����:<Ul�^Y���q��|��t�I�{-����E@�ڹ�j6�D�~�_���M>��9�c�pp���K[��_����D�[0����� @�a/Ѧ�S�T��Gq��[l����gɡީeH���x�#�^�n'&<w7i���l�4S�r�3_��ϙ�*"��p��4����S���OEY5��Mjv�2x���>`�K�<cHv�5���6��\�*��2<���z��⥍���4Pߵ<�̧Z���-���ź� +�M%>Ů�J��>�ڏ��� �<���7��%A�Q���.��~��@|�V��`r�fkcA;�`�?�� �o�%�Mc*Do���n�{�0�`�������&�m��#y4���J/��>̞��M��{�t_�:LZ~��q��n`�mm�-��r×0c�>��]�+���E�\pN�� �3�h\]m���R,�&�#.����|������w�N~-�X���J�Qနl��f*6H}��gM�$���-���g,3H{�n��#mݍd�F2 M2Z0f��/�°��Ir�\���d�W�� d�mU �[_�Pd���q�D4�Q��R%�y�����K�娄�ߨ�ae7KLc "���i'���9N}���?����k��ى�Ǝ*Ձ X1fg3�s�eW�" s��!��]Ne:�nL��W�:G���:9X��q9��Ύ��;��tm|�� �F|P�Gۨm��Fmq�fP����艷h���5�����՝*�և1� ��#�Y����89@ӎ�r+$�ʾ���%S-h��{ �ǭ�C�����B���^��!Jd��CΪ�.3Ftʃ�����,@I��U�"`d���>��,M�(��&�4�4]���-�)PVQf�8��!�z����hhc�L\�f���4f��:�*�%U���t��"JۋH�ܢ�CH ZI����<`��s�-�IW����e �秹���ڥ����`Y���a�pn=��e@4�oդ|�F��:� J~�&8AQņ窑J���+֠-{�;�H��,N�w��q��e*&�J��ԇ2�����F\��5e2N���l�t��q�M�KN/˵37�C}���<_�D�p�(�@�!dNd�$"3�*�O�oz��bj2�G�� �r�.��[�^2C�%%7����TqU�ߺ �0sc����w�Ea=>��(X���ue^�y-Z_�n�w n�i%c���Ů�<��+��� �k���ʮ�*�N����DV�� <�-$T?�X�'�)���2 �`e];2�a����9�/w��ş������M��N�� �:M�h��E>p[%�8�6q0�V�A��!*�#C�Ȗ�#�U�H���I3l8A �R �����t@⌔ p��*a_*V����zis�4ۮ�R�7�4�t9o�LK�v {x�e9��~��}��w����=� ݐ�!��P�vXN ���M2�jn��e��t�n�4�Dg����n �;���OG�LʫN��x�ܿ(�� Ck����s�3��ͅ���/��j_��R��T�y��НI�Wt���ϮW�������m����0��M��� 8G~�M��� M�"� ��5�����e�BS�"� ��Uf�<���ؗ�.��Y�]|ͭ�-!eߠ�ȁ.��C����9S�: ��}���]2_'�F�����h���tN�7u�喰˻�Q���W[ ��C����~��%8���e ���T��̭4��Tn��BE�K�:v�1���&'R6W����Q�o� ��k�Z�H��/rr�Cl7�ҭL�5-e�r߹��@�e�y���{#�-��ו�v�y�{��'D��ѩm�n�k:��?G�j{J�3����ԧ���A\�1��l5ڿ��M#IM�|��)��/�}����F<�9���e�4�m��į�)n�r���R:b,�fn��E�;{��`�f��V�B4�d��t��U�ܞ\ːl��p´^K�j=���p#��C��8�C&)�(�{�x��f��6;U�露�~s/�YE����#emU��Qӊ���i��Ǘ`��6���lY/7�t���4z�n!aH}��d�����v'��P�eP>(��J�x�Z$(�=��C�e�y�������ڱd��kw��;+id�u�Ҝ:O���Z�y��b'O� ��u�j�+��~k(Zn��9 p8�ϡ�r) y����-4ӓ�,gL>�'Շ5P��1wj"�H��&
Static task
static1
Behavioral task
behavioral1
Sample
c75de83d4adc8089b69bf2188bc56d7441f8062b90780d59b45fbf1ee743a8e0.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c75de83d4adc8089b69bf2188bc56d7441f8062b90780d59b45fbf1ee743a8e0.exe
Resource
win10v2004-20240508-en
General
-
Target
c75de83d4adc8089b69bf2188bc56d7441f8062b90780d59b45fbf1ee743a8e0
-
Size
8.8MB
-
MD5
4f50bdbdb433dd9d4a4fe297824ecc33
-
SHA1
7f07c54bd812d849db4dc2c4d6d64fc39fcb0b2b
-
SHA256
c75de83d4adc8089b69bf2188bc56d7441f8062b90780d59b45fbf1ee743a8e0
-
SHA512
5f0a8d9b819cc058cb96648916f196bc64f98b4702bdf4e89f71699d3f0232fa810211e8d64046eec92df71d01fce7f85ca833c822c5d9ece28c47f789db334e
-
SSDEEP
196608:WCL2zImBPLD0pxBXLIQavr0Y2kn6ox9kBgdj2lBTpXtc0Tc7:WANmZQpxBbI/vIUnXsxnc7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c75de83d4adc8089b69bf2188bc56d7441f8062b90780d59b45fbf1ee743a8e0
Files
-
c75de83d4adc8089b69bf2188bc56d7441f8062b90780d59b45fbf1ee743a8e0.exe windows:5 windows x86 arch:x86
9fefe7ebca09eb447273bac9c5d3f613
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SafeArrayGetLBound
advapi32
CreateServiceA
user32
IsRectEmpty
kernel32
lstrcpynA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
RealizePalette
version
GetFileVersionInfoSizeA
ole32
CoUninitialize
comctl32
ImageList_Remove
urlmon
URLDownloadToFileA
shell32
SHGetInstanceExplorer
wsock32
listen
winmm
timeGetTime
netapi32
Netbios
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 50KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 536B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ