����<_�(�M���?&�� ���8�F;�ԱM�:J8|F�"�f���)�+�^����c�����Y�Fxi��Z��ݷ�"Xi*�#�t����)��C2��`nw���}��������N%� :�A��a�}�IJA�����/��/��![x�<�(�`H^V��p��=dL� Uj4���[��W.���K�"%�b��ax~�/�B�_v�^�`���7�U'QvX��d$���`Y���hu0xrO(�O�Ed�D��|�ȞFh�6I�~ٹ�˖� 9��~$�XH�6#��Nv;燴S�%C�^�\���ƴh�w[�sS6bp�}Dž��Hs�MS��w[����jΕ{qS�".2ß�,J.��,䙁Y�('^A���ZY�=�-������m�jK��毎�az��#�!�nF�����,cݗ ��[�Y.�ސn�r�%��!�߹*�x,�1f=YS+���{|��,%�/̻�@�;��]���b�c�S{� `ܝ,tX���� X�����~�&鑄`ZE�p1� t��%C�ZV�I�!U}&�����1�p �@l�">P10]�����*������;�%M�E�Y��o�pl�y�U��C1�n�l����X]�SϪ�@��{���s�~�����'2�v�x:dT>w��!��/��dj����_rHe�2�����F�0�f�C@�֎��k��B2 ���G�1 ��i" %�?+�kg�> .*��했���Ѓ+ G�Z���lʼn��2�Dr3����l��R�A|����D�K<��e��xTws�#K���1Ÿ����1?� �JuXzWA��6?f�3G�����yLN��L����M�� �nl��W�)Ϛ�au�wJ�D����X4�Y��h~@�t��2q"�;\E�m#O}ORnc������Z?��в�0��� .�E�,�Ƣ՞�Y�+])�c�5QY��h"��MH��&Of�=t�]��3b�r��ew�N;���v �T��r���W vX�)�C��(�(zIF��,B8�X�s�.�Ű���/=L⃜����IGY����J,��"��j�c��)��� ��6'nH�t��\N�:L�������gE �Dh?�N7�T�����rT��7]7o����-ʾs�58�E�D�,Ʀ�������8q�!,>�K\�y�'iD���y���R��X#��U�1�X�>�)-x��r���F�Y>���n�����jRo�JOa�1!��1}t�EP��_De�3�\L\��t���f ��jN�����^�����cِ��l)�����M"^���T�i�Hx�� ��r��2����=������ai�0C_��-9�Ex�X#�c����<��APD��� lf�}u-��W9��u9��ܖ�|�X�q�����qت�Y����G*0Ժd�f�tu"���_ֲ�R�9X�u���䷔�bU�n}X[� c�9�(�N�U]�{"��y�B�mn$��N�1\��d�|��v��a0�5^��+��� һ��BGV&zG�m}#��z ��!U�~���o�Y��I>�T�'1�Q��६�6{W~�?�DB�FF�G���7���P?K+���ډ��%6��t�g&����9lv�� �]e�;I�c�}T�R�ڪ�DN��a��ͷL���"G~���T����ݐ�"eUW�z5+dv���i���~�Z�(��m��{��X#v|[����̤,N�AxNu�Q�k��%Ӟ�����v �Ӳ��4���F�F�$ڠ��8��}�4[���F�������IP���輩��)��c�FP������9 K4b�dVkb"ͻU��_�v(�~|8��áD���G-X�j�El9��ɨ�e�T0d���Ź: Ye���Ui���ܐ�P.�����i�<�d��<�9]��Yc����{�gɺL����mE@���3��_���R��ɲ��<���p���W�s�����X��[Z ��������Ā�Z�^��n�;�5�B�n�c�$��v+'�`���7c�5H\i�.n��A/�%��dmf���W;L�O�4�e�]��Apr7�D!B�UV��N��%|�����λh5u�dP ]���y�Sr�lR���^�)y������Fqb*u �h��FjN��I�Uڒ��:�(�p��q�`���%��6ՠ�<�%1�$�Va�h2�`PW��#G�WM�O��|��Nz{z��Q�(/���]��bՇƥ�l�{�*��^�L�HmKL.z��(H�W)������0�y��K��r�\.h��KR�����<k�Y��"xD_�<Q ��I�N��O1��p�#�������0����*�_I���/b��>(0��W��R:�`X�e���?W%`RЭaG�D�4�I�&F^���/B�=�SDv�ȍ&B��.�@"� D�Y�;�$�u`K�m,Q`��՝�Q;�����ycۨK�~��58X�ųp YD9T�q�D�q����Osi��L�`9;U�y�:^̏MUE>�>�y��j2&X���pj��0"�|r �3`7�S_�K��o؋y�-4Ij@H�.�D�Hx�-S'�'ThM�Кk(������F�M��oʖ�)#+�m�|� �VK���R�����Ѹ��"�T��M�����;�a��W�D \�{[���S�$���xڌ�vkf(LXjf��z�,ts�<���pҷxsfA,����/��W�E_�V�tӒā9LK6\�Iv����:���R�%��Ke "IP]�z�~rC��٧(�"���,�a���j%ڳ��AZU0���Eqlz�����R��;p�����b�{P�_<�V��)���N6'$���2�Ӷi/B��6��� ˤL��W능}{�h1��Ю���go����pqI��Y�>%-<3N����b�7[W�Q����T�l�� �Aeე��NC���{�������#��2�ꍒ���d.'|���jmҘ_4w[�{��q��s��$ŝ�Є�*o�1�9��f�O�3y� Bڠ����q�ڹ�JL6nщzQ�#��T����\7Uw��(>�����;4��[�0
Static task
static1
Behavioral task
behavioral1
Sample
acce6c78497ead8d04d76a532995d58cca860cbfd211747eef11709258d167ed.exe
Resource
win7-20240705-en
General
-
Target
acce6c78497ead8d04d76a532995d58cca860cbfd211747eef11709258d167ed
-
Size
15.8MB
-
MD5
346f131ccbd3bce610b1bd534e0e744e
-
SHA1
834618b5acde6146ca4ce07158c31b2fb6b16643
-
SHA256
acce6c78497ead8d04d76a532995d58cca860cbfd211747eef11709258d167ed
-
SHA512
e97480bed6b724ace7b65bee4bad5d17ec552ff9713549206007f92fedd1f9b2c5b19078c9a83ffa278d862cfaa4145d49e5036283d7b3a1628d9ab998e6fc94
-
SSDEEP
393216:W6CbSC2/8yS5U8ePJFrCj6qO8zWp2gbNh5h0zajdHEnK8:WRS4ySFaFO6qtzG5+GjdgK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource acce6c78497ead8d04d76a532995d58cca860cbfd211747eef11709258d167ed
Files
-
acce6c78497ead8d04d76a532995d58cca860cbfd211747eef11709258d167ed.exe windows:5 windows x86 arch:x86
1a1b220a43765bac29bd9ab343e507ec
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
winmm
midiStreamOut
ws2_32
ntohl
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSysColorBrush
CharUpperBuffW
gdi32
FillRgn
msimg32
GradientFill
winspool.drv
OpenPrinterA
comdlg32
ChooseColorA
advapi32
RegQueryValueA
shell32
SHGetSpecialFolderPathA
ole32
OleInitialize
oleaut32
VariantCopy
comctl32
ImageList_SetBkColor
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 501KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SHWDD0 Size: - Virtual size: 11.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.SHWDD1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SHWDD2 Size: 15.8MB - Virtual size: 15.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ