�Qh\iE���eR6� i�H�O���"�>+ϳ�2�4RSsk1Fϙƻ�S5�`��b��:TR�����'��������(�g3������Sp��9?��}Yb�sm1�g���� �� �d2ԙ�p����J�L�Y�p�����BtmB�%���xX稜�N�ڳ HA�v�'�������]���J�`J_Y�U���\A�+:G�!2܋[��bȲ�l���� �V&N7���vϝhuK��*5�'>�Cm(�i7Q�sB���[`�`�U`����d�[�wTy�V��|LM}$�PK=�/|3�-{~â�`K {6������H@K��|�yFas�L+/�o/;���EWn'�XOӨ�w�}-�4K������x����j�����!w�॑����NZ��7Ʌ�$���m v�0���|�2(M�r�3w�ӁV5�������-[9�2`곃߂�ߟ�<ip8"9$B'���}������K���{b4��p8g���(�sf�5|����hEX) �ݮ ��r��/W��K�Q���3�Au�T(�O�����X���?�2�'���H(r�_]埿3��$=E��_F ��')��{��KGhf.7�L��7/x���m2��3e�;��?qH��C�I�{� M�M�߱}IB�d�9 +��&�i�Q�~F��L�%�݁,��_��'6�����q(����&>:��w��y�Q��.s��<q�8���֗(q�/?Z�]�&�zG�O�|a+� ���0�N:&��^u�n?������ �&�"X�Gz(�A���V� ����P���w�-I;xA{w��;#4��^�r���k�:G)2��C���*ص�\8=�#����P���&^,E���m�>��ߥ��8�KD���^�U�v��bb Q9�a]F��lQ���H�ӷ��>�B�d>+�T����Ȥ�P�M�PO��E�S�u�ء�S �'�i�z��A��b���r�d^���/�ɢ�./���_{�Ih>s���F�j1I��|?�`�����'͓Mz��v8�9� =1���?���12�-�z_�p�Ɇ���.��@�W����ՕѬ��䕊�X�\z����JQ)��U�}��5՟�mQ^:�����OP�k2��g�al[�j� ��\��'T o���X�������X���K�c�����ڭ��*j�9��Ⱑ�?'���y�/�U�q�2����Z���Ԥv��F}��"��=Q�~r�����]ݖC���mM���WN+��p����"��`��j�[��0��<�(ˀ�٩�g��&����v@���C4QB��%bQ>Y���C����K�Wi����Wi#?�ը/��wW�7�d�j5��A[%��� ��a�#���ác+GSZb�P��^�a�7)�Y)%�����"�LM�i_��O���N��MC������|G{����MN0�����],^+(���ǁ�Ik�y�}hL�X�@���c�Yҟ��#�� �y���Ϣ�-�����^�u���M���+*P��i���2�y�Ԓ6�(��[�+�摉V�6Ty���w�T�#�1� �` ��~�I�����wR��̹tm����":�,ҧ(C�a]f��W�f��G �0����K,0�������[7��������`I,U���<o Ǡ�� ��O�(��f���)�|�e���A�O[�=�ð%���~��q���]D���7h^�}�o��S��z2�%pT �� ψ�E�th�y����~"�3����x.,�b�c�N�%vV��6��%�����g��c"��<��;�F8#�Rkڅ��E�����=��&7-���\4�2��@C��J�)=jJ��FFT�kIDL����χ���<�Ә�F��I�澳YDeIku��d�I/t���#���|��XO���� 䈝a�x���┉�1[4��(SQ�����H5���)r� U�6tB��V{g^ߺ\pK1��[���Z��A+ ytSu��</3_�#�~�(�0ˤ��g2���(Ƃa&j�qc*�~���Ȅ���0���6_�!�*�FU��d!�A _�K��|�ڨ�7e0���(���gSׇ���}˪��}Opp�p7�3*����E%2����K �9�-��)hK!��ϕ��=tͨ�D`s61������v.�ִ�)^�]��]VJѫѻ��7|�z{&�VB "�=T �������A��!��7��Yt���K�@�\oz��f9����������7ap����oK����9�J�%� U���o2Q�5-MkN`o��e͝�̤�sLw��3�� ���S�����d[7�Y�'�q�Q���-m)�a�W�(��ݘ7.�e�iv<��_N��@H=��+������I� &��<4>F�h.��acD �$2��Z1h܁Z0�'��a�ެ�k����lK��2J_vl|3����ٓ����O�6%�����k`���m}���zWl�mpT[�E-��O<�L�p���~�x� -��w��=�`�wm��+ݠ$-��S�dWn�AF�=g���Ў����r�?V+�"`oW��9Wzʕ4��9 �P�Ek�J��T����bbU����Q@o������l�:�OܐI3x���M:PnN��7������5�+í�I�kgpEY�Q��wE9=~��L2����Ψ�AQ,N2����~�Ӟ ����u�]E`{=+���et`D��Y����ϯ�����wk� w��X*�Ѹ�I`�����L����� ��ٹ�I���Qz��^� �{��f�ӻ\x^BD%i�9�o��>���U�ό���9w� p����*h���Fi����Ry�뚹��7(�����<AX�¡:$��?a9X��G?a�+9]�����ܝvdu�̣��z���n�R^w����E'�-eBh���9z��� �^B���@�a�� ��~Ā�X;rt��ٮ2j�}P��|W��O=w�����?ve9_��%�r��?�f�J#�� �1 �W�_�FJ��G"�/�暿nUK�����OR���q P�ڭ��Ew�&�{/��/�eᨛ=0Ԙ�յ0��x�۾�O��l҂E^�cFd
Static task
static1
Behavioral task
behavioral1
Sample
f8b4b371367613797bad3b16a4356cd3f7e1201497f526d2807060735b945160.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
f8b4b371367613797bad3b16a4356cd3f7e1201497f526d2807060735b945160.exe
Resource
win10v2004-20240709-en
General
-
Target
f8b4b371367613797bad3b16a4356cd3f7e1201497f526d2807060735b945160.exe
-
Size
2.0MB
-
MD5
bb481c2847a57988f83bf2daeffb2d6a
-
SHA1
3bb586af2c08c406d0b9bbdffeed5e0447c2ee48
-
SHA256
f8b4b371367613797bad3b16a4356cd3f7e1201497f526d2807060735b945160
-
SHA512
6399486780c68846c13d594f9cfd1f43a36acc773575b4026e1ef21e9970adc262b1cc98c4b7f572a4270c3e01791a1042113cfb8f0dc8677a4af02d3c019e5c
-
SSDEEP
49152:huHcd08tKRM6Zl490B8MjDoZb7Mdh2rL480yDXC5D:ld0gKO0PDQAT604XC5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f8b4b371367613797bad3b16a4356cd3f7e1201497f526d2807060735b945160.exe
Files
-
f8b4b371367613797bad3b16a4356cd3f7e1201497f526d2807060735b945160.exe.exe windows:4 windows x86 arch:x86
1d67aa952d573a62fdbb812880b65d79
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaAryDestruct
kernel32
SetThreadPriority
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutGetPosition
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 954KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE