�����Ž���^���T���&��RU�w9���l�EXˋf,!`�>���&QE2[iM����ZT�(�t_�\,���`�n����H��#YQ�I�'��deR�=��}-ʒ&|�1p�X�L�ų͐�p!.<%x<����==�9W����Z �>n!{��i�Ϗ2)Lh/�v��G��mQ�a�X�����46���_~�9�9�w%��K����9�i됴�I�ӕd�+� CE��-���'�]<v�u���&��o㠭�g� �̓06�YU q��Bs2MʱK |a�ПI_��:b�H��V�;���e��K�A�fw>��_������Y������C�܌'O�>�:Ae8�\� ���ɚ��W���_+����. u�ِ]�5���:��#�ȁ�]}��I���6@�I/�}��� ����Q�~ˌ2�u50u�����z�ŷ��Tt<}x�~d����4��#}*T�8S��皆�r*�zV`�,�f)�6��6sL�J�O!#%;T�%I�����L��lO����-��#���-@��q�b�u�6��\�w7]��3%X�Z�)eh��Ю���O1�fF!-��j�Ӝ(y|MO��m'6b�7�q=��.���{}.�Ƃ�N��r�� �@�*D��� ]b�rR|��. ��Y��?���h@�#��6��Y�5dC2��7M�%���O[� 6�CҦG����x.���痶钰�/a{P��h-/V̉ ɤ�6�?#쉅����֏+�Rs䊒)E;y��]+v9�Z1���}�Պ�lhp��wm�@�f��ؑ�]%k�~@��$�r��T� �cc3���Ux\op��IC ( Ũ|Jy������jl�[���<[�l~Nq7��U���: k��8I���A�2���`K��I�+[�0�s�rU�X�A��Q����[����a��?���j���� �g��1*�C�z;��/��;���Y� z���)]�"�w���o�+����ϫ�T�'�����HwQyѳ��U�]��H�`�zp�S���>yx�Z9���T���[�g^�n'��~r�א�6gs�/�9*f�n e�(✞f�o[gH}Zm%*��n� ��?�k��e,��^�/T�������j�c�T�V^r���%�wH��+�r���xI�+ڟh/6�w��� `���N����- �#W21���dgiS6K���C�,�m� ���t�@z��8��)�G�Q��"P��3b �[Y?�3�1ݩ�-�X�,��^�h{�������h���$En;q�N�q:���v"�s?GcA�ؒ����_hpc�M[�yQ�m���1�؏+�p��,������_g�V�P̣�vI�R�#�_Pr�J9C��K)�ߝp *�IT`O=���X���? �{ɪJc����Ͽ��9�gsw��Fb�!,c� ^�m�ꃷ6���n�/>��H^C;b���Ѐ�����v����vʺ���-����_0�θ�z�]�E/�!�ZsGD�ּ�H�Y\,�a:��˗qK�E�+~�}���P�n�3"��u�ӵ�:+^,��{G������9�����N�pN����`�`��Q��P�d�tM,J��U�[�<�;��y�(�,��� �p��L������>b��024�ŃI�3�&��/�0��F�z�Ħo� �$,*�Z_��x�E��N��<������池7# ٞ�r ��J� ���;�}�0���7�7]M�|\13��%�5i#���C�y���ƕ��̱�2��$�Hص��<��w��]ԾU���kTޯ/�_ H-'�[��2'S*�����Պ�g� ��V��`�Q�@�&/�<)��~�����N�:w8cԤ�����BC�O$�_.�2�If.���N��|�Ήx����Kw��:8�0��B:�W��i�v��g�ʢ����đ�l��4!xQ��wMI)n~K��96L��Y��r3���a���+��n�����H.����yO����۞�,�����9�U|�<��U��;�>��_�zm���F�����^22��Z��#C�搗�UЪ������˼�����c���a���,vY���Yd���|���$�[ݯсN�˚��`�M�C��~���d?�af��1!a���*m���B�&̣PN�,Q��1iu�1{G qwգ�`�m.R�f՛�o2t���i^���g�%Cʝ��CVʻ'�s�ɋ�:�9Yc�a���]���#�\����rg�^����(@��YP��qȴ�Oj��?� �᥅y����}lϭw�L��c�,�)=^���ը�C�*���2)�7���|�ApK������t�Ϻݰx�L1�=��"x��5W���B�͚����t���R�ڮ��>-*��Ff˲gH6�N�����,4�Zj�A���p�iM�4g �`�3���� �.�qp���Vh����3d^�ib3*��*����}����-�1���LS�S���Kl�[JbD�m�`D]�[H��k�n{� ~��ۇ���1Q��4�������\"j��q8�4�ko���Œ�<1��o6��9X��ą8�y Yb�'zz�[ ��}��c`�]��\Z�f�'n������\8���gs,�0Q�l�c��+@hȷ��� �q�qYv�q��:��wC%9~�A���ٺ��G1��AD�ڱ�2l��?�6����}�R�㾁�w�:@��RIvc�����t=�b�n��>O8�nH ��O���:�g^gߘ�O�$�C�ETTQ&6�s��<j=A���N*�������-R���~Lt;!�AN(��ܟ9p�K��F5��V'Hj���J�u�áOX �e � ۾��] 'z9�ܗ���lA���L��Bu���� ~:�B�`�����ZaϖH�����!�;�4�Zߌ��� gj�:z��m���X�ѝ�XP�zN0�%\x�J����H��{w}E�eU�v�����H��(���� �E1<�x����V��Y�&�tE[-#TV�!���:/k��*<*q��2E����e&�7B�� h*T�q��H���E�&y�[
Static task
static1
Behavioral task
behavioral1
Sample
bb0098aa82beb5629054c391b0efd5463421bb53c7267ba8972caecce7804f30.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bb0098aa82beb5629054c391b0efd5463421bb53c7267ba8972caecce7804f30.exe
Resource
win10v2004-20240802-en
General
-
Target
bb0098aa82beb5629054c391b0efd5463421bb53c7267ba8972caecce7804f30
-
Size
4.9MB
-
MD5
98bc14a610eb5f0ab77e149e7b74a6f8
-
SHA1
27bbdd938fdd6a3bd2b54a311c8d1165cd60b92f
-
SHA256
bb0098aa82beb5629054c391b0efd5463421bb53c7267ba8972caecce7804f30
-
SHA512
0eed0be23be4f631952184f29df83eb7e729e2e94cf2adaa3dce2f4e0113c574f51aff91ea0c08080b300526814e8f66692206bf9122d10ed2a1304148d66d5a
-
SSDEEP
98304:OahLinSkIT4/UUoI02FjregJUg0LttANvK6sj+LoPiZ:OaVi7Y4v02Fve+f0LTAcj+sqZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bb0098aa82beb5629054c391b0efd5463421bb53c7267ba8972caecce7804f30
Files
-
bb0098aa82beb5629054c391b0efd5463421bb53c7267ba8972caecce7804f30.exe windows:5 windows x86 arch:x86
873edfff01eafb8a04b0f8e283bfa622
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowTextA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
ws2_32
WSAStartup
shlwapi
PathFileExistsA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 310KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bnhjsdf Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bnhjsdf Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ