�6�s>p�{� �DcQN�7�ߦ_m� ��Ġ��.Tt�V��8�ɬgfΊ�a�]���)��n��ͻt���$�ڌT� �ȑ>��iطR��:���"�mW���q8�k�c�M��?��M�8�"�Dl�G$YG<�#t �-�RU�F���D���)������ ���� ۄp�$�3�� U]y7��%'��N�U��TmUx�YW��^����}��G���S��6��Qw.�i�04e�%�Pp��U�ȅ���� ��������y�z"�7��d���X��*��s�5`�E_��NS�}G�J'���g�gq����i/E�AS ��Ӯ��X�e6B�SW_���A�U���b�ɚ�A���i{5��;T^��OM���&�iԄ ��P-9۬^(0�.�{%hx�&���p!!b�:�.����������jŔ/^x[?>�+�-��:����[G����"�+Tv0`d��6��ru2����l�>$�p�����KE�x-��=������e���-�X��`�D�������͍7��fBR�%Q�`�s.JIJ�!G��=09��@8�P9� W�%nɟӴRDI��{�ʴzi���;�vRrz�r�C���$�d ����Z�R�$�ʳ�gMGjR����W&7���C}��gi�|�����T�#7�H�q7ZqE���YEf�?�q ^Z�Net7��$��6(�z��3c��t�ۜx]��M�Hwߟ��T��W� �����cپ]@e f}�Ҟ��Z{�����֯��ɨfRCn�0��zގ��u��?;�LV�;��r���f�J뉰aఝXu�6�x��!Z����cÏ�L���e��]m����M��b�V��9�<��6yG|��EMc ʉ� N]�����zZ?$n �`1�q"y�F@� o�����M��/�՟�b�����������o\�6�kP�m#vu�#���.��@�8����_��\d���!���h�6�p&0��d b��t�\9�Vz�1�����ۢ���t���H�����w��n|k(������&� �oE����r�X�x������_���b`Ȳ�b��3'�`=ʜ�qd��B1�dd,=,�KB�li`"��ׇGrũ��i !��ɳ�\����z@=�]A����.��3�4ĭ�A�Yߦ����1{?��!P��5m�f�߇��y�����8rT��� ,)�:�**��?�5\��:��3�W^�5��u�O�V��!�,/��br��"R�kn_*Y�������d�م��O�9{�]$9U-$=��~���$4���?xt^���U�"��ؖv��9�=�R����i�� �y( �x5�H�é���L]��iqweö��h���(�A�,M�U��C�*�[�q�zX'u�t��LV0�V?R�t���nm��s�!;�Cs�) �O)Q瑠/���mg��:�Դ�7���ns�g��2��~��v^p�0W�Kx��hݍ�O,w�P"�"ɩ��P��v*��p��������kS�V5�nh���`̂���p�doMxg�`8�*���[%�-[x��b���e,]�G��扊�k $xR��|���ӫM�Jp�������.g�CXmmb�8ёN�8��q�z�Υ�.�M������6�ɒ�M�lPϼ!0��!7�h��(0�)E �J��h�F�Q���8gP�g~���/�1(�7�î���>�<)�|�4Xt�6x �G��!X��[�IZ�+>�#D��b1 q�]As)Ur�����5�I�KЂ�^F����p�J,C��ӷd�fs�����v�V�Cp٦�X|����.ީrM�NRp�틀���\���Ly�������ɒ�|rpL7��[�?2��!��[� ��������7z�F�$!Z���9�Hf���+'����*��мxE �r���ϓg���f� �|S��[g�GX.i�d)GU���s9*m�e��9G�SAI�;zG�x,NM�=H%�f������'��VM����$�X��E�Wsw���Kjh!TG�zo�U�{Y�iʹ���ǻ@����b�p�{KT�������&��=�G3#���,S����m|'b�첤����%,K�˙���p��!�4����d�hXT�-���K�j��k����X��=�����j�>�Br0"M�"�zB��*Uu�I`��h[@F0g4n_7ww��g����eR5��y���=��x��J����^7��`1!��e2�j���'��k'���&�zo��x�]� )��ɘ0�In����,��|��:W�M.Wx�4(4x ���em��J7�����6��u�x�D��b�:x� ��y[<���$�h�nVU���H=��KFx��wߛ4q���:>%�6��i�/J�V`�Eb���0���Z`���������0Nȓ��14�,�<"AVб��oa �<��\��ѹ�w��9� ����Ӭ��qoe"���Շp�%!������u1Rړ��bD�4#@��zTXr?��f��\������؛}۽���,v�<?'O�}g�ؚ(=+!���27�����Ҋ�R����4�H�|IL�w�EO `x��5���fa2�nY�~@"�U/w��,N��/��=���y���ln�ʕ/EJ�*4�"��"��-�����U��"`'l�����-�`@Q�G�r/rT��!Ѷ���Xj~�_��"��3���"��r$�ع���b[O7����y\K�_�_�| �Q�� ���Ou�ۢ��:Rs�^����ugWP��Iͷ�� }C��)��{�R������,x��X+G��*v��.C�V)h���FW<E}�a��հ6���I�KX ���Gq����.$�H>��̤�I���lK�f�:���pNg֮A s�>D�� N�p����P�\���ƭ<>$`P3;�}c�����-�#��� ��1����}o��)�Soe�{�%�\��! ��g a���kJ\<Z]lN�w� �p~(_���Ե|�%��Q,>|RzMJMƔtCX�� 27�N��% ɃCo��D�>4��E}aqH" �i\�#���;D� H����q�P�
Static task
static1
Behavioral task
behavioral1
Sample
a015050ec13201ed5eeda33263269740b473b1a266a3670a7691f22b00c3aa23.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
a015050ec13201ed5eeda33263269740b473b1a266a3670a7691f22b00c3aa23.exe
Resource
win10v2004-20240508-en
General
-
Target
a015050ec13201ed5eeda33263269740b473b1a266a3670a7691f22b00c3aa23
-
Size
2.2MB
-
MD5
5a753e7a4707b31e113a98a7d76b7be3
-
SHA1
facc71797243dcbe40f49a72f55cb1bd696e27f1
-
SHA256
a015050ec13201ed5eeda33263269740b473b1a266a3670a7691f22b00c3aa23
-
SHA512
e47862ce7d08e67a934f10c774bac703798704bda7c3f69e58f203bb5580ef5af68f7a34e2223afbf0bf42a3a9f1325146f2d462f2a36127e04a15440e5f59b9
-
SSDEEP
49152:gcbYa1HgrZ7uSYWwKbULDCY7P1uiwmPXMigBAaxfXY:MEHgrQS/w1LDdoiMigBAg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a015050ec13201ed5eeda33263269740b473b1a266a3670a7691f22b00c3aa23
Files
-
a015050ec13201ed5eeda33263269740b473b1a266a3670a7691f22b00c3aa23.exe windows:4 windows x86 arch:x86
275c33062ddc269015ed6bb28602912e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RaiseException
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
shlwapi
PathFindFileNameA
ws2_32
WSACleanup
version
GetFileVersionInfoA
user32
CallWindowProcA
advapi32
AdjustTokenPrivileges
shell32
ShellExecuteA
ole32
OleInitialize
psapi
GetModuleInformation
oleaut32
SafeArrayGetDim
winmm
waveOutClose
rasapi32
RasGetConnectStatusA
gdi32
OffsetViewportOrgEx
winspool.drv
ClosePrinter
odbc32
ord13
comctl32
ImageList_Destroy
wininet
InternetCrackUrlA
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jpo10 Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
jpo11 Size: - Virtual size: 962KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jpo12 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ