J����$��.��և�1���=�~g�G[�>��v���λ@e��'�������Sf����������|�s��H(8�&k P&��`:��x»o�8�( �;�.��\�<�LFk����~f�U�$��8��I�����&\>�y����XldAjE�S�IW=�3�������ֱMڴo�V��ϳR8$�9u^Ëw�@�Fs��u�fG=T���#~�.���\�a�}�~Q��Eq��n��]_��٬��((Λ�˳�H����K��2-�\���!��<hﱶ�ٝ��|��yh<���%�S<٫ڞ� ��P:T��ﱯJ��[���D���£ w���2��] sԅ��^�"[x��vcv�߅�C����3ʥuR�V� \UAJT�O�{6��4��8���ski�$�m��vjh�k���D�C\���+�{H��_�`U_Z�,x����gh�pz�?Ѳ�)ԥ#a,鍶�v]V�_��Y�T�X+<s6�����S.)��#��i0?��Mc�E"� �����j�0�>{) �#@ȧ ���Ne���u#�=��yD��ӿμA�D�=�q���I�U��brE-������I�����Z~b�2�*�ך��ZZ9��Y-�B�~�¿�`��4�'&���_*�n��m�"~�%a��S5G�u��ah�ofw���� �86��w�֩y�G��}؞��s6���`#�Ƈ�S����EGC�__0��u��K��-�F �Ffs�Ng&Ǜȍ<�J@f�:�U̼��;5��8|>'����b�L_ǚ��u�J[� ��!�Fl�/��P���z-dJ?[�Ua�X��]�%�;�0��ڎ���,���̍F��ۜ�!�u쀈�!�<�7x�"U�x�+�����A�oߤ_(���� |t����,���Ă�O�C''w�m��9�H�>�V{�Du����3M��~�ȼ�oi�a�����)�O��7Y礞 �z��o���zCu����wjp�������� Q0�k�U�T�B�-1�<���?�$�M��9��\�w�ۨ2U7E����m��X���>L�|��Fod���ϕ�ٓ!ٷ���������m]L����~�-@k߁B�5r{j��z��C-�����:�1��7bu��[��ѡ!�;�9���ؓ{�3f��A��P$V}���|����AY��e��e�W�MBz��3S�$�-�Q����E��TY|�m��_��-�!|K+� S�V�B*��8�QuX;�ۦ�ꢽkbŬ�����tȹ|����<Tֶ�c&��,&���;�{�������g�����M,�j<�vW�Vɾ'�f�}��|9���Z������,>\!Q��U�@�9�u�<uF���+�^�N��^q�٦NBc(��LT���z�m���;���U�e_��GJ2����i�${�ts}� ����D9K^<��貹��!����l*��V� ��N��m2^��-j> ���tq0�� �o� D�{�����h�� �r�5���Y��al�+��ħ��8H��N���aa�T��� E�iS��<�F�WwH���\�+-�Pc���Zl) ��_L'#���x���AS�Z�3�^R��� <j�Z���rGʹ�D�f���粉s��xp�;���$I�W�q��,�~���;�u^�x�����8�����w���;�h��H~ *��կޣ�$چf�b�a���}ll��%����L���<�uU0y���t�sA��=]��HG�W&j���<n�saIQ-OR�~Fa& �">BP�`m��*��c;'� z��L0 �t��G���Q�d�Mqс �~���hN���,Bٵ綵�c25�zYbe�=���۔�v�pxռ~�!����:3H�Bڒ=I�D�n���^���r����� w��x�,Z),��P��z�O!�:n��6`�{�#��ωH����|��g��V��?��đ�b��~:z���)�F��/Ш����:�a�7���U��M}-��z�\�&H�:�H� 㣼U\��"�zf��'���`}[���B=(�:VZ�����p�$�V��wIR�9��Ӛ-SQ�j��(i�NQ������8����f6�ϵ<���6���-�s~��R��t��&���Eb��ʸ�=��O�ل*a����lο�SU�(�NBI�;Kݮz�-�S�3���s����D�-��$�t W���9�Ivv&��j�o�t��;]ŗ�,�I*�����}6��/����5U�z ۱�dk����>���C��Ft���#s��i�j��.Q����)�h��rtT���|���#������!-��W���u��*�`|��m�������r>��3|6�2�jnG�S�@��Tѕ��r���(�Zseـ��Ӑ)���.e|ձ��T&�TJ ��*�5�D�: ��-� =������ұ�����p�s�����1���%�?�`�v�jE��y�Bj��j;+�*i)��/w�|c!S7�L�!ޕ��� 1�C6�Wj&S�����`X�8�����E%ι�ճ$�[BX�_��F/�����FLs�}��݂K{�H�k����D?U�Q�^�`��``��!��D��B\�47���!ߢ��';^X����l�#v����ѫŋ*FD;Mr���>�F�`�����LK9���:ʥ���HlV�Љ����oc���لZe�z�-�w!��b8�y�r�ylr����h�5�ܛo�3T@&y�b����vl��$�} m��f����*>\\�34���\��8{�V�w�g�v�0�OPF,Gq�\�WJ���� �ucэ���:��/f/��FZ0S��H��jh��r&��v��~-�Z��<W�_�-�I���?㜃���t�g=���uu������ޫM{{Ċ���Yv�y�NU���/�e�(������a��i���[b�����~Њ�l��υ��gJ.-�J'����Td��+3q��X�!��?�zv�D0h=;2������I��-T�,bsm��g�mFϴ�8n��/�=b��oWK#v^�
Static task
static1
Behavioral task
behavioral1
Sample
6b3bd9fe483f4f5fcde16b31b01538a8dd36ec2cde249eb3e0ca79f9943fc3f4.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6b3bd9fe483f4f5fcde16b31b01538a8dd36ec2cde249eb3e0ca79f9943fc3f4.exe
Resource
win10v2004-20240709-en
General
-
Target
6b3bd9fe483f4f5fcde16b31b01538a8dd36ec2cde249eb3e0ca79f9943fc3f4
-
Size
10.1MB
-
MD5
78ac18f8db020e9638523589da0e5b17
-
SHA1
5822c311b034a3d043bde10e7dfbe832ee162dd8
-
SHA256
6b3bd9fe483f4f5fcde16b31b01538a8dd36ec2cde249eb3e0ca79f9943fc3f4
-
SHA512
ea8a896999833a9999f16d9e3089a697454d7422430c025f0acc64156cba3dfd94103785db7b10b43f0b09a5823311ac2af526739eb6d4acc52d067bfef0a6a7
-
SSDEEP
196608:rR06iuvEj+S6GdsZ48esKwjD6W+JIVRH/dwF9lk5zFsdDKbz0s:d01EjQsfRjWW4KG8xs4n0s
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6b3bd9fe483f4f5fcde16b31b01538a8dd36ec2cde249eb3e0ca79f9943fc3f4
Files
-
6b3bd9fe483f4f5fcde16b31b01538a8dd36ec2cde249eb3e0ca79f9943fc3f4.exe windows:5 windows x86 arch:x86
90e3194daedaccc10f7fdec100bdab13
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
rasapi32
RasGetConnectStatusA
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetDesktopWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
TranslateCharsetInfo
winmm
waveOutGetNumDevs
winspool.drv
DocumentPropertiesA
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
shell32
DragQueryFileA
ole32
OleRun
oleaut32
UnRegisterTypeLi
comctl32
_TrackMouseEvent
ws2_32
socket
wininet
InternetCanonicalizeUrlA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 460KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 10.1MB - Virtual size: 10.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ