�#B��I>�7������$�RF� �ܻ��nu><*�gvE�z;�07c#)٘^d|n���'�.�Mζ��Y�t>��= ��Tk�v,&XL�9i�[tU�dGy���<�Ԍ3���R9՚��˒;G������$Qi�?(�Éh5�8���g�oT��A��;DKȊ7���q�!��`r:MIH�s��_ ���*����������}�����AWPɅ� ��pT�w��B�:hA�����A�e6�j qp�� ��N�b6�m�j�s��jH~��7ǽ����|��B<^X�A��� ���Q�{�}���ϵ�e �@�$r�+_ѡ�K�¤��DL425L:&.��̀�d��#E����7 4E<Z���kDߜ������S�-� ����p�'��u�$�g��}�FO�q��OV����tb�4~XTo��Oe��1��;+�Z �y�� ݊o��Czn���6�(D�@Q_��*� ��#"Ij���c�E�����(����,V>a�NO���,4��D�Ua}�T�U�� ����r;�]c���1U�3�%b�1f�ٯJ��t3;ϋ��8��B��������?��/����kv� M)Am�5�<{G�g��7Q��q�����lK�y���,I�(U��`)ej�f�؎U���UX�J���m�?���.�NP JX�����O"Ӟ�����j4t塇�|��ϑ�)[T�O�����o)�*D��y#�&��q�V�����%!G�*��d�d��J�#�/��Ǹ��y1���1���s����O`e'}��ސ,kI0Jj�K��N���<�L�Q{/���i�쀨>�Ut2r1|��Uzҳ@q��P�^m��ͺ�ts>��R�4�� �|����r��)�����[M9�*��^1r�Sz$4�[��tb���ƾ��g����on%4W4�@l�)aE�n�1m���d]߹̞M߶r\s�}I̤��t��Z�k�K�`jCÔ���N���r��뿳h ��h�k�M�� ����N� �_+�t�����]3�7�^!h��'��i����t�k�f�f�MM�wϊ`7?.t0�9W��Y�1����._n�ϋ`x�2�8wg�z���=~�����p�mJ�z���`m��҆z�������5.ǰNOaA���)j�~��������XM!`�������7�D��ـ�������׃�(m�6�H�t>5���Į�VM�s���Q��L��Z�U���Գ�)����T緘ʯ�`A����#uݝw]T'-n=�M�����e��^*I�D�4�4ee�-6T�R���>HhN���Qx�[O�(��3W�V�p�W��ϖ�عd3��(C�d��@Z�$��<ド������ ְ�{|��W���k�\b~��"�V������)��L�h{���1A$��(�8��m�c��t��/�b*�e|��]�hW�j��[��w8�ՠ��u�Llj�VAVJ�s����Ϳ\_�е��0C.���v���?�"�O�w��2�>�u�+�/�'%Tcd8�h �� ��?ɜ�gt˝�ŕ���\�#C����S�P�R�n� >K���D@;/e~o�Ƒ�a[V���A��* �Q���>�X������5�G����:���Ir����u�L��F���*���)$d��u�ۡD$q�?�Ũ��RBs�gI͚Vuï�'%�C�]�ռ,K�Ŕ��T'~��*�X͇8�]`��a �Jݤ����xӯ�� �)L�l�0�G��Kq�㦋K��H:H����ܚ.��e�H�2;s8�/�R�~xEĥkr�\�ʰ%����z��*� �} �O#���?)�Z/Af��L͓B��}�?U���7�0A+I��L%*Ʃ�b��@!������\���_���Y(:R�~7�S<�:��7��#��ܣ�3l��U0�>Qi�n�C>2Y�Q_��?tO��'����P!=弲aW X�� B�& ����;B� �|�Zg�+������JXꠒ$�s2Q�M{�/4�?�N|w�MK��&�L�Ƭ��z�E����n1&Mm���w4�Gi�fyݯ�D��ʨ�W?K�O�an؊j_(��l9�pM�s1���â�}-B��C*Ŀe�uhgX݃��j��aŜ�p29�,W��ֳuD�U���@T�@��)] ���~&�������tI��}<x����,��x��*��h4��އȠ�F���>����d��}�)MM��%n[�]D>��7����WL���Ҳ[mtEt�Ш�7� ^�A��D�_'_pm:�xk�&�i��5�$� wD �f���/��??.�m���K� )��P?e�WLՇ��u�� �����0`4<8g��K�2!����?��N ��j��@G��+��Լ$�gd�F��:s��=�s��~���M����eQ�6��u�4Qu�\ ٕ��p{�& (��Շ�`���,o�2����NBH�-��pM�M).������%�����l�u���Fv%�K�F-�'�m�I���`�m�}�FQ�>9���k�D=�u �(|��}�i�/|��^ޔ��R�͡]x!�L:�t�Y'��`5�w�}"i&�Jd^�#���y���p��.`��Ǚa��Qr��τN(`�wi��ȸ�(��5��.HxE�0��ӧ���b�I�w�� s%х��q����c�)�fs[��p�'I�T0 qW�8�3��&g���f��5�.w�Vt�"Q �8�����5�u���J=q~9�q���B��n�]�b#���Mx��)[��=R9��E��CӸ�|X:ŖY�8�acʫh��O�qQ+��Kv#�$R����m�Ae���4:B�j���:zB�zT~���qc$M��s>_BwY 8�9����ʊ9�����ɪ�ov�c{V�(���b��yn� �����{ yQ�iJ����0�8�+d�><�;I)���Q���}��Ƶ��e<�%�Vc�M�b Cj�]3Rp���ONl[��^�bIHx�����V>�gXG<��l����u�h|g� �t��Բ� R� 8
Static task
static1
Behavioral task
behavioral1
Sample
7c98887b5acd1875b37fa982269dc654059a257abcfb39d71bcae165eaab72ac.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
7c98887b5acd1875b37fa982269dc654059a257abcfb39d71bcae165eaab72ac.exe
Resource
win10v2004-20240730-en
General
-
Target
7c98887b5acd1875b37fa982269dc654059a257abcfb39d71bcae165eaab72ac
-
Size
5.9MB
-
MD5
d78754171b31f3ec3761d007590b97c3
-
SHA1
0fa8c1ecad9de287a6517aacc38941c743228257
-
SHA256
7c98887b5acd1875b37fa982269dc654059a257abcfb39d71bcae165eaab72ac
-
SHA512
d40120518ecc605824faf18614f81b4c42d17e711d730ffecae4dc2dd5e84fb9a6f50893c7c59548a4ed2e87e8a65efde3d7777e48aedf9319aaba6834122fe4
-
SSDEEP
98304:zemgPGqNmoPEDrHI6VsLGKD8nGLf9DYvnopyQ5wNm8LQzhOxn2XaTIwpvAOFubnf:YGqNmoPWHI6yEGhl98Mhy6aTkbh3R
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7c98887b5acd1875b37fa982269dc654059a257abcfb39d71bcae165eaab72ac
Files
-
7c98887b5acd1875b37fa982269dc654059a257abcfb39d71bcae165eaab72ac.exe windows:5 windows x86 arch:x86
3929eb2103040cd0bb68659dd1ec8cc6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PeekMessageA
CharUpperBuffW
gdi32
ExtSelectClipRgn
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ImageList_GetIcon
wininet
DeleteUrlCacheEntry
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 778KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 566KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 377KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps2 Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 40KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ