���! .H����� c� ���� mS�r�}=�"��P�7_Z��6S]9�.���b���Β�Zz��8t�<�� �t�q��EO��IԖBeO�[ rs�{LT;��(�,-v�D����`��������Dj���r��,f�J�]�4�-*��½��̄{����#q����/5�F���5u�7/\�9 ��a�N$l=�J�f�[)�s�b�ڟ?&��X]�}�qR9�����Q�OO�Z j,�bX�y�(ס��7��G�\��e���ya>;]����#���G��\�â�ۏ[�lYn���9%F1O:�[��U�&ᒈ���>V��F��З4=&CA��j��&�U��@�q� ��W �pѦ'�j���8*�?�t��-y6 �J_�.�x�Q����oI�])���ft��mo�F5k|�+���6�nt�v�*�P@g��� �����fP�Hp�h���F^�Ѹ7�\L�%���~�f��f�H����%j�V�YB>ؐ5t�6�� }�K�:Fx�1�_�..�Dq��^�KNs��T��ͳn���9�d*S�.p/�|�F�9���I�p�Љ|م�Æ[��*��H h�jP��Bp����I���SMĜL���� �\�k�!}x�#������G�ԑ��4�<��s͊�'+��4����W�t�k�4�&cMm݁A��,B��5�q�p����-4��-H�Z�т�:j^�DO�B�G����N�!/���0��lN/��2��PΖ�, 6�r��a�]�������k�g�w"�� � ��8^�d�ܹ�����me�x���青�aQ\�[|)��wju�V�����O�n��Br �N9�FԵw��~?r�eo9ֽ�Y!�c�2�G��jf��{�V7HЖ�S|�R����R����Z�$ ��W�b/�o�`�(��i�pi��i�I��{-�"���$�)9 ���H�hM.�b�5'���tO\��"�-��p���ri�M9|_��?���{3U���îD�͓|1��\?��\`�8�Tt.=��=�؝+���XI����#�gC�E�ܣvA����]4�bOдK�T=���1J��_�2-��;B��{��4䑳�y��i�1[��`��*�%���u�O���ܐ��;�ӧYU:��3��K܉=���=��w[ȅLU<��^��ϣE_�1�����u%�\�lk��j�+T�!X.�P��N˹��r��=��/��y�E�2>�S�U��܋3m��_�'#o~������`���cc��z�֟�1�_'�M��~}�(�9+k ��?�6'�2�̔}���p��!lP�P۬�_ub�� �:�����UU:3��l�4��?ЏO>>f��pNi�%��<-��d4U}�X�2�F�f����y0�;�(��px!J�>����&�AJ�����p��O:yݙ�g��X`8��G)SRP@�Z.�"�;Ѱ�㉐`�ibs$,?]�ͥ�#q5�ƼH�R0�l���>`���[�U�N���v�x6�1nEq�G�����o��X�8��V�i/���*���&�j���yKM�tُ~��U�QiV3���I� �@��h��+0߳�X�H�����nVQ��n�����z�O JK��s�4���㠑s�9�M����Ӫ������Yߠ_�=]� �gwPw?���o#Q����%��7mL5�\�š� ���S�f$sk�|�k�E y-���&�>�#�z���Xl�Xo)J��;>���t�LfJ!Z�ɓ~��|���m*$����?X��F !�?˷1vG��Ǘq��_����1+��1Ej�\}�8�N��У�w"��/)����U�ɶ�0�~�c6��\�x1w0��h�(J$�(Xw�?��1I�o\�{]�${M~�����$���ڹ&s� |�y�0��|�.Ҧ�E�����;���6���+��W�� ��I�U]�%l��k-�H� �w��qU5�K�q� 9�ݹZ\e���f{KXu^sPvߵ�|�BU�ʹ�LΈ�Uqk*_������>��r�'�l� (w�5�7 ��U/�E䫑k�WO��H�6Vc�\C��6fH��^�����e�Ԡi����=�&k��W{f,P=�p�h5�cq�b��1���>�t��� a� z����?��!��f0��r��$��"�Z)7���MM�&�ŋѨ�v\Mu0L,Y�$�R�il�h=?U$�jiI�{��H��a�聜�&��^�ͫ`��xދ�JG;��}W"�b�g��7V��F�e�TH/�O=Yv��k�Vz��o^�� @��`q���\���mE��B��k/%��w�ٚ��z)�r�d���*���r�R��o8���uUH��=�P�zh����Pϻ��ّ�4����<�m���f^tf���d"π4�Qy�v���������C����.,`/�?� ����i�xn� ~�y���s:G��ܪ!��Q]]R9��d���ou��/5l�#�xyDo�$eB4�Ϸ��o��.%8G��+���a��,j@������f��Z�7]��Z��[��n�U�s0����⨸�L�OR���3��RCP�9������i��ެc�������q�ݎ��z�MV%�Xf9��ShC��̝�A��LQ�TF������_n�JR�����kv"A.����,g�G��gL�u:q�����' ���.��B3t�n{�MW��)��h��%+QY6\#KU�h���Ɏ���b���G{�!~�ø �'��Ѐ �3����"�>�X��B���:2�k���Ib�B{�I5��y3U)��X�ޓ��X;� ���R:K���m����Au��L~���e�-r����LX>����o�~P���:��b�ܢz��F�ak�s��:E��q�m���^W۩ۥ����B��)`��9�x~�M������z���� �y^�Lh��@��D����kk���ȏ�� k��/�7e�ὢib�7R.�yQ�sP��6y-r�����ݹw��=�(>�b�x4���c� �.�n�M{ �D�Yí��g.��fl��yw�y�� ��`r�U���i�gΤu���y
Static task
static1
Behavioral task
behavioral1
Sample
289f89f6e9f5ab8d1ef1a8defa3013fbfe872edc533d156f07331b44c2bb6ebe.exe
Resource
win7-20240704-en
General
-
Target
289f89f6e9f5ab8d1ef1a8defa3013fbfe872edc533d156f07331b44c2bb6ebe
-
Size
10.6MB
-
MD5
c723e75f630fa871bb19d5f1772dd27d
-
SHA1
e61909d329b9abc607849f2e656e21249812bc68
-
SHA256
289f89f6e9f5ab8d1ef1a8defa3013fbfe872edc533d156f07331b44c2bb6ebe
-
SHA512
f5649452e331214d4e6d3d47d626d156e08d1d8d6dc28f72bf89f5a591f7ac0b45ddd6b90c30c9507e578f2d8c22ef958fec731bf1f480ebdeba0421c738270f
-
SSDEEP
196608:HHP/3beZyHykVPApZ4gcAb9k0js0LRJQCCBSP5NawRJD:HvfWsNmNcmk1iCU/N
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 289f89f6e9f5ab8d1ef1a8defa3013fbfe872edc533d156f07331b44c2bb6ebe
Files
-
289f89f6e9f5ab8d1ef1a8defa3013fbfe872edc533d156f07331b44c2bb6ebe.exe windows:5 windows x86 arch:x86
f7c12a3aa5d3e170f5471201530bdb28
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOpen
ws2_32
WSAAsyncSelect
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowRgn
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetTextMetricsA
winspool.drv
ClosePrinter
advapi32
SetSecurityDescriptorDacl
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ord17
setupapi
SetupDiGetClassDevsA
comdlg32
ChooseFontA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 681KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 315KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.IOG0 Size: - Virtual size: 7.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.IOG1 Size: 10.2MB - Virtual size: 10.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 356KB - Virtual size: 354KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ