ex���1�\̧��j��$v:wN���V��%`�<���X���?�i.�䞱��*^��e�8{�ӀG��aX1��i��Ќ��8~P48���3��UX��Vv`ڟW���Β_�:,4�y��K�!ӓt�\N'P�� ѣ�y<�Z,$#���)^K����߇�S�-��@W� t�F�p}�r�2�4�+����x���NP �wW'��{)\������u�|���&�Ÿ���ܓ��3�|`�#�&�����KS �o�����?5��4R1M�Yz�4_��Ӆ��i�qga��-���L�,���� �}�@_nC�&��y����Oo� M�b(�ᄄ�c0��a%(��+�!F����o�K���H�]}���0?�x�>��T�`m�]Ӣo��_�����fA��Lj���q��v�l��$�\�b���^PRx����l���>���M(�������$� tnh����t��4<K����6�qo_?-]��{�/�9�x�q��3��0�7��,N��(7�m��e/b���״Bn�Sv�-�[��s���+�9�N�)�� �Yě�w�7��q&/�#�D�㖒4 ��1;���˛���A�B�IzH����Ɵ7U|g� }{T���z���u����J妡�0�`�� �!�俭�$�d�m*]=X��WU$9�0GM =� ���A��l?46�jUւ��4�}6tտE�Y!{���"��A-��:� �o����4��$:�#U�LF�`���5����X��v����|���/�&��kA��o-���m�Ft{�UQ4��)�.�;���$��Q�?c�M\�e6���+�ɯЀ�/\e����=WU�%b��w�2;��?��{�[��,�>9�Q����IV|B"���l��[{�0BW6�>}�xT�5z�d�ڼ�Kګ&�y�b��E��w�;���!I��_�lIQYK������8�UZm��k:S�*�jK�p1�v��7�BÑW��0ݓ��OS1��� ���"aZ��T-�8�ˊ��~��㸛��8��6F�.Қ�bj�}�)���� �Va۲���cɍ#��1tE�i��a��%h�=��#�LߞeSJO���ivH��S'|x���@b%[CCP|=6!�z�̿64 ɦ��Sm�J.÷��:���� ����w�t�����{E�M����k�}^O���W"���6�Mu.���i��l�z�H:�o`䍹�4�=�,���"!Sv��c��8<�J�?���ac�ě�CHfvnՒ�Wǧq4�i��bI�j! 4s���l`�^89��A��Ku�"L�*�vg��gPf.+����lf��)24�����R%]��0E�����'R��N��<������ڙ��7�wX�A�H�^����%�.��K-�����ٵv�Ȯ|ڌ���(�نsu7���P��� ~��V��Qڗ��YtJU)!�)�26t�_al��z��JB���깇4U\{�;1tc(�o���2k_�0φ�[v�����K��s�����+��Ӑ�ṙ�Q���$��^�hE�+��([�[�3'.�:��`;�r�B�%�(A'�z�H\/�/�D���iWoM����5�l{_Xפ%{ά���� �}��B�@�=��������}���Ɋ 6�J�ש��xN��=!z�e�И��@AWm��B�i,������0l�����!Ɇ�����Χ���%a��c���֢�lp�1�V>�k�Z����.Q_nA~���*N�nL�&f�����B�@��L��$�H����Bj/ .�M�F��Z˯���MJi�=�Y��?�w��y�n��J�xkɠ�/ ��Y��d��nW(���ׂ�&[n����� wx���>��KL.D�x=����*14,�G�/H�\M����%�0��� )�h�TM�p�g�|Q��E|\L�.��:�8vu\�d��k�#�|��Y�V��a����4[{<���l����d���u�N\��6�>{C R�*��}#���k~��<���<�D_�S%����?{�j7h���<� ����W��h�Ϳ��@�M�^jMc5�T������hA�ʥ���X��r0r�3t�j��%>�<@��שw ]R�)��Ra4�2�x��E��j�gg��U�,��t����ʘ��tTY4~�6Z��@2a>����l�=���-/V�j����PZ��`��� =P{��^P~���q��a>ěJ���4!�EXV8 ˃��~��z�d���NV�:�dWJ�sc:��cq�@_A�զ����F�,NKZ�|��9�G��$��=l��[;�Ho�@��Zx�u�)���Xj�c�^���%$>亜QpC;ʝU���}�*b%�;$�?gդhS7��=�������𥠅[�?�G+�n�>I����$��8��B�G���57�vݝ��`����2����"D���D�� ��dpT�eh�! ��os@|>���͐�,pI7��{I�s�Ij��-.1�b��8��t��[��-�b�k�X/~������q˼��q�<f��`.����9��qa�zX�I1� P9�8�,�������k:��77�&������5r�S/��\7TC���_W/�7k�s�)i���7A�)+�D���&$�Q~�ay�u��.�{�5�QK��o�/�sEgF���Ѣ�N���b]��]N3_�:;WYÁ˔��R�9 �p�8�r����N�V������C[�ko�� ��okE^W>�"�8��M�1�|\L�j����;`��^a���<����h�7D _>u�0gf�܃��sœ����2��y��r�<o�7��]���P�&���U�����.|V�7�'�Y@��<�Q��-ThΈ���%mmQ��0��L�m����ǜ�_��w��o���a`fTHG��� _��%�_����#�V�ml`b,�t��\�m|(����I}�V>-�WtBa��L[�Ly=�'��僓��@��g�!��yի]3���[{�G���'��JH��U땶����}ټ8���Jٜ �55 ��"H�
Static task
static1
Behavioral task
behavioral1
Sample
d8d1c15b7c5ec84ef93fb6666e3bdeb9.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
d8d1c15b7c5ec84ef93fb6666e3bdeb9.exe
Resource
win10v2004-20240508-en
General
-
Target
d8d1c15b7c5ec84ef93fb6666e3bdeb9.bin
-
Size
2.9MB
-
MD5
d8d1c15b7c5ec84ef93fb6666e3bdeb9
-
SHA1
eb7fffcf40605b1451ed422b5573c03aad8842e4
-
SHA256
1d13ffbc8a8e15222eaff5ee304dbf35fd13e0e7300edac55878a02d7011533e
-
SHA512
488fdda9466da66c806daf9c34c150fa1d01d4c5872ad1c0c2d96217525ab2ae9c13559b508a9ce28309c11d3693897713974ad15aa46239daf6bbabed6d28e6
-
SSDEEP
49152:qSMJMbYUGb/CPjisR3hCtZGUpo6GbjuX7s1c4PghovW6+ij85VxhrBXqKbBWASw:mMbYDboHcZ4bj87s1Gov8ij85VFX1bBT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d8d1c15b7c5ec84ef93fb6666e3bdeb9.bin
Files
-
d8d1c15b7c5ec84ef93fb6666e3bdeb9.bin.exe windows:1 windows x86 arch:x86
a89e7aadd7b39e09806935b7db40dc6c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCurrentThreadId
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
VariantChangeTypeEx
gdi32
UnrealizeObject
ole32
IsEqualGUID
comctl32
ImageList_SetIconSize
winspool.drv
OpenPrinterA
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
CalcGEN Size: - Virtual size: 888KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
2009 Size: 8KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Cracked Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
By Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
EvO Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SND Size: - Virtual size: 320KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Team Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
******** Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
***0 Size: - Virtual size: 686KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
***1 Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 344B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ