w��x���;,��5��L����b�U*��C>�Xx���G�"� 9q%�0�t���f�[�\k���/]��_��,����X O���B��0�;G�����M�=�;�,�k�=�9��r�ٞ}���h&^�������?��z�0Svu!��C�U��@�?X[Ɖ��6�vn���m�+���. 1���Dќ8��0�qH*�ڙk�u�W�n��&@J%��̎^O���-h�N��E�)�=8�if]W�� ���K�8t@N��l�Ǫ������L�t�O�����E�T0��su���t�սdI*�K7{����� V�:] )� K��=u_�#�J���E���d����*�AB�=cKmȅ\�%�d�d��'`Kא���t#���+�#���_�&�������^�2�ɷ�Fw£.���f�p�N3P?��[8�|�/n�%X�iq�پ��?ˊE��šVA �9��t���Y�r�&��/�U>�y��f��Ǽ��q��@��N.���VH�g-�J��-Ģ������ZF�'�qB�hn���D�T�c�7�u�A�a�D#;8�ϑj^�Z��惥�F�|Ϗ%�QD�tǯ���y���~���3U�@�y�%IÛ��;�Lt>4�D�]�Ӏ悢�����O��&�}nt�������������VK��E*9�?'�"�K,=����,L���S%�M-���v)�n���G+�l�|��Yd���$̩����.6����!k9���V���.m��F�>5J���Z��%w8�˜kc���ٵߦ8w�m'��Wj��n3�IS$e_d~�8"ʩ9��{k�MOu "��Lj_���X��2��ɗk���t���vF*�ᰰN���uWs�dؒ'��� K�z���x[ ȕb�Yʔ�l�#���c�\QД����&Z~ }�#�,tDߏ%��9)}�%&\��^6�qOX:�S�s�eS�V����?I�����F���!�Y<J���K��j����TB��Gȱ���J�o�u �#%����Y�9}��Ja�Z�ً��Pj��-�kK� @�b;��Y�߰f���]F��9�xP��x��Sh*�u 2�d�o�����k�m�ei��ͳF �8�{�P��g��3q�a�tЊ`!�Z�q��g�{�/zFU���U��������l�;>C�-p��c�r�˨i}g�U�_���07���B���b激: ��y!_��>�R����u��o����ul����2e�ѿs���}8D�i�E6O�Q��n ���}A��˕�d��\IG{,�����'@���2���E�'��Z���=�@ű����,W��?���Vɼ�6E�.�)�<9��g�KH�6;�Py�~5��I<�M�X�E�E��g|I�?7�zF9�GgI��a��0Ƞ�5=e��|������[53'����A�/����x�71 �!����@���l�GćfDgڸ,��7R��_�"�A�VP�W��k�9�v������i����~� ��� ���x#�Ƴ�F��lae�@8M�rT�Cd����`�噥�ty��?{�M��R3B������F��$}<n�K-�xˤ*$�{.��76����f��)���X��= h�ŀq�.��L��81�9�e�?��O�4a�H�X�Mj�{����V�j�*lUڝN��XCDN �\`ҵ�����,G#[���}v�1?�4uCYQK��V��|��z��������ST �˭{m�ܤ�ae�\{m��I��$������몯������ľ_����@NG��J7Ï���ex�/$n����\MZ������Q´�Gw\��e� jG�#�m�r����d�,���(e��s����r�:^R�l7���K����K��;BE?<�y��9~]y� ;�V�5���[��Me�y�$�Ӽ^���B'ӮlF� Zo����_ ��KǓ,g��Ѫ�C��a噸8��Agf4��,�y���`f�`�"&G��23�%�J?|T��ׯ�[�y3K���(��2S���a ����g�BٯV�"$}7F\w��E��O%�Q�2�`��U���v�jTǣ�by��U!��h���a�C����P�io�:����C@�>��.���-3��`�1&ğp\_J4���f��ʘN?I�����o�����s�k�]5�L�O���9��t�\c���T�m��j|��P�q�{��-������kǛI��MN4�c����Է\)�A�3��&{(E��9K�Z\�ı'��U� ݰ�x���c���?#��7 C�!9����4^�|;Mۉ��T�e�S�̞��4r+��Χ�e�!q�NqIT�U����C�}##�+�������J����l 6#"$�S������-�����]\�Ʌ�5��F��{����^����������YU&#G����,�I��w*Т;��?�QV���7٠h³"eބ�����ş;"��I��:���d3�4oy)d����[Q���*�i/�����u��yc�Q�1wbwQ1��O��qߩd=��;��,�$(Z海�j"rH*C��' a�xT.WHN#�/8Ke\B�T��y�˻�EUE �iJ}���ؠ�8~n��8��1lF��,c0@e��$��#�ϡ��o;�ȭ��b=�y�.6b���Q��-[cNOE,@ �q�n�:�ћ��Ml��%��I���WL]+����w�H,������"<�����f��R��]$������>�2�f�x ?�GU�)@C��B�s�U�2��Le��Ʌ%~�F�������<�Pp{���')�������3m�����i��R�e�����2P�-K�/<����%����3�-�v.�i��H�GYE6�.'�p�) x�������:ϭ6o��ԇ�a7ת�-��nُ֨�cd�đn^�0e�AW�O^��}����|Ӏd��^���<���+)���3-�����-Xȍs�g���>�U9R�/l�-��H�U5�4$\�Փy�B�22ߊ XPf�3� c��6^��4��~(�sA�
Static task
static1
Behavioral task
behavioral1
Sample
df96e642c212278aa083b63e430b55f54bb789f39c85533161ba28cca52ade4d.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
df96e642c212278aa083b63e430b55f54bb789f39c85533161ba28cca52ade4d.exe
Resource
win10v2004-20240508-en
General
-
Target
df96e642c212278aa083b63e430b55f54bb789f39c85533161ba28cca52ade4d
-
Size
9.3MB
-
MD5
7b18631514bc4e2921c6ba75c27552f1
-
SHA1
589bf4d1e33e1e593156969b78813869cd89509b
-
SHA256
df96e642c212278aa083b63e430b55f54bb789f39c85533161ba28cca52ade4d
-
SHA512
7bde7d214dbf95a3bd4760aa2bdd4436af971d83ba7a45e86f5a092d3ea68904a0c605e1eb5925ed18e3686bfff532916b838cfef8e18d36b00f2ba6ee1c5f42
-
SSDEEP
196608:OHUNU3TlI6Mnh+nE7azCZaqSJJ8lPs2Im+y4R36Iydc1IAxHbG6rjYfLN0:6UNU3+6Mh+nEiCZaq9I6IzeANC6PYDW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df96e642c212278aa083b63e430b55f54bb789f39c85533161ba28cca52ade4d
Files
-
df96e642c212278aa083b63e430b55f54bb789f39c85533161ba28cca52ade4d.exe windows:5 windows x86 arch:x86
24f97f460f3445b0c60bbe8272da7200
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
midiOutUnprepareHeader
ws2_32
socket
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
ReleaseMutex
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsWindow
gdi32
CreateSolidBrush
winspool.drv
OpenPrinterA
comdlg32
ChooseColorA
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
CoRegisterMessageFilter
oleaut32
SafeArrayPutElement
comctl32
ImageList_Duplicate
oledlg
ord8
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 669KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SE0 Size: - Virtual size: 958KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SE1 Size: 4.6MB - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 84KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ