��%`��"�<tњ��"e(���"���:��rD�PzW��V@����=���$����ja`�`ģ�e�V��(4;�O��c)5=�]�����V0�;I���*JR]`J#��2����[0y����m5Ze�G��1ZC�}5s���u��U�tns���Ⱥ!�dnB�p�|�)�n7�j��Jx�l��*9L�yiWoN����F���!0s�*�8����d�)�����SIk�|��y8e��-CM��h5�E�0O��xy鈇dBJ��s��82}� ��ٞ�߫c��c���?����� x�ls�1�O�D��Od ���0ہ���� ��A�80L�=h��H���qʶ�рy�ԇ �pp���$f�H^r���d�Dh�B��"���qmg(14��q#-�i��|�i��"@� � �E�VzoW��إ�k��T�dJ(`�}����A M[� 3��kh��Ԋ��?+NYр�-�R�ӧE�@^��۬��Ͱ���Pr����8�g�� �����"������R�)�0 ���q�_d�@�X����C��(��U&��.���~s/��[H+� Ooô4X��^,4@��������w~��=TfON62�P��|R�q��CM��Р�6@ ���Ǜ�Mìց����y$��Q��:Njw$��T �m��9��$�_��Ê�� ��]$q�,��q7�!�y���T����$0ǿ 0���&ٺ��+���Y�N�OX�^w��y�E�~݂҅^�{�J���P(�z�����?D5����#R?��"��e�2����`�rK������C���P��˾\������v��-?�p�V���\hp�<��r��r��=1��%,�;�W� ���`�W-��cU��P�90� �<����n0�ԛ�v�riԲ}��i��G�۫�|������A��Ê!G�O�80�@��>C������f�����WȐ�5wBݞjLOJ[u��a��W�mI #�31^��n��'��~��* ,�?%2��qβ�r�GQ �r[�"Оƃ�n���X*�G]L�E6���J�:�L��4ڨ[u&K��)�Y�X�x��c�0�]�>��K��)Aّ%ޙ@y�)�? �����=ܝ�KXusd��]췂ue���}��LO@b܉n�6:E��Gpp+�^��i葐�ڹ,�Ĝe�����C \�+Y۔gA��+��k2Ӷ�n�~õ8�h�"D=�kmg#j���%ff���<]�Sk�G[�����|��m_l�j���#��';!�s9���?w�$���D�`f���p16�Ẳ������:��'z$ �݀i�u���V8�*M�2���^���D��,8M +ͮ���@3O7� yg$�A���迭�]����e�~�g O�_����o��4Q�**O��=i�l�h���yo�Y�Թ����>�0�k��U���M���*�i���~�n:p�=�KG�����12�5=�� �D�Q_�=g�����s8^9,����ͩH�fi��yh�s!>���R~�܇�e4$}����W�H]���ʩ�+��*�<��� �S����[��27��n���q�Pbj͚c�.��CO�1r�Φ)�S�;���u",�O܁�>�w�-�:�/������X΅:A���J�(�{,7�[����vհ%�7HCϟt�O�j� ����d�/՛U����:�x>��ٛ��DQ�,i���!���kvrs�=~)�w����π�\����NJ\����OԨ�n���8��FZ�E&xx�8b�*M����U����qbje���N��/�8��>��qg� 8Q����V��d���Kz�ˢ���R��Wܒ7���c ��N ��i�.@���A��+Vέ�驅!���տ*P�aV��I���>��l@,�T)�n�"�ݙ}�VR,s�������U;{y ��ƿ-��O���s�:�߫ԝ)� �\�A�Dⵤ���cAO)D���d�p�����a^� ��w�wif_�"[81Bf���a'l����&7��B�ЮR�Y�rl�d[-o�;�Z(Zqn&�SWhic�z��F"'�=��`�ք�}NX� ��5ut�� 0@.�������wn���!�;@�c�`m!(4�;뮆�R�Q}�R����+�J�V���,v4���,���^s||�nc+/D4P��oc ��w�ڢKZ��i��`��|��l$����⦉�G�vi�m s�=G��voYr�.JP�zc���_ q�����0�6Q�j�o����DT�0�n�:�r�Z��;܂�2tZ�\�Ԇ�n������T��ϻm���6L��ܲ��F c���Xʋ�Li�7�6d���������X���X�Ǩ�ǁ\`n��������p@n��o�=-G�N�b.x����jg��U�N�F����j��J��r��r�GM����9�ٚ�D�A��T�E����)���)z�E^^ MeN ��E����(�P�&�U���B��,g���`Mo}��Yj�:���cZ�S��]��(�9]���p^K���:1!�>���1�3�= �!>�p��S�q8�P��|�z����� ��y'����'�耷6�L�]O�)ۨ��m� ��@�o^%��������%�s��K+�ݻ�� x�A�Z�Jo��i� �"���c�rç˝�j�ݓ/n���S:�Wr�!l�e�u��z<�b���LԗF�Lk(�����5%Ԑp�x�8ˠi��O���_s���@���ё8�����,����̥��P(G��5��A�z�Lװ�ui�O9nuR�8[�����D�хѧ����K.*N��AC���d�}��q�^��m�(�=��EQaAHS]NVU��Z��f&���N�U��ˠ�����t��@�����B�p)�M�ӱ��B��$�Cut�( ��:��w��P�Q�����']SR���No�~Ҡ��$Z$zEnFɮ��#cg��ɫNY��w�V�\p���c��D/4������jy���%f�j��E�~�{w����"q"���f�440u� �
Static task
static1
Behavioral task
behavioral1
Sample
b486a032265bd56c4a1e8bace44680ca6c64dab0837423513d644a7052dc5426.exe
Resource
win7-20240708-en
General
-
Target
b486a032265bd56c4a1e8bace44680ca6c64dab0837423513d644a7052dc5426
-
Size
1.7MB
-
MD5
6b93b3de8a4411a47e24aa95b45deb80
-
SHA1
1c86e46ae899ca8b83ef8479187b5ab5fc998e1f
-
SHA256
b486a032265bd56c4a1e8bace44680ca6c64dab0837423513d644a7052dc5426
-
SHA512
ea068ece848516ec2398b7d120eeb85afc8786edc8238f8e41cde9854f45487a1da21dd03838b7c40574cafe5b8c3ce2d539195fe626c56dcb739f8c8e5c101c
-
SSDEEP
49152:gT6ESriPVYhI1FqbU7+C1GBmr3xnuNhSD8kFkxk17JwkIjI:KmhGqQKC+qBp7JwNI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b486a032265bd56c4a1e8bace44680ca6c64dab0837423513d644a7052dc5426
Files
-
b486a032265bd56c4a1e8bace44680ca6c64dab0837423513d644a7052dc5426.exe windows:5 windows x86 arch:x86
6de02a123201e4672899d01732a06303
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
HeapFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowThreadProcessId
advapi32
CryptAcquireContextA
psapi
GetModuleFileNameExA
shlwapi
PathFileExistsA
Exports
Exports
Sections
VByTt Size: - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
VByTtL Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
VByTt Size: - Virtual size: 921KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VByTt Size: - Virtual size: 688KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VByT Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VByTt Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VByTt Size: 4KB - Virtual size: 692B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ