���?E����i����(�����}��P���<��y<tg�L[��!�������B�=K�o�Ĩ��`�@�I��_���mG����W�!.���O�;ZۏzD���db��~&�2�A�H�ւ�ZS�Pg��灾�sr���P �����\ uZ{F����V�!>���0��R��3�'�x��,��;$c�Ipg}��Z��ɒ�C����x>���si�o�a���E������GIC�~}�+%��c�8H��(��ڝь���c(G�!t��-QM��ᢷ�?���Y�|�V�e��^������C:��i��&�w:�ƥ���|���Z�q>6p������=;Ȫ���ݟ�m�I���E�@�N[_��h;���!j�HX���#�&l�^AʔuTҢ��Aq�nM����,{T)���ڶ!7���/#.��)k;R\���!=�Uh� M������mZLc�g ���1��q��S��M�iM�� ����d��"NQ�2s���g���HO[�✢�����bq�mb�Fpm.a��|��u�8 ��bEa� 9����ۂ`�n�*�æpv���n��%�/!�`I�=Ce�m�E7¸?���v�k���B���4�(v'֒���U�Jp��=ك��R\E�0�|ɸ�xN��<t�RY��h��f��)���ʾ�ɥkVZ�'��t�T)�3:�P"{��@�4r3��?.H9�b3;b��S�Pӎ���zg�ֵ�>�*/e�O ��/�3�F:�}�Ab��p \��S��ms,�[ie��=o^F�>=�|��vD=�>��N3�R�Y�bB��~�=6� kB����S��k�i��� /��}k�����)���Tm!Y�_�dJva_pO ��VV�W[�q{��N �5;� ��������B�j��]@< �$�xv���@�dƹ�W/�K������f]�����V��9�Nv�Z��{@����D�� 9R��$���S��E"�D�,O��UP[�� ���<�qILh �{֚��q��/ыp]ƅA��/-�k6�/q-�����U��e{k�� �F#:�k�z /�M�{!)�41��qxВ$]~jZ��-�Ҡ��_��!��������n<w���<�E@.\���"� �l�Jb��Q��:�E��4��\��̆ � ��9�c$n�Nu��DH-O^F�a�4��J��F���#�QNJiu�[��+)�1�l��>8͐���'o=揰'��푢�aA88�H�)�x����ڙ�ͥ|�=-F�[K�X��JE1 /Z����ދ�cG(S?��/���VZ�(�� 5��㺎��W5 B7���1�r��L̉tw�O\�J�L+� �po�.��"�8�}��<'� 8�����nK�c���� ꑋ��w���iߑ�'�cJ m�ݙ\i�$�M�}[t�P����Y0�>hT�ef�e �g"j ��Bbø5�cR����ܤ5b���'����[�*�d>)�-^5��.��okseQ�XR�|��v�L#37�`G?3A�0�/|3��h��:����Qm��`�paI�D | �V�\ �3r0� I��*�0�rI�}E�B�,���r��/�˱���z��|��WŻX�� �(-q�^���F�UKT�jW��-�I��,���$I]rH{G$xrW4�ɧcy�HVA7��cAz���[��t]�b_���/$*��NΆ�a�5�<��z�RV���Z��C���d����s�#�'DCR)Ј���S x|Z�|Ӑ.�� ���+N��^�]V��O����(,m��32�iC���ؾ]��z �Ǩ��eæ�PՒ�눥��Jٟ�xM�t��e4�Z"��Yش���]��g�����X��z�����(20��[~�5��Y违�n�Y")�f$�>��-��u���H牢�#%on,�+��u��� �\3�zwl�������ໝ��//��2b2:�o �Nt��q;��I;[�)R��Z��3��>G���?[\��]J��h���K!n� \;c�#���wѷI�M��K�d�j�S�4Qk�Q�2Ti���P4i�ĞH�G��;�oQ�N���;L�w&g��xA�'L��H���}���ez�˻�,n4��1Ҹ܇a�"J��jg�_b�����XV%��;&��xc�mǂ�j"*��ꝏ3!��j�u��g�5��g�V�پ�Sζ;�j&�TI� ʨ,�]OA��Ej������&�}R������z��f�����m�j9re�"�L�ƀ%�bWn��_��J�թ�%���e��wt���1�G�i3���/Y��Φ�dxɢ� }�$����lm�E��])�R:l�]��&�7ӥMM ��.)�����n� jT����U�:B�^�P�[�>E��t�ѰUMF�D�l���XߣtY��sP�Oϳ�#v��yGvn�Zm��u�A ����wMŪ��c����������z������.��l����z[N.G�,M��雿������@M��_�3Sm��B����ǃw��l�YO��$Zu��}�S�?e�p�Tޅ/}F�Q4�l"͢lGmڵC;g�{�Ð����er��a������rɐ}��.���;��T "�@=�UhO%��o� �ٓ�w�6�r%ʼb�25�NxT�t���8!���e��q������o^�LB ^(/�?�O������F�R`� ظD`�w.ZPq�Rv=�G�B�{>�����,��P��Z}���˙H����#^0P����s��*��[Дv;;�11'(�E��S\s�1'�Z���,;Ҽ��vB�w�1��B�ƌ���RXPѵ�(�_U�G��TS�=���ђ G�Re�GL}�0�� �t~z�:�{Ifh!�F�n���V{���0��D�X#/O�[��K�P3��h��uG��x�SI1XH/���)���N��#%�(5�g���e�ר�7w�U�����@!�T��Kc�cѺ�Vfb����Ɣ�\+{̞��Xwd�E�8���m=[�'WA���kz�����Bk�4��u,#��x��8G l�k+�壟���!c�a�3-D�v+�05T�߬��x
Static task
static1
Behavioral task
behavioral1
Sample
12942546333137877db19b7b7328a750N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
12942546333137877db19b7b7328a750N.exe
Resource
win10v2004-20240802-en
General
-
Target
12942546333137877db19b7b7328a750N.exe
-
Size
832KB
-
MD5
12942546333137877db19b7b7328a750
-
SHA1
c18c49cf248c8f6c3b6ec7f1ad69d46eef6d743a
-
SHA256
873d1ca0890a3569fd24b53333774c3afc9ba20d0bdeddf4e15c46611bd45b3c
-
SHA512
3a7c82616604ff56fb0f0f37776fe72fbcb23f421364d715b1241dde5a9a4cd320ce3e671d2477b2e68fa662d2c454458974a8cbbab199f140896c31d8212d78
-
SSDEEP
24576:PST1y7kXF6dhjyaBT1e0dq5U47d07qlyXb0DtMCpD7Xhp8RIw:PST1yUF2yaY5Ui072+CtMCpDLQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 12942546333137877db19b7b7328a750N.exe
Files
-
12942546333137877db19b7b7328a750N.exe.exe windows:5 windows x86 arch:x86
9336d7d04a360eb315c5349e8522fbf7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
FreeEnvironmentStringsW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
FindWindowExA
advapi32
CryptGetHashParam
shlwapi
PathFindFileNameA
Exports
Exports
Sections
p0E8e Size: - Virtual size: 119KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
j86vCl Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
j86vC Size: - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
j86vC Size: - Virtual size: 686KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
j86v Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
j86vC Size: 820KB - Virtual size: 817KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
j86vC Size: 4KB - Virtual size: 692B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ