Vy��[�cH��#�S���A���W aco;�j�אʢ0��S7��/�Ճ�G�`�;�������IN��O�0"��݃�ꑘ�-^�&��(? ��G�BW[�]C��~� 0���NeC�ڼ�D���v���M$q�����ga�xN�;�� e����X^�Yy_� �8��<N�t@�-C�[^|�hM��SgN��,?> ���.�=���J�9�%F��ۻ�@��Aں���H�_����S�?�����˚�7Tl�$�]���s���2\̏��w�i0X�_�-U�-r�\3�*r&��k�rGA~��E5Z�d�yX������-�qF�bTb����~�|BT=zV�3o�����>�=������ȣ�,E���^w��#H*�36��U � ��x�An��c�zj>�?z�vb��\�zo�wﲞN����TX/�rfR)�L�.\;��d? �0��~z���˻�T�Pz�o؏'(���̯�E�8��RƔp�$���q�>���\0�&����f�oN�w��[>�����\[}@.�|P��֯v��s�/�9�펟V�Rы�=#O����(��T�n�O�2"��.D��nPi�QP#Kot ���Ű�Vÿ��ǵ �oe�miH���hd�G�W����]It�n��{�����I3��X���v�&��Q�^P1Y}�eV�?�+�ݝ��� s�zO_���âa�|�5��G����s�H ~�b��.�|c�#�w=R�lD�L���n�53���A���8;F�z���o胚� �{�!���7븓���zK�%�s-�`�P@�I��n꜏i�@Jv��z�_ރ��1(,\q�ا ��d�;v��«���Z\)���CI�2p���\��*A�oW�Rq'ڍ�l|�3wҸ�P�zx��d��^mQ��_��o��m��.� =������'焚�~ � b��VJ_��Jn�����Y�]`��6�}}QuB�n�C�h��R��;��Wkszpc��Q�f�*��d���@)FxМ�����W-����m�T�6Ќ�>�)4U����UHTk~��ߘtъ��|��y�8�q�f꺬���Pk|�@���Q��� u���Ώ�'�5ϰH�0���m/�LY��OM���oqu��f3R��>�����+@ƅ�x@s�\�����5���6ʿ�B^ �Fa��a ��s�s�������z�nl� z�x;�r��R�}���G"%�Y����d���o@���h1�`�@e�P�UMA�^+(�Pa՝;�Q*��O�L���'�:�b�.�+���)r���c<D������'�_"��� B��9�U�� p8 ���b��ۅ�[bZ���Ǚ��{��;˺#F(�E�l���� ܕ��'w��ny/�s�+H%+lL��^�^����D3���wީs�~�'9���l�m�%�V4y8 ��p�&j����5�����<�� �$�b���O�G��!:�~( �<�ț}ɽ�M%���:ؐ�F��xb�[Xd�O��fo.����,��В3p1�e�B����!�K#GL�$\QQԦ�VP����R��ń��� Y�u\��T�����'6]���0nnsl�ѣL���k G���5`<�F���l�iV������_����t�m尅������չ�I�[�� ��$Q�z2� tOi�Alle��`C]2�����/8��W����ί�y#�����[p@9�5�4�����S-��D��\L�'�9J��ukHn]���@����R�Iê(8ԤbS��=k¢�p^�%���5��p���86R�����l���4���w��?��]҈�{-o��~%I>�QxUL�u��Xr��>�M��9��d<v������vxL�R����'k.�]�`f�fM:�ה'A/!��.�rB�3+J�<H�a��[��o�:�f�+�E��Q]&YB��=�!əL��詍���9P��^Oϣ�h��*6 �;V�v4V4��Gf/�4�_�@��O�� �����do��C`����=�i���kF�@�351��s�g�3uR4@�2J3��(�����@];"ͷ��6�L��d�2�_�]�o���`����[�UjKBg ��&`K�[4X9��Y�7�i�f3���Re ��@ҏ��ǣ��)�q�Ӿ`z��t��\;�m�{�e���)������t҃��p��hv@��fjx�rD�_"g���)�����/UQ�l�$�q,*x��3�cmAr�@@>�6uZ~��W'�_*�)�RK����� ��.�di��q��������W�E n���[QY,��m_��l����+�R�}�x���@�!K`'�7bu���������-~���տ�*�oxe:�<�6�2h��u�{�q��m��s�p8���O���d�9`��2�ǝ���YYX�b�cI�����<�\�D�D�}�v� �<�N�q��V�:5��ؽ頫�Y����v~}{�\�.��C�H�¬A�%�]���'���s ����"�� #'�ӅD�()�8�UD��}��5T�k$�uRC���@\N���:)_{��-~�.BLJ^�J^c�2};��"�u{GW[�)��XO%�,�@<�����{�ѓlŀb��&�H"�-`)�L�'���+Sε F��?V~,~��&�؍ �}H>��C+�]�K�;�XEns�"o�P�s-s�� �T�� N��Ax<!ܴ��~ �g�~>�d��SGЖ�Q�#`J �n�|�u콰Ƀ���e���n�jڕx&����!�̋x�����d���7'@ �����p�HNV�k5��r�7[��O���~Y��U��^V9R`�q�X��`��m�#�X����Y��adp�� _�e�}cg��c�s������x����P��e���r��S M����D=B�j�R��jT�R��lF�[Iu�9��{��j��� ҹKX�G.����@�ц��kq�O�X�HJ�� '1Ғb �H�����>H®?��m.���h���P�H��!?q�:�ۤ����cϣԝI)ǯ��kJ:��M+�
Static task
static1
Behavioral task
behavioral1
Sample
7a0b79f44345f15a9ed6f14831a0fba60fb1fa603997348b0557c08509faf24f.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
7a0b79f44345f15a9ed6f14831a0fba60fb1fa603997348b0557c08509faf24f.exe
Resource
win10v2004-20240802-en
General
-
Target
7a0b79f44345f15a9ed6f14831a0fba60fb1fa603997348b0557c08509faf24f
-
Size
4.9MB
-
MD5
9d0d01b01d02b0b287dc339ef07e9fc5
-
SHA1
bad84d018aa4329034a73714fdde47189b3bbd53
-
SHA256
7a0b79f44345f15a9ed6f14831a0fba60fb1fa603997348b0557c08509faf24f
-
SHA512
e71635717733cb0fa9491c6ba633154114b9d2946f72885716170a508d429d3e6b8ca5d44189fa27ed65cd46222a6cd2c1ab7affba94d4df6e7861810702bbb9
-
SSDEEP
98304:cp3R7BjbKq0NEjlGbgVeY1q9aRsNCQRU2:gR7B3v0iDVRqusNCQRU2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7a0b79f44345f15a9ed6f14831a0fba60fb1fa603997348b0557c08509faf24f
Files
-
7a0b79f44345f15a9ed6f14831a0fba60fb1fa603997348b0557c08509faf24f.exe windows:5 windows x86 arch:x86
873edfff01eafb8a04b0f8e283bfa622
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowTextA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
ws2_32
WSAStartup
shlwapi
PathFileExistsA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 310KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ZSRDXCFG Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ZSRDXCFG Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ