�{��o�w^��Ju l��^�6�/�Sh����n[� ��<�e���V� �&qX�zo��#�k(u�9���j�s"��6�kw7"��T���9Q; JV"������x����o05i�b������!=lÔA I�F_���;��$���8�����K�;�������ɬ���l*0�h���'�ZCt3D�U���`L� IX�;�Sʹ��.��%������A_������7�{ק!h����a�e����˽�P�M���i�F2`�I��l�iN�o�����0�@�>n�_0,�X`��A���O�|��` }��m�3"�u�?8��}2�"/(�i���g��8�=�+Uۓ������k<�o�U)?'#H��+�ԃ�1� ��I9ѐ�����bA���J�.ډH$���������cT�4Y2��>^�?��$��bFg' �n|s�4V��k����ө��&������a,<V�����6���Y�?����!��>Zo��aS �k=̀+`D�7Z;��?D`K����,% � Pu��V�F]��p���n���$�9!~�ٍ�Ͳ*��Xڲ��YQ~+Y�ebu�D?�X��o����n���o2���d,�2 ��p��K��$��L���U ���Y��#�v`^��2gm>�YvX�e�:��TJ`�aU�ŐY���������xU.��t,C���/��2����h�;>*#D�e���3���X;�0ϤnV��1_տp�!�G��x�����I����������mH����[n)f��U�f���}��p���p��m��{��b���P�ߨIJ�9aPe�ۉ�ٺ���G�F��<�˜A�s��C,Zq���9�gGE�?h�T-�o��Q����+�Kv�b\t�|�`r��W�檉q�%O��~ýr�(�iC�ח�?�:���Q�zp�*Ï�^A� �F��XR�� �Şǩ����gG&�z��~R�a��. ���b`�Յ��71M(Z��k5����C�u��vK��M�Ԇ��'��{$��(F���f9`�s��>L��f��Z+L��6Dd�ph7��d�KcH� ֓_��x��Z]���h�C���� mvc���E<�xu�G�j�����EW7�Xn`�o8��/��eh�Ng��D6�2��)u���ieZJ+�E��������W�xg9����� <�_�J�<�6ZJ���Ŷ������5�C9Lr���HO��Tu2�=����X>�T]'a =Dݿd�|8�ck>oeS]�(<�0f������V���X��}�������%E8�sb��zvu�f3���S�f�C4��.�/;�3�R&��A�4�����u_�m V-�oeIb�d^Y��%6�H��B�cQ��E����ȉ���r�S�4x�5� 3ϸ8c�>q��I�G_Fz��k.�9��$�F$����tIL_���}�&oX�}!�(S�qH�S������n �����5�j �H?�E'F]&�� �Pl��LU���h̨4��/� ��!#[��_)~2c��9�/���._/x��8i��v 7�q�����g� 05(��(� �+pڊ�����i����~�rt��H�9F�ʾ�[�s�y76�$�ZA��(��&t-m����?��Y���>��Gŀ�Z̈́]�K[}sF����04`�Ө�w"R5�C��Tt�O/g5;9�}7�1fb`}�8��.���&Y����q���T��Rh:W�t⪴0w���rDžy����kd��٦�@W#���m�*/s�G,| ӣa�,��������js��:e�e@ J(=Y��I�`��������ϟVg䲵jO���B��|�0��b��T��Z��|̆� � �Ab�U���2�;�"A�G0F����b�a�M?+Mm��/mgm�5``���P�����˨��,|�*�V����w�Q'�װ�R1PX� s� �*�����!�Y�X�\5hC��vz*�·:҉��i�K��n�������Zt��J�ϯ�"��C�"k�@eV����Ϩ�����W�k��ʦ�.�G%�U�z���SfV�9!_[�?����Ǥۍo��pڪ�TNj�XDq�{%����M�� �̛���8��C�gЎ��MLf05�ªT�K�5j���[��"V;;�4O�8^@�")�`h�r���E͕F����)"����BcH���{eaIR�c:��xa�$���������ԥWM�G��k��>��)��]gJ'4��v�.����#s�bn ��� ��tD^p�RaKܼ���вbН��d�T�X97�H�OM�`�DW���X)a��̂G�����]d�r�D�]41� vt���?�� {��0ܒWL}S�+��gR�����P�i �r�&���f����8)��(���i��n��k���5�dY\'�L�#`�(�o��N�-���q���Bh��c�fjB���(Wg|W�w�����'�Z3fo"�潷7�p�y۸��(8A�O%�����|W�3TD�9���'22ل��R(��6<R�Ѓ�o厀������>|g`���i���r7w2G��K��������v3��V)�Z i=nY_�k ��n�%!�a����Un,���}�Na����d�A?�,��ͫTD���c�j��$�{�sZX�-��4�2w~���1hZ3txD��_ �J�u�P�s\˳k�l��a8���IKE� G"|˟���}��q^ K�ý<?�4��]sVސ@5���mr�P���9���>�ƀ��� ��>��L�5�-� �h��@��z�oJ���8:!��E�Np�F�ۼ�ٓ�"�|d���EF q�a���^gaa�ͷU��Ȁ)�r����v�VC�*4�|���<�溊V9L4F�C��Q-87,���7��Hs� ��I_����%i�<{�M[g��R�Z۹�V耕�nש�I�7�#�[H��� ����+P!��M8��V��O��=�dip�ܤ�F)�Rj����u��3Y�'o���L��C����{�����8n������W4��a�����%sj�sȜ�A-���z����
Static task
static1
Behavioral task
behavioral1
Sample
4410e6509ef90e0b6d680e04c05552c0cf8729c40d3cbb6ffd39126d022d3a11.exe
Resource
win7-20240704-en
General
-
Target
4410e6509ef90e0b6d680e04c05552c0cf8729c40d3cbb6ffd39126d022d3a11
-
Size
5.6MB
-
MD5
a386741a24f6dd80f0a87a8af51c37c7
-
SHA1
51dd4f9a6ba686e40123e6200b292534fe15b529
-
SHA256
4410e6509ef90e0b6d680e04c05552c0cf8729c40d3cbb6ffd39126d022d3a11
-
SHA512
c52abd56e6a70d7b5436cebd97d185ce9133760fd62fee8ec8dbfce9ca989c702aed9267163ce011dc4584975869399962e2fd096bbf776e12181107e649752f
-
SSDEEP
98304:NGw3A8OKSRt7Z4wiP+D06EA/rGkd5MDy1cFZeEzfnIOQI0/ZQ5pn05UUKKOcnj2n:3w8OzRt7ZJiy0Qd1cFx/INIMZQ5Wj26R
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4410e6509ef90e0b6d680e04c05552c0cf8729c40d3cbb6ffd39126d022d3a11
Files
-
4410e6509ef90e0b6d680e04c05552c0cf8729c40d3cbb6ffd39126d022d3a11.exe windows:6 windows x86 arch:x86
6cd534e7b5176a03dd0f0bb59be036b9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
RegCloseKey
shell32
SHGetFolderPathA
ole32
CoUninitialize
wininet
HttpOpenRequestA
ws2_32
closesocket
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 313KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vdata0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vdata1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ