7/0���Z$ee8eIo����,p�~FoK�=��WkCE�����"���*4c:�d�Sb�x!�������8q���N��P�2T�����8�a��j.���h4>G,f�Ǣ9PSf�ÿ���j�d�]�f�d��٣'�?'�Kg��N�)��Y�F�It��_��!�?��ٜ�(�yNnb=1f>���[L-ƁE5#ˣ�K��oO�D��0�����Q��ի/�<�LJS����|��G7�l�HGi�c������E�����2'��:�P��W��Z�����s��/���jٛ*���tJ_Jks�:��Jו������[O�. �~aRo�Y����4�[�t%���+y��!��w�4��t�avm���: ����f3=�ݲ�+��t�r��B{�A�B��s�[�Ϸ&r�ӂ���u^�������gB&k?0���\��bp�� .I{�G���\�M����������F6�V��-o�]~� {�!�S���R�ܥ��&�[��GOp�y����&U��Pt�a_94�I���Ĵw��4��]kR�p����c{�v����k�8d~���d�m>)m���qI��T�C��K~Q����R��z�����N�"��oy�ŋʂ@�$�p����C��%�趽uO��~�m� ѓ�)�h~J͕u�+���֦�2ن =#�~3�)Ϛ6�bE��\k�d^ �ލ»4���/���1:���V|�3�-�4L���Li�@���'$[L�~O�f�� ���Wl�1�0Tnj>�*��0����q6�%�����r$n3�����'B�Q��Jq��By�Bg;����&��R?���nP�\I��@j9g�TG�Κla�����M�I���!��c��G�Y�X|-p2Y)��kiL�QO�t%��n?��)[c���S駮�w�螀mi��ݒ7�� Ve�2���$����l"���"���پL��wQ��9��-Z�~���h�N��JQ�L���6RY��m{�A6{Z� ��?���~�^�< ����f��{����L��C�3��ڕW��b��W�l'�Ϡ��c�P�=Vҏ���)M�����ld2�����y�7���T��b���&E�5/������`H���ѺmR���hMR����s G:�����P~���,�U��m����k¾�[^mq��Y����b����~y��C߮j�dp�s%SB��DGX~4DU����Em%VFu*k7��]��lc��B���Jih-�v��D<c���9�)���ޕI'�T��d��v9P\D�t�!�5ܜ��?9YҚ)�p��V��$���I^��40�x��ZWG`/.��Ԑu:�y՟9�W��r�����Щ�"�/cud]�Yy��7t�;�e�mcXK�r���X��_7E�0��h��_͒ͫ�CCP�ֹ}'Q�X�O��r�J���.'�Z�.����x� ybV���~��`�³ ��=��"���D��+*��wa�"%u �]-��V�� �Z�0�9V"��u�/}��i�Ht�9�{�ndl��d����;����8�)�+��y�td��w�����\F6��6��u:����$�tH�<y֓�|��%�G]���v7x��;�����z� @��-�~�?�v:G������k�ѥ%�e�������do_�����{�����K�E[P���- I�cC|B��9���B�}CM����;�r�ŧ����=����C�ci � ���&>��N�/A�f�*��J��h�I�18Ρ����C�Ș��/���]�B�)�a,aC>_�O��\s�������B P���n#����I>F����k�$�KKg����]���-i ��S}�����y�||t�LlF��6`̱��Ԏ"��A,�Go�Rg��I�� �1zU��(��V%�:����ֽ���0�.ƝR�e�ڹ2��إ2q3x�Մ�xԍۚZ���?S���GpmFS��0�Û2�b<��(e�7]m��J�&+��/�����Pf9�n�S��Ԧ����j@`(q��@pVz��8��f�N0 �����n8�{:70V������mc&k��3M��;��\�X�܁��V�ފ�{C f�ٶṽ�z�4*"�i3���9i�L�������������:C<���b�����yY�֦��]%9��lj��?�jY��C���#�9����%e��Ծy}uZ�Zr\i�@�M["�s�& ��d����9 ��&}�n�E���'��a�E8�@�^q��7u�QV�.��S��� ,����~U7/c#�Y���uH�%q/r��8H!K !H��0�������� 3�V�j�p�,�;�F��S�Ԭ�8�5��.��'{k p��E^Q���3���4n��J�;6Å�fͮ�c����}C����t{�7:V9��Z4H5���� ��X���Q�����Z�K�+*�:�5��O��H�����;8hJ�mc3'�s�c���TK�/��:�L�.7L�z�#zP�Ѩ�"jh�H��UNV���i8�ce~"Q�Fr^(�]ؘ51���9����Óh,4�ʫ?�=s`6�[(� yx��͢����#s��bjv����,�0��z�-��_-@*���&B�� ͓K�d|e��8�z����%�f���9n5���|^��$Ԟ� c)ڊZ�4p�҂0���+��&����;��*ǘ赼�öȇ��*� ��b'(v@�>� 1���EhT����B��<4/�:��Zrw+�"k���j����ؠ�R:g���I�������#���!���OY���� )|$Fa�_��|Ժ����^�LC��f�l����c*Jsu21S���Yi~��T��Rl��4pp��=� "�g�i�Q{��f+ q�����c̢�*ůp���O�4��~ߖ�V՝lHM"�3�o5*{dzh̠��/f��F'6H��Xbp*O*;UZ�����|���g�M���U���KY�Ճ�����:<}Y2���t�,��5cfN��8��:�"DO�����n�f��̒� ����p��3�����6X��Z�����<�8��pg�����
Static task
static1
Behavioral task
behavioral1
Sample
94919121bad2389e3908f8bc995c0b2b80b3eb40444224ec6080167b1c815395.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
94919121bad2389e3908f8bc995c0b2b80b3eb40444224ec6080167b1c815395.exe
Resource
win10v2004-20240802-en
General
-
Target
94919121bad2389e3908f8bc995c0b2b80b3eb40444224ec6080167b1c815395
-
Size
15.8MB
-
MD5
3ef385502116ab644ca2ac8f3451bd7a
-
SHA1
6bd6c6682b08353c09d50dd1f9d44d01216c22d8
-
SHA256
94919121bad2389e3908f8bc995c0b2b80b3eb40444224ec6080167b1c815395
-
SHA512
62679edaaf2d2a01d9d8d8734c79537a8b35afb61ec4ccc42c065c87575303b16ea841cf5e30e33f12cefe3386c98f7d181666b724e329968c6d792580ca0265
-
SSDEEP
393216:VZyCzDBzZ7M3GX1GjO/wwAWgxB6tWwxNnDFZL2l:n/J2GIjisZwrNel
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 94919121bad2389e3908f8bc995c0b2b80b3eb40444224ec6080167b1c815395
Files
-
94919121bad2389e3908f8bc995c0b2b80b3eb40444224ec6080167b1c815395.exe windows:5 windows x86 arch:x86
81e0eb5143288e1509410470c9ab8845
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
GetVersionExA
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumChildWindows
GetActiveWindow
CharUpperBuffW
gdi32
CreateCompatibleDC
ExtSelectClipRgn
gdiplus
GdipGetImageWidth
ole32
CLSIDFromString
imm32
ImmSetCompositionWindow
shell32
ShellExecuteA
SHBrowseForFolderA
shlwapi
PathFileExistsA
winmm
PlaySoundA
waveOutClose
ws2_32
select
winspool.drv
OpenPrinterA
advapi32
RegCreateKeyExA
oleaut32
LoadTypeLi
comctl32
ImageList_Destroy
comdlg32
ChooseFontA
Exports
Exports
Sections
.text Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 608KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.X&Q Size: - Virtual size: 12.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.>jf Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.k:T Size: 15.8MB - Virtual size: 15.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ