Z�Ўv3hD�8L"�w�G+r�-&tчy�bя�k��'��!U7T4�8����"�}��ԥ���]��?�<$���A��hZ�>Q`=+({��)h�@��yR�Y����c;c��g/�*���8�c�r,u���7Ο �.�י"��vi4�n�8N�a^��8ݰ�7�:^�^���#a���? ���^����0��<��X�����w@*�c)C t!�x��'á�T�B� �L���1w(��jk�������h[�]A�&�a�[�a��������V~/���&�F�<�8eB����;���N=J�7]{��W���v1;ɻ��ˎ�=ݍ������Q��R��~�=Q�#@���9��(�U�����G�d���������/���?8�Ė0y�fQn���I17Ǐ���y�}�?��%�Xo�ڞ6�y)H����+e�5�9B���Ks��U��\��Ւ-���I���|�E���!]"½vV�MUO���uo!�P��)��L=s�^>� �%8A�V��F��@'���F� r:N�w���R* ?=[��8I%a��?�D-��~N�]�,��]I6@�7vkdҠ�u�2>��Ao�(}�[�j�h����%�C ��dꩯ�d�U,<5\W���,t�I]u��<���|?Ăxo��X�� D�n7��%��UiO.+Ff}+f��>ye0_z/.9&XL,P���,��Ŭ`�����k����r]�gT5��0��Iz�K��L��r��~g���^������*_�F2�qk6����I$�E���K�j�d��ɔBL�'HYq �&,���fN���ֿ���Ȟ���0�ѫ���U|�TN���G��*���V��I�ZѝN5���ٸFE�~�������·���:�+5{~�T�����P�V�!ƚ.������r u���/��/g(��z��)Q0� ��m �'��$Q&ЊS�h�BM�g�V�^�`��C}�G �8��Y�}TAj]���fw<-�ݐZ����5�֘�v�u:?��.���Y<���UH}[�����#�$<f�cgi�b8,�=���N�pܲ�;�[! ȅ}��M|���. K����Լ�YU��s�h;u� �ub�B��y��a1���y}�$eP������I3Na`L��n�(iޣ�/1.Ů ���Y���j��ؚ���������|��9�l����6�� xw�k2��4�&Ef�.��?qQ���y���e|Þ2,�#m�����x�;+u�MU��F�0(�$dl�����M�����o\m��9�a�OcR�&��+�:�v�ח��SFB�Ak���x9K���&F<m%N���\�tDŽ7^���_�y6* ��&D˧��n�6)yz��;z֯x�Oj����b�|X0�59�P�[je=��1��-!�w��Ua�/^��j�Q�F�#ӗ^�b����$�X6)9��@3�����RV�F�����e�E�,�Z��Nїğ�� ��m#Լ�,�� �x���Ǻf*�ElC��?��+��w �4G�0Z�n&��N4���. ����ʳj���sX�9�W�ODK��r_�{ �.\�bv^�������fܨ��y��{�\J�ͻ�/�Jۨ��b��e`Wg�C��%|;[ ��cz��5/���XQ�m ��:�w%]=⾢��*�tk�Fr~�/s#l�-� Zx7��WM����m�����~ot�qd���;�uS�;o��4��bz��\\&e�bfUd}�XpRxvekw{4LM���! �>a�Y��z�R���Y��!��.�㲐TM���K )o_ժ#��c���+�b#1�?L:�D�>R��g�f�ޘ�"��g����}�r��<G۴p�P���<��=��WX�����TqS!��Z<Qɷ3Pݓ{��h^�%�} ;H�}���6VI�R���4�~�?g�9Xu�_3���������yw[�����D-�~-#p ��C��b�C�/WZ�x��q���,Z�NJU��#"_*�oJ�����G`c�!w-Z:��!�`Tyj��1t����F15z�5��b�8}D�W ���r|���{�x����[��������@�&Y�Jf���܊im�����Er5Ϗ����e���,ĸ��u�x�o=�vH�W���Ȼn:I�h�k�������q�I���Y�p�1o�:�(!�|>�t���E���4��@-Ԍ�2h&wZ�d���i�{�C���ǯ��:�m��IQ)�T�C3T��% �p"[����5�A�q�?�k��Jet���%��җ·x�bb���ƈɢrY�����_����?P��'*h�S�Y�t�ڲC�����i�fd��w�J;B�N�.���9�8n��5l2P��#v�2��?̓�� !8�����4�d�2�R�� "W�\��'!�6�;�;���%F"z�TR�CG�Yay���s�^�C���v䬏����k��iJ�ń����*fg�Gu�b"#;�k�[[[��db�@YYq#����4�d���M,m�~PjT�84Dh*���Z���qf�@��67x��G=˜z7{�;%��� ��ɒ-u3J�����瀮MҘ�6V��� �#��_-+���Z-���.�S��,����d3���*��n��k���d���8q�O��Í�����O�m^�1�[�H烊P���\I0!� �:&�NR;�ġ@O�!`�n�#��}~y�̸㶝tB���#R)!���B�)H���F��H�Mw�t�өm��[O5noܥ�����sT�䨴'�L�)"R&�S���'!�C��fz奈�nw��dT��g5\m�E[�{���"k�1����D��C������lcsV0j!V�e/F���U���9�hN�H�4�����Ɔơ!�"�-��!ӗч$���i����3����վ<���O��)�.Jw�RL<��8}��JN�B���\کCxN,H�e��p�r�����θk���%G�����z�����B��y1�6�2�#����v��0}5T�C��'��<r�H=W�#d�of�s�����'��fkۀF�N�zSK$I�
Static task
static1
Behavioral task
behavioral1
Sample
03ab161b5eec1bfe92799547047ad8ec3372bb3222c2b77a0069a78df080360c.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
03ab161b5eec1bfe92799547047ad8ec3372bb3222c2b77a0069a78df080360c.exe
Resource
win10v2004-20240508-en
General
-
Target
03ab161b5eec1bfe92799547047ad8ec3372bb3222c2b77a0069a78df080360c
-
Size
8.3MB
-
MD5
4c35e727c9a1de38c42dbe4fd97078fe
-
SHA1
d0fa0aa80324d809f6629bf2c6d255f2c6a62687
-
SHA256
03ab161b5eec1bfe92799547047ad8ec3372bb3222c2b77a0069a78df080360c
-
SHA512
fd87abbe9a7d7daacfc39b5f4b694a1c23d0beb15c362c70f8ecb214128bcb67b313ea64b167fa4b1c863c6174f48e554452d548ae073e74cc89569f1789cf99
-
SSDEEP
196608:2Jbl16YF5hxH5SFRKqq1LNgRg5bB1LITJxEXOLEfBeJGemOddMWbTpwhawu:2Jbl16W5XINmgRg76nEeLHm5WXpdz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03ab161b5eec1bfe92799547047ad8ec3372bb3222c2b77a0069a78df080360c
Files
-
03ab161b5eec1bfe92799547047ad8ec3372bb3222c2b77a0069a78df080360c.exe windows:5 windows x86 arch:x86
929be1d5c60075c2f1da783df9c8bc5c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
SetCursor
GetCursorPos
CharUpperBuffW
kernel32
GetVersion
GetVersionExA
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
gdi32
SetMapMode
GetViewportExtEx
ws2_32
setsockopt
WSACleanup
atl
ord42
advapi32
RegOpenKeyA
RegCloseKey
ole32
OleInitialize
oleaut32
VariantChangeType
VarDateFromStr
winspool.drv
OpenPrinterA
OpenPrinterA
comctl32
ord17
ImageList_Create
oledlg
ord8
winmm
midiStreamOut
shell32
Shell_NotifyIconA
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 599KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.0dF Size: - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.brj Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.NH[ Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ