lR�����i1��=`��"����ɕ aO$�O��hY1�~t��|��m�':�'�n�}`�E<���/���)�fz�b&�lJ�n� ��]��N\]�/7 ��bH�g�����tvC����Y*8O?�|��3�>����w���&��e�v��2�&k�I������c����)}���< tq_�ǞFz��B� �x���{d%����+sxQϱH#~��?���&���4����Ξ/��r-����s�7x���N��]�$�V;�<����8e�1�h�����|��bJ �VX���$�s�[�6� \API���f.WBVCM����Ҹ�b]l��t6�v�t0�=��*@���I?���USƣer�����?�x��Y��A����ڲ�����Ia����m��Iԫ s�|ݸzh'�2���� �*)�w�c��z��:ɳ�(� G�g��4����&"�[Bϊqymop�t0ހU�e/Æi�"A�{]��kE�<��idkk+���L���M`M��O�oF���'AH�AR�#(L;�3^�A�D�;�O���p����w�Q�qE��Jp�]q��t�i��3�u i��YYj���U����N��5�J��j�i:3d��0�/efPyq}ṉ���ǂ�F|6���8��<�d;߳�bݑ�j�.2�i�>vQN)u��W�+ɝ�v��p�ʬ\�pԣ4vIkH�t��� ��M�!5h��z�}������Ҥ��^��懩�V�m(m1�#��|�����o@�r��cJ^�����*EB�*+`H�H��ۨ��3�fVAt�� |��tyQOL�Q���w3=>��� ���c��c%��[�2�|�8�N��lʓ~b)[Y@�&�e���U�¾�[!��q��(�T7�=�Z�����s_2w-`9z�e���þ`ޱ��ЕcI(P%WQ=��C���|���Q�t3Y�2�C`A�|� �j���_ "�#w��S3�(��H��i�,x���S��-��O�?E�����#����0��T�����|s���3[^��O������1��`�s��S��_7}\��[���g��-�M��J�.�\p`N����?������v<N�D��K��1ɸ��(��'�UUF���=QT.b�I�k"QA���|��u�*��6p��5��E��dP�i\Vj��3�,����������E6[ �F��A18 ��ۍ]�����^Ȣ�%՝<�(���^�t#zG��y��h[E5����t]�*�`P�q� /;���cj�6��2�S��(��.j����$X�m�{b�ѕ���Z�%��������;�m�$¿1�3�Mey�mt?����NI.���39�^_ _ �wlw^���6�쑷]��Nv�_*A6���~�. �Gw������\N�'�mh������_����G�CvL�C������2@5�C��NϮju���n#$�M�1uC�9>���z��Ɔ@-��5�B,گ�I�d-Ґ���K��D��4�2;=��r��y�j� {n����x~8Xdm� �^����mii&���Z�H0} �`���i�Ҳp�/7�,�|Ci�Q�#�;����Y�N��U��{p�~,�w8=� ����FEB��`��G�,��I��c�C�5�d�n��r�p- %@u;\�:8��<�@��g��c�ª�A��ڱ�@��;[L���7):��>I\{*������X�p�\�2�=��#,�^� 'ˏI��EFY!����v4����|F,�.�j���P)�������b�z�����?�J��c���S��t^����=�a����<���5��=���X&�� �q���J�ė1;��dz|Z���y�k~[�5{�]���u����'�ж��Q�e|G�XNl`p�������P4����F�x�|62֩�0w�z����e0���T�"���s�j����"e�J�~�v9�!|��^>��EVA.��H�K)D�����Ļ�������J�9��p��C�骋3��P:2��gu��|����J^nԧ��fDZ��˔-vb��cp��4��G���If�����ޭ�~��DȐOF6]e�y&���#�Lh���r�QwSd�3�A�$8X�q��(��c^���86:����{���1hHe9Y��Уr��`%�y�ϵA�/�;��hE�l������Xܓ�hzY�ڦ��:��C��Y;O�D��H�LN���[�q�2M9���EM���Sq�G>EEI��'���JߙgH�����9���%��d�E許.e�B1�l�H�o�z�s�j��x:ͲT���v.���w�J�<.o�_����Ԙ��%����diVL�1SLh;�ު�3��6>��Swнk�lƺ �,���X^��;<�ލm���$k���3^#�[>����q����a�UXK?zr��O]m<���!�:������l[5J����[zĖ��c���%J�h.� GE(�0j�R��N���=s7\w��r�$�d�FgL�<H˗�^=y�6����r�~̉�ۊ�H�1N|y�\e[UW:�f��odžḯ@ ���Y�0n�BmIO�!�>:��T**�F@�H��ѽ�5 2�����⊴]��Ii����]u��Kg���71�*�,���v����f�Q\t�4ȏ�J��H��e��HX%,߅��K�0a�Fj�q �'�Ŧ���;�u�K�IeZ�)��Ւ`��1RD����,��fi�V8 g���|Q�����ڪ�`�>_"���\�Y�n}Pш�閺�T�>Ӯf1��댘;��ԃ��%���3(X�,��� C�R��rj��a�U��.�S7��˜/����'p� `_�u�:�[��qxF�n "m�@��)��G�!fJ���U��U�Z�ڤ-0�5ߞ�tŠ;��Y<�IF��\�0дu�Ad��a�>��ݬ�|q& � ���Y�`���_������@n*q�Ki%��AEN�pvv;�ފ{���^�_�������UO]�Z;M�n'p�cp~��[ew����/����c��`�4Q �1�M�\0^�v>z���3i8<D {���֫�.��u�N���+
Static task
static1
Behavioral task
behavioral1
Sample
62f549054e902ba1d7cc281147e85370N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
62f549054e902ba1d7cc281147e85370N.exe
Resource
win10v2004-20240802-en
General
-
Target
62f549054e902ba1d7cc281147e85370N.exe
-
Size
9.2MB
-
MD5
62f549054e902ba1d7cc281147e85370
-
SHA1
e57009f7f5f895b1ce133de3c4fa4f45b3b81b81
-
SHA256
e2fb9ae2921c3f49be4eb9c4546fd9a81f3b94e9f00189d2ce4acb8fabe0f885
-
SHA512
3b8d8ad206ebb205b1f1d7f4df3df4071996c387731c9d16f1f46af8547f414763b1813af76c183e9c29d5459c99c924d57ca1f3c944ff94d0ab80b2d4c67e81
-
SSDEEP
196608:0jsM1/rRsfpdECxZVstmASU+qo3pO0W9yxpYJkWtoUtxjU4L:L0/N0xVstEUqvxSVHU0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 62f549054e902ba1d7cc281147e85370N.exe
Files
-
62f549054e902ba1d7cc281147e85370N.exe.exe windows:6 windows x86 arch:x86
e9484428dc4487bd4aef8d55c089770c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegSetValueExW
msvcp140
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
kernel32
InitializeCriticalSectionAndSpinCount
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
ole32
CoCreateInstance
shell32
ShellExecuteExA
userenv
UnloadUserProfile
rpcrt4
UuidToStringA
urlmon
URLDownloadToFileA
psapi
GetProcessMemoryInfo
vcruntime140
__CxxFrameHandler3
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-stdio-l1-1-0
feof
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
api-ms-win-crt-heap-l1-1-0
_aligned_free
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
normaliz
IdnToAscii
ws2_32
htons
wldap32
ord211
crypt32
CertCreateCertificateChainEngine
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 686KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 234KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SUPERMA Size: - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.SUPERMA Size: 8.8MB - Virtual size: 8.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 423KB - Virtual size: 423KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ