����G:�m��?J��_G���|2�,)a:X��2lюq��%���Hȩ��SyzF�}lfC:�6��SU��$� ���9�.P�U��7ODd-)�_�b�����C+*`YL���t�%��3���M�"Y����7߹S�aD T(�Ur\�EU1Ԟ�b"XzVEnWM�?�~����c% ���o���є���3����g*3���Y��k�>�M_�>fI&�;�+��������?�څ]��F*�`ʋ��4h�����mro�\�䷤A>�������-4��?���Ui��v+���z�p�Bʝ�@(��i��2�C2���������o7��3���Gn��t&)�������6%�4uEd�k��^�dZl%��e OZ ��p�����^�qq� ZP�?:�GJ���Q���Z���J��>D���F���I��\�� L��:LK`$fynk�R萲 �"lj�ӂ5JΎ��d�VR=J�����$���^;���T�0�?bׯQ/�Q��(�}��r�i1���q/:�Z��@�dF>��ܗ>@��Mnc�= �s�N܀5�"�����rT��A��L}�X{���}��CMJ)eG�Ӹ����36)��7xjr� G"�2:�`��hDE��,ID�/�ka��ǩ�+Ei+�s�dU�,��3��s$,�GD?���� ii6��$��y�XQ�+��"��q�^)�N�bn ��ߋ���_��P5���x�V�Vg�C��b������`�^V!]�X������t�l7,r�VZq�9���e?�i:�l���o�9ɞ��Fk�Q��o����V����?�kA��H>�x���8˄�A-A����3�j�� ���nA�鯪V������Ԓ-�ǜ'�����2P�ڪ��)�B̐S~���/�ir�@!<lxF]��%����t�+\���]�d�)���3RH�ח��'�CMK2�p���,-���VYg�[,����w�>�a�X�RѨ����h���/��b� (@��@�� &�9�Y��6�Y�x�����B�+p���I�����u2ę�� ���n�̯�t�.WN=��K>2���Zu���ڵ8R@��W?�;<\�yVX�������⽰�ߐg�#��@���V�@� E�z�x��%�?Х��[%e��jF{P�Z�p�@[�&����B����]�C�Wp��X�[<�#�or�p��Z� @���C�}a���l�����:��z��C��g��x5�o�ت��@��)!MS+�5\���a��w����O~Z��J��2�z�� ������ch�1�U5����y[�o�<X��7P�����X&�BV��NC�͡��ϸ0�-%`{[��`����#�W�N�햓�E�o�]#ZGz�G���{� G�TZ��4���7��;|���|d݂5��f�<)s������y�� :��bT���'�K$;)[|ē���˖�XY,{�YEST�Z�p�z�T�q{P5�M7ƿ���F��!��� �?Uy;��Z�l9a���_Vxf�v)xj�L�u���tb8�;���1T��#T+UO9�;FhP�^Js1�}�7/z��NxL��7��4�WS�2.�{'/�����謞�OC��Ȉ�!��|����{?��U�D����:��wkHF���W��P^���O�>�U��*�Sӿ�|;�7%�����Hd���9��eG�tG���֮�T獵�.�DE�_8�,S�A<�9�XyL��--�jmG��D�����#�'-Q�u���U�u�Q9���{��&#�Ͻ2�t�9@���<ݒ�����l�5m�o4�b+qQ#{��\�A���}5o�W�n�I�I����0��?�&Lc��·gH����/�0 �+s����[�im�a��_��ͩ����Յڠa�Y�g�Xt�5mTa��~9��Z���T�ȱ��2ż&�ӊP+�p��&���V��$���}�*��;�����9�T��X��9*�9{�̤��q@����+��'�FQ�6O�bo3��n\�|0�r�(��,�vr��Λ�c3 {WO��е�X��i�$�d����J%ބ�a (�ml�# d)��.�R�N����?�r�U�����&�n�%��.�p�� �> 2*���ř�OV�/���R1���J�jSn�m^S�?gޛY��fM H��'�V�o��l�\�����������d�<�ީ�����k�h ��FD@d�����W�*L���V��ӟpi��M�e�ɉ��-�B���I� �9�E��%V��:C���|���.v�b�=�6�6���7-�d�yȌ��@V���h� ^�s�A|�����z]�_���QlW*�2��Ţ� _ŃH��z�������0��}�/���i�=0������5#\Y��uGL���Bv�PO��̙�m�(;��֗�bB<��(.EFr�{Y;�-�R����ZD�� �d��"���DKxc��!���H�� �aI����ڜ���o<rl�֭�˧�&�{���� �z�J�iB"��F�%��V���`�m,����Y��-;j~������FP7zd��E>)R]��Ѡ#=��*E4�����#�4p�ŵ{������� 9C��b��ο����a��K5LBċ��A��=0��uXw.{yRw���@ �1���7e�l&������LܺK�C������� ����,�~J8�3�a�%����fO��}{�q��A�@)֕A����e��d�Zib4��?y�M��q��SW���������E~��+Rh��XM�nm|L����|D �<wA�/�AL���Tui��}������y��0=����t�C�o7�E����M�#�}� =���x��AVp*Oޞ��D{B酧�R���^��.��&�'�{�Y ���m����^ �H�Y�2�?����u,��5ʹYP���)��M��`8�"�ý����6��:�g��urB�R {:�!YMw�Q�@��y��j$l�t���MZ�C�me���̣\v�̓��rF�m�`V�sE�4
Static task
static1
Behavioral task
behavioral1
Sample
b4f34d34994dbc5138feb5ed1f9ee296097bced5a90d3e6c8399caca168c2411.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
b4f34d34994dbc5138feb5ed1f9ee296097bced5a90d3e6c8399caca168c2411.exe
Resource
win10v2004-20240611-en
General
-
Target
b4f34d34994dbc5138feb5ed1f9ee296097bced5a90d3e6c8399caca168c2411
-
Size
9.3MB
-
MD5
b2d2fdfd505ce13c6578223d91d020df
-
SHA1
fe3133b151895a1416ba94b769ded6b38c58c21b
-
SHA256
b4f34d34994dbc5138feb5ed1f9ee296097bced5a90d3e6c8399caca168c2411
-
SHA512
286135766b0d555c14c4632f32b158272f3394964c880fa76e255c5952c9090416f096fa9c14302c2d51155abd8ff8ab321fa647a60754b9fbed5f39007bc433
-
SSDEEP
196608:R49kBg6K75bf+9wxqXE8QX5v7CHK3Cc6:RokBtK1T+91rQJ+HKSp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b4f34d34994dbc5138feb5ed1f9ee296097bced5a90d3e6c8399caca168c2411
Files
-
b4f34d34994dbc5138feb5ed1f9ee296097bced5a90d3e6c8399caca168c2411.exe windows:5 windows x86 arch:x86
8ba2f66d8f1393bd69dbc52ee2164063
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
midiStreamOut
ws2_32
recvfrom
rasapi32
RasHangUpA
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetMenu
CharUpperBuffW
gdi32
LineTo
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
OleRun
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Add
wininet
InternetCloseHandle
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 896KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 447KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.OnJ Size: - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tGd Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.t%o Size: 9.1MB - Virtual size: 9.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 268KB - Virtual size: 267KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ