˫Q���o~� I�K������j��r��:D�";2j�/��B����F��T�F�2�����)�K �0�Eʙ5�jA�tm��̠��(� ���T����������,K��Ć�%�Tz�I� �,;� K?j^,S�}��S)H������Cy�z�N����u tՂ��TV��~h]` ��s����^^��2/-]���!$����H_O���{��� PmUklk�؈�)zi6��%�����}?�xo֫�Bc3t�ǵھ�ʤ7�&���w�MK�f-ȋ�Ҫ�� n�45nP�)�W5�n�/B���\����!���� TC����)��^g��ܨ���eH�K���9� ,����a�����F�_�aF^^f�H2&r��;���랽BYP���6��P ���p�`=o\���������/Ym��J+�l�/���㭩0k���9wxA�}��ԃ/Y����Wqvs2}.���s��s���5-[*� ��ыeJuU4m��Y�AK�ICZ�ُI;왏�/W�j4=Aڥ�AGp�|�����t�Z��O}Q<_^�������v���l��g�?'���5�X�)� �PWFt.�����j�ǛU�H�tg�����9���=���?T�>��\�>|6/��P�GH�˳� g�C��#А�@%lRI����"9��^z���W^��d&�n�q�%�! [:"�mnA�k���f3�&\��[)M���@$d֕�q��S��e���W��%��{�B9�*D��8%V�(�!�ӟ���Fn��.|��y~��sE��:���!Z�]��`��l��[��R����V�v囨�U�v(O�F��H%h�='�������lL�-ͲtQ錾�A�HRL��A-Ff�(@�"��5���bo2�Њ;P�~p���5q�Y������������ҡ����ف��㜤�[�����ɋ��8Ü��Ayp{��5p���֑�C�|n�S���Wk���Z���B�՚U7H��$�� d��آ7��@A�ӥ�� ��?b����J�|A*uo�9��@;�6g��27iR7JGY���yf��^�R��|PF0�F���|�f�7��q����聭O@m u��5,�b��+2f`����|�&jЛMDEՑ^�\�����$fiOP���M��N�Oj� <�n�@KVr�x~�k3=�rx�]�����l� C���ַNv]�+B�Jз9t���_���x�|�I}�Q� �̶��~��~Ŵ��'��J0f�qA�VϜ�����J�]O�+���D�" �^fǒ���^Ƞa�-��i%����_1�>U�t��C\]�����hn���}.0B㼅�>5�+�K��%�e��[9�n�L0�f]�]NѲ�� ]�ju��=����GFsY)j])�P=��-u4�>o��5�n&����Ҳ��}���6Z R�� �S[UJ�+��ʛ�s�^� "�n��m�yq1������ڃ �=1�EO�d��Z��.�������L�5;Cn�)���8@��AR����"?m�ǞkEN�F�z�ڤId-�]86�a�ˡ����qX�i`�8$Y�й�`�t�N��I(�g�:I���%.'�H���0��B�fj7!t��W��&j��A��=�<"�3�Wa�ް���^~�/f����*�v�L���w 7{�'!~�-�,x4ߤV����'�<������q��`�%��O�袳Va� �������>oϹ���^��9aoW#~��D�t���]��:�\���YB?ͮA^��R�mTQW��m�)�$0�;��,H��5ے���u�(���r\�N��g��x1�j�&�5ohP���Ӟ_4fwT{��TZI�� ^��0��}�~�\,}V>�� ��\Pt�^��1����"~fN��v�Ɓ�UuQ�^%��V��NE�Mx���^S#xm�%�ޞ/I�uȐ�l����zW9 � �5��� ~ŝ :�I��Z���2�漑�����1�qv�'%��W �<E���*~"���k�C�=��_vc� ��ٓ���ؖ�WE�m{.��'eD�mC|?�|�B�J���RA}g/Q>���A���;�of�씎.��N��s?��t�{y)+�6Z��j��Y{��V�ӑ��p'�C����J�Q�/ �����u���P�6�������ƳY�a��]�ٹg:�E���n�)x�����o{�E[�hX�H�DZO�o���_���fƭg����'Ag�<gR����Ӏ���7�Ù�TPvj���I-d4��J�بo��V�e�� �U!�������4�'2���V�[��ٿ������'�N����Áx&҄�M�wQH8R�ؚ��z���C����<�Ե`�{vXCO��LU�v�H:�̒�{�֊��{��-@�0�#K�ɑ���,_o����!��˿a�����������8P�w�꣒S� ���P^u��}�ޭ�4�S���kx���{";�]y���m�xtf�Aʙ1�b��w����]>`,ګxE]���7�X0|ZI� ��"O:w��uc�A+�,t��QdL����[��[ttY&��M>��G���,��&�X�^�y�"4�����7�v�H�T/��Nq��A!���֚��^�&��H�>�=2�����}���FH�g�If������&�ϴg�͓h�k§2�0��b�][�z&�^����j��{-��'4=�@�/�/]c���?'���U�/ֆ����j7J���nk��#DD<)��7xlE�|�q��<bq�-h��-��,���X��!z��nj�F��x(���z�E(���)0�2�l�ŵ,��jہ�H{��\��=7A~{��p>j��HH�a¬��;q/�О��Eϝ-�<�t�Z����dCɮ�#����қ7g��EV8.�}w�CY�NHk:n���<�B�� �z]��]��kU��L�K����`O,���uR��/�B%4!� ���@`7�_ ���icĘ�6y�ļ��x�;�6�X�;�#nLn8�!gD:��a܉0�b�ې�������fo�Z����(̋�v����=m�fo�*M~�D
Static task
static1
Behavioral task
behavioral1
Sample
39b6b39a504dca350a904a5a85acda373225b6a99a8c15c1e06520890bf061cf.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
39b6b39a504dca350a904a5a85acda373225b6a99a8c15c1e06520890bf061cf.exe
Resource
win10v2004-20240802-en
General
-
Target
39b6b39a504dca350a904a5a85acda373225b6a99a8c15c1e06520890bf061cf
-
Size
4.1MB
-
MD5
e96a27367c6c3d397d6f3aa29a907d6a
-
SHA1
7fbb1c28517bdf69a5062b8d4a6e74399e6a41bc
-
SHA256
39b6b39a504dca350a904a5a85acda373225b6a99a8c15c1e06520890bf061cf
-
SHA512
e076c0415a1048a7e8f79fde666f5aa9fdac667ea6783e115409454e75951fdce95848f089252f869b0550f0fe3c206ce7383d26db21a1a0f97acf5eaa3a38fa
-
SSDEEP
98304:qhm9FZ1r4lfw53fkK9lHu7nEta9eYOtXKncLoQr:q0V1MCc6Hu7nveYAX0ccQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 39b6b39a504dca350a904a5a85acda373225b6a99a8c15c1e06520890bf061cf
Files
-
39b6b39a504dca350a904a5a85acda373225b6a99a8c15c1e06520890bf061cf.exe windows:5 windows x86 arch:x86
f1da1d8b092d443c6105be97ae794d9a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
GetTimeZoneInformation
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
InflateRect
gdi32
CreatePatternBrush
comdlg32
GetOpenFileNameA
shell32
Shell_NotifyIconA
shlwapi
PathFileExistsA
ws2_32
__WSAFDIsSet
wldap32
ord30
advapi32
CryptReleaseContext
ole32
CLSIDFromProgID
oleaut32
SysAllocStringLen
comctl32
ord17
gdiplus
GdipFree
imm32
ImmSetCompositionWindow
winmm
timeGetTime
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 292KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 17B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MT0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MT1 Size: 4.1MB - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 364B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ