�����μq"�]��v�����8=N8r�~��|���.(yF�G#��"H�'���x7@?�)JtMj�R*���v���w��׳��Ts�?7o!Z�Ɇ����B6�Bk��~��=�ə ��v���é}� R�1�I� �X��%S�il��1;�tU�Ū��3\�3���]ڿ-�7`������<��غw�z}��-X5���fw���Q��m��RI�!B�\������=c�o���C�Q��h�_iXi�"ds� ������.�����)6��!Cp_�s��+7�W"����#�X�B�7l�5��'���~Ts�"o���|>��^�N>��~.i�*S'����l�V�E���p8R��:*^ �LNڶеb9fE���%�P���N-2��K� YP�l{<nP�' a���il��\u�k>�w6X�����v ��x H�4�"Ò%����s�Ҙ�������T%Ȳ�o�C���3u�Em..�_�^��-�"U�!y��7�9��-�Pz�MKK�)qv5�X�4��p���>�բ�8Ϸ}ts����Ci��,��"9h��8!��2�`�ϋ/{�>:�A�}��V =}r* ����sRV7�\ OT��;�{j�`i�k�,vn`f:�|�O�/�&g.Б'h�x+R��2�'��\�j,P�_��/<��5�j��i��(��g-�y��hk���m�}bb4B�_�:ҍ���֕�fbB >�u�)�W����� ا����*[�~��ܶ~op�IFJ�r�N`�(���%���6��յ!���} jC�-�J�&�9�^4�y���Yw���V��HH7n Ɔ���Z��B �H}��X'�����270E�Q�3>@pO1Jq��{�<���+˞f������D#�w�>�B,�B�\i�Ġ�8g&P!�|@M����X�@s_�]$�C9��ϥ�V{���2� ��Dz�C�wN��&(�&�cx��ރ�^��0��8�x_�g~K��^\�FH��3F����Q����@��:{3���Wfz<iI�,����5��R�}�Ԍ_\mz���yy��W�����,o䧝oI���X������Q�:bNLH�sW���t'�jk2JD�����X�4�����oU�(�sN�|�Ǝ�����TRF�T�B@�!��J.���j�B|^��������9�60��B>3�? �M�/#yeM�q�c�br/����C�6��"s�G&���/�|�1�Yb9���κ���+����c��4#�z��a��l1@��ʇ�-������D����岥�P3��0��ZQ� l��ေ2'��> N(��冼8za�ήu�V��T�K�r���a����EQx�UVR��Y�'���/�r���W����k�(��X�|�pu@6�*����Vn�.+��l������_P~�j�/E�n妕)��c�%�Y:Lk�m���Dp�%�K�SC�A��l�1��H/'0�P@~�"$�������3�� P5��� �����q� [���)��1�[��$��T���'�̞%�F^����ic��>#�g�e[;Ol���`V��5Z�ڸڒ-��b��_O�o�� 0�^ i}��n>;F��p\���&a��.~Ҝ4�-�Gp�i*�bA��D��:��4/a���'m� bD%Nc[V�w(����,��q(�o����9/����2��_���0G��_�e0˜IOdX��6� ��;jW� �'3�t��J&Qw�Hw�g�@���`v<��6��>�_ �>�҃g�ݧ�T��l��� ��^��q�';�(�p����Yy�HM��)��31�x���c�~H+��y��:�����n�S��m M�N�$[�a>���}Ƒ�&�� ��G�o`\�6����&c:1Jj��rv!�!�bSV}$/ ƽr�Q�[O��:��՟^�7�L=��|!\?E���<�?{B��8���=+u�K�D{0"��M���;�%:Þ��#���m)V�M]�v�m���9��Oe2��иNd��( cW�\j�J 'ese�6&�:��Ü_R�)�)cʭ#=���N?-�'h�)���Y��f:XN���q���%�Ϫ��a��I�����cPbo��m�����9wXO}�3�������G�5���[�ʹ���A����x��A�� ғn����)wmV���w���O�$J�ݚ�,�p< b{"���]rH8�|��䚆"'-�$���h<�6K����<خ! ���d��@w�Pz�X�^1��@�@W��y�2ĕ����*(�@VX�9z�xL���|H7��5����&�H]}[�u7A���� �%4�s%ֵXh��V��Vf7�P؊$�Y�� c��^��s<�[�kM�3�~����q ����|GMn�|IE��|� ��UkGy�>d��>¹Oռ8u����kz)��Kq�1u8\����w����S���1\�c�WL.�'Ƚ{�.�n�ý5;$�$ljsGnp^:���W��H��K���zQ�Q*q��*ѯ����`�� �����I�ס�Gh�<�FJ�7���g��7�@��R@|�l��*^�����m�$iN��%RA��������+`bh�j��ی���γ�{t��d���}IM6��ާn� }Q1�>����u�5�i�G�l��k�r2~a��1�CA�C�J;P fk��q��1�@�oh�rS����.7�Y�=[�<l�epV����{�^3�!n%~�܌�����M �����>l`���:9KR�9f9��"l��%�o������ �"S��@?v��"{�%d�VE��r�vi�����9:�Mw�|�d<<]�&�5ՑD^��˰�C���ϱ��=JL��ҔK���N��Ѝ�И_4�seKۄc,���u<&����H��0��E�#����y�Z1i���T�Dlf1�o�m�*��d��]�X�T1\_�ϩ�&ͥ*ѥ� �q,�|Rp��(%����V��E��P��1�q<�U`�l$U�îN�s��� =�r��0 �{W�u4�^��I�#q�'k��C/�n�hI�4|�� ��
Static task
static1
Behavioral task
behavioral1
Sample
11a3fb8ebfe588fe40fe1b6448e1b6a05440e5bfb3bed5c2a4d5506c7cd156fc.exe
Resource
win7-20240705-en
General
-
Target
11a3fb8ebfe588fe40fe1b6448e1b6a05440e5bfb3bed5c2a4d5506c7cd156fc
-
Size
10.0MB
-
MD5
3ff3882e508971a1f428d24a5d19255a
-
SHA1
781ccb6bd195021de3416ec4ff37f3658ff0b42f
-
SHA256
11a3fb8ebfe588fe40fe1b6448e1b6a05440e5bfb3bed5c2a4d5506c7cd156fc
-
SHA512
02a00898988d5001bad56f7033b788bcae610223a2b033c23abe0926770f63c1e19c3af5604c859c49b42180425b90b90e29efa6111a5a48ffcfbc5b2ebe32af
-
SSDEEP
196608:cKogZT31pwWid4zYDTW9VRRRKFibjsv/2rZLL3rr01Takvz0UKXYhNxmKN/ati:cBqTELdW9RrsvuRrsTtL0UKuNN+i
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 11a3fb8ebfe588fe40fe1b6448e1b6a05440e5bfb3bed5c2a4d5506c7cd156fc
Files
-
11a3fb8ebfe588fe40fe1b6448e1b6a05440e5bfb3bed5c2a4d5506c7cd156fc.exe windows:5 windows x86 arch:x86
8d4c523b337176d45796d6db012ee730
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
SuspendThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetClassNameA
gdi32
CreateBrushIndirect
winmm
waveOutReset
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
RegCreateKeyExA
shell32
SHGetSpecialFolderPathA
ole32
OleRun
oleaut32
SafeArrayGetLBound
comctl32
ImageList_AddMasked
ws2_32
closesocket
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 820KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 426KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 330KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nd50 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nd51 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ