���(ur^�����%����o�հ�?�y�ߊ��� U�&=94Y�h�Jp}_4��ܽP�Ĩ'a4�$Å�����͡����M����P�z�_z$����� ���ƞex�E�M�*��8�udH��_�"��~6Gk-�:������D =�Yfk�J�z���n8A�g��}�h�]>������'��<F 9���n]�D����D%Zˢ'#���%�xu�F���t��g�TČ�IV�e��1�)2~.��դv���ll����#��5j(P�E0ͥ�W�y�*c�HWt������b��A�����$I�t�۔~{�]8�W ��?���qZ�|Y�ۻS��9��Ť�Z���>6�S�tr�P�&*6��$ �� tM�ҏ�c �8�/%�����T.F��[��,/����k@���C��<�0��lč�@vx�s\��N��������+7��|����M[0�8�����홗��N����i�Yޯ~�S����;��I?�ʞ�K����ş�ԋK�|�B����q��ޠ�@N@��=A4�y�����[��E=�Y�e���i��N���g�c=Mԫ��oA�I%�~�y3zO�@,N�&u/���W|� �s��������-6.�5���`��)8N��z������5;�1��0��AN�hR[3��$�����cJǯ�3��(��B�Z��p&�U�{��x�q+�m�x�D��1K���#my�P��.f�H�H����5dǎ�$�������I��*�A�ΘHW0�>��L��1�q�1�g S���6.]�i�_fr⟑��� J<1�w�]I/G�����VA���vJ�֭�Od݇2�G`�F��=���t���al@����6w��m8����+��c=Bh�\n�e�ܥ��������wy��v��]�������`�M�xJH�x�z�l�a��!ȫ�aeQ5QO?(��1f�n�Dz��I� GY,ykQ��c�@2��m4�Q�d ��BL�_���Oh>iß��~<��đ�� )&�r���Kˢ�����D�;���#�Ҡ6�R��̯�U�c�z=k ���&����c$@*�D��k�$J�HVd�7Z��<,_��u�&�����ٔ��U�����EiЈ�T��{o Ь���gU�F@G �N|E����-�asVǹH�3jqH�MWf�C@�i`� ���䅕���v� ܩ�� �+E�^2\�� x%7V� �G��g|�fHo�HOt�ZEyfm��hM�߷^`�oYO��˼�n �E�5�ͩ'@V~[���%f��j��>.����g�c�0�P���<�P��P$�6��wfn��'e0�����b�����{([�Q��y"�.a%!�C�#��Pq�s�3k�Ϥ>�Nc��+�-\���s��H�Ca����%EW6��ġҼ�:���|"免|��ן�X|o��� ��F!DN����L5q.R�*��ʰ�=�����������,~8J�]%M����$�(���o}��������^ #r�F1�E����6���r7�|g�Yf�4W�Ӵނ�qqy��a���g���(���a�/����wT�E����p<A|V�����v� ���hh�m8 Ǧ�Ig���i��JN#c�Y�䞦IȒ�k���M�PE�nn'�jY�K%�{����ߥ�FI�P�D�Yw��5nj�R����#�t>�-7��e4f͗��?��Q�W��{n�uX����Vȉ^Nj�� I��/���%8]��D7gV�����P*v^���*xܚ��R�`@��S���E��.����2h|���*_�.j/8�[�/�q���'q)4Y�>Z�.���˹�SR�^Qğ�R�`�E���1��v�G��ڸ��J�� 21<�_�B�E��2�"Ӊ<T�� zE�X��rCF�s큜{"�Z=� ���h�f�7\��-d$`�S����0�����>E(��a�55�z�XQl�w����P �߲iN�(�p�{�U��yJ�1����哴Ҫ' 3���VL��5m�ߧ�--�mrAYq�������iv�t��BpE�[o��-��҅�wTC�݄J��EX��Q|ܑ2�ݽ��YR���=]��Q�G���m����yk7h�r!7�<�/Nl�b��D{�W�r�ʈ�ɾl�-�V��Gy�I� ����r���������PZ4M��l�����x�f j��������"k,�k��-{ؤ�PT]#��\K�� :Ӗ�������P%��Jq��l��K(��Zvz'H��p$��˚�c{�l�H��xJ��o�z܁�a��}�d��/�y���+�5k��ޞ�'l�ϰ4�3�naз{I�n��v��r�|�n�����om�$�~��Cd?� E�����o)�������R��[21�67p�4��ݥ�h���}e�ಐ"�Km c���&>Z�%N��_�D%ыלS�,�������+w�h]���A�g��$��ٱ��&��A6����q��"�@���"}��E)9�o�̞�t?s����>�1�J��z�s9.�da�544�o�����+n��[t(-����G�}�ڇ���m�FpIݒu �π���fa4�}ȟ7��o:D�8�9��7�p.)A��p��v��d=n��}~���qD�@�}��#�q[1������T�H9R��#x��K+��d�E�xM��W~��[��n��g�j����JY�u��S� M�g.��}��"\r������{˗��� N���/�^��0|�=_X�Ա��n�T��8\��j�%����o�g�)�B�{�*Q�ݛc�&��(���|������^:u���鸧Q����w��՜��zWভՌh�Ub4���Z�$��߅�?��^�{�`�/Y�ͮ�rptŭmh�-��1GB/��J���J��v���oc�LQޘ�`xM��3Mn�-.�p�����@�g'/��NK��_C��v8r9���4Ƣ��WuU�~��r��3D�M�3��2�����/>� �>+g/ ���O��dthf���o��������#���a� 3�G
Static task
static1
Behavioral task
behavioral1
Sample
f187d1f66d439000e0fd02d75d7903bc2e57494f6277794e9591750a1e699c88.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
f187d1f66d439000e0fd02d75d7903bc2e57494f6277794e9591750a1e699c88.exe
Resource
win10v2004-20240802-en
General
-
Target
f187d1f66d439000e0fd02d75d7903bc2e57494f6277794e9591750a1e699c88
-
Size
8.6MB
-
MD5
6679db44fd78934d076573026dfb778f
-
SHA1
a04facf91a0625079caec027829aee2c9c54b464
-
SHA256
f187d1f66d439000e0fd02d75d7903bc2e57494f6277794e9591750a1e699c88
-
SHA512
f06d00461ad6c7a6186a68fbf544c720e714dd51f82b2ee4d76c4371d2e06620edd79bf3f7d72098af42c6a9e52bf6a35879b8d6d6cef602ff6d3f7b01a1b69f
-
SSDEEP
196608:hGGJD7CZpVCHJG1OgX6uB/482c6Nw96Eg1VAQ5Lxw0xjnhfNQlLpKUB:hd7rG1+k4Nc196LPKwhCKy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f187d1f66d439000e0fd02d75d7903bc2e57494f6277794e9591750a1e699c88
Files
-
f187d1f66d439000e0fd02d75d7903bc2e57494f6277794e9591750a1e699c88.exe windows:5 windows x86 arch:x86
1655c37c4c68546711c396c118147487
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnableMenuItem
GetMessagePos
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
winmm
midiStreamOut
ws2_32
htons
rasapi32
RasHangUpA
gdi32
ExcludeClipRect
winspool.drv
OpenPrinterA
advapi32
RegQueryValueA
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ImageList_Add
wininet
InternetCloseHandle
comdlg32
GetOpenFileNameA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 918KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.upx1 Size: 8.5MB - Virtual size: 8.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ