��{�k�7�gP4�W��M?*ש���;,��������B���t��_tA��v�vس�ǒ���yOw�[-�Dd�b���L�!����d僖��_�d^��UΜ'IgVcT.1\���BI�u���9�b�É)1�-��vL�s�u* |.ʇ���)�Y��⋃l��MA�.��Z(��EdƮ�Ҹ�?����1��y�\S_ݮLN������R��Z��oQw�����v+XT�����(��*I���O�.�0���&c������3�D>�H���u�h�:y<o��7�c���#u#o����ew�-�'N�oj��o��������Þ:"Y�&�!@���al�i!��)Ld���^N<��dvP9�Z�n*jUY'� }���,��%}9]Q�֬�P�9!% ��t���w�΅��>�Y��XK(>BU@�{�V�Z.>���0�a���S����ך�����*�8��m��@�·Y9��I��ߑ���[�.>�;v"�����7����YGy�� �!��̑�ȧd2T�)ơ�I���H5���i��)�;}h���� ���ri���� b�������Y���d��3~���il�heVR�{��ۀ� "l�@�����Ir�(��Ym� ��h�(�Q��/I^��6�e����O��ɂ�:�]f�;��o����%I�����1a���r�xr8��3�[J�G��M.yͧ��{o��<����Z�@�VƮz�� ���k���Ӌ7����!Le��$��$�{�o&TAT>�������D�1�=]zA��[v�����GPw7��d���|@(�����3Ќ}�k�;O��co&Y��_�jT�A�g;��F�o�+`��I�;�y1���J��8�={�F9.���p���-�ڹ�����H��B1���%0|��:���7#(��t�`ރ�8�10�:����J���`�T���=MSV^� ����ޗ�x���{�ҏ�������7p�`��$�(*�_�됴�sd��e�fx�eS^@�ci��P,������Xl�̶�����A��� ϦHESHz��;�������'g�(+���~ k��U���q�]�{�N͜���*i�������9�'D���B�\�����2��/���v�*��*��j��^z� ��m�6�� ����I6����i�hLz��Hs�[Y����M.�Ėϊ�Z�wl�Eu�b���D�K_���z��j/�gA>� �^���s�,l M��捅��fQ�ܯ��9m:�O����d�'���K���?�+�3���|��D��|��P��W�/w�墄���e�����b���Q��gd�"0��W��ef����d�Gh� `���Z>D��OUA}#�r�����'HI��H�SD���T�\7ĝ~%�����ϝf�j�#Y~LR�7���t`��X�P��w��w��oa��+�Q�1sƱ��H�P_���˃w���7����+����)���F�� �!�9}%v�-��+'�K�ޡ�6�:�-tE�~ߏ���q�\ƙ����ң�Q�'�73�-� "�K�(�2�MP6Th�=��u,뀎������kڙ��w��P� {�'�D{��`ːtB{sw�< �t�� m��!,(�����p2�S�"l7�LĽ��}�J�6`�����9۰�;2�e&;����(o) _�= ��:nF��<,���f9�g�f�ԛ���s±Pj�V���6g���[�vo�m�������*����E=�z�e�lJ��� ���?��ѧ��;7bu$t�<E�a?������WV�q���e10=�/eh1�2�tZ��\���k�-������&b��FH;|���F�G��}4�S@��{�%f�x�],�s]�<*���T� ��L#�����%���z&!s�k)[oe��A"`����'�n�n�OmX̱G��6&��a��Am$����/�Tm�!���)�������ɢx�SΙ��2-� ��!Gu���|�+2���˒�� �3�B�&�u�%!�uu�Ĩ�<��7&�jX��ؗ� �g����յ'����R=���� ��������'�/>25W����&��2=�ÜC��K�c��� ��4��h'Q���k�F����f�N�昇�;�n�.�\�\c.�S����5A8��skG�vcK]y�)�=ރ���a���'"�'5yoV5���8!2�[�l+KG[s9�o��)-0&�8r�� �(< O�I�t�p1k�l���K)�׃`f�� ;��)��U�o?N%m��Y[�oL5�߯�#B?�%��7�ڡ�u��e_Ou�CL����F���K�@��� ��B�>m�8�Ѫ���neٲ�3]��pz��|+ؚ�Oǯ�~&���%�`�Z�X�%?&IN�kC⽖y�*�0@gT]LH�DpAE1�J_Q:͒�-��Wo3NH� d�ܧ�G�0�3�հ`P��k4%l��6B]= �[=,����6q)��L<ky?��_��C+�3&��}�ZMJ�$��+�M6��r��S���8.(��2�k���4;���F�{N�s����Q,U���tM�4cA�m�N�fJ)Q~OB����ߝӐa�����r�����8���|./U�jO|`�!����'�װ�,:E.m_��̢��'Ł���D��yaHB������Eq�V�8��� �W*ƃ+!&�JT�w6����ҥ$@���'���V��S����Q�����d �&���k���w���)�7�v��#!"�Y`��S̺Zh�+�'��h�^���K�"ՊhA�l�Y~����mB�'f�f�_��˖퀪u�������(�p���Yk�^���i��Ŧ~�nD���!s@Zw���s��0��Ej�\��.�ڹ,�4�̂%�2�>ؙJ�}H[���;Ҹ�|a�;�ag>1l/� �E���ڱ�/Ȋ��--�1���f� ���U,����ƴ���?U�g?م���C��c�p7�v��AX�M��L��I�s���`�oX^\�������O��@P6i�pQ"�~RQ�Ug�<.M%�R��
Static task
static1
Behavioral task
behavioral1
Sample
0c3056aa1f4960ff0a2980303c0d6e842175cb1cb9bd01c6281054c16a03f750.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0c3056aa1f4960ff0a2980303c0d6e842175cb1cb9bd01c6281054c16a03f750.exe
Resource
win10v2004-20240802-en
General
-
Target
0c3056aa1f4960ff0a2980303c0d6e842175cb1cb9bd01c6281054c16a03f750
-
Size
699KB
-
MD5
6bb17bfcb2ab7ebee182d3f73820e183
-
SHA1
daebb6221912d844c0888f10f06b8532dd0730b1
-
SHA256
0c3056aa1f4960ff0a2980303c0d6e842175cb1cb9bd01c6281054c16a03f750
-
SHA512
5c674f109f9b25525f4c5753b6a431c4c007d2dc794cd8b50cf5737ffd565556344d556cb517b6bc847419a91f7961ccaaf11e0e17793117bd7b4d3574655073
-
SSDEEP
12288:lVgVaFZjRfCQEVNUx19Jc7idXF+XJEaazodx3cXWxYtzQ:lVgW1kXU3U7QAXKTMLcXztz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c3056aa1f4960ff0a2980303c0d6e842175cb1cb9bd01c6281054c16a03f750
Files
-
0c3056aa1f4960ff0a2980303c0d6e842175cb1cb9bd01c6281054c16a03f750.exe windows:5 windows x86 arch:x86
cc00fd2e81c8881322c42e58158d76bb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
vhookf
?UnmapDll@@YAHPAUHWND__@@H@Z
kernel32
SetHandleCount
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsIconic
gdi32
RectVisible
comdlg32
GetFileTitleW
winspool.drv
ClosePrinter
advapi32
RegSetValueExW
shell32
ShellExecuteW
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameW
oledlg
OleUIBusyW
ole32
OleFlushClipboard
oleaut32
VariantInit
uxtheme
SetWindowTheme
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
lyrgmkbt Size: - Virtual size: 370KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
fmhnonth Size: - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dbmrrsoh Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
uhayvsps Size: 20KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
mdqjyswu Size: - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ihrjcyod Size: - Virtual size: 385KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
aoyncfti Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xbmovgyd Size: 677KB - Virtual size: 677KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
yciqgwpo Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ