A۴(�))hyV7h:ea��9�z�@p�Y�����P��!��:��&�/����|Ŵ�����F�1��q�<�� ��!7 e<�/�,Z{�ݳ���h��1O���X� �zd �WT|��ֶar����.T¥jN��R��f+Ix��E��i��ӚU�l�=�����c�v_ �L���E`s9��?ݝ�`���5��h�"��"�t�I��d�#�XB<}�:غ�Z���i;�_�P>�}쳔�.����i�/���q��;FC}��WQ�S�յ�7Z� �.)h�e�˱�ˬ���J���tG^n2�F������ч���<�X���,B$��/U�4�a�R�?����;��mI7~�.�e���\.��z��S�]P�d�Y�^N���x,�)4�y^��wpZ ��<�#t�og#~��}��\g�r��= $]���~@�h3�z 6k���B����v4�dU������T[p� ��(�/����G+ԋ���]�N-�-r������qc��� ���� 0��gC$ T��z��9N��#������n7!u���!��7���n��@ ɉs�l$cte y�k��!�K��恐a[�8��H!�2�׳\-P��L�M��<m.�W�v� ��O����䑦�I:@C����f��ٯK����MՏ���43l=��/}��F��}�4���N��6M2�)�Zؕ7օ+�Z����Q�T�������F��eI�٭�6-��=9�_B� |os�� Ż�.rD���BHc�1��u���*��h�EM�k������8+m�$��%EaZ�˱7y�\���h)��`�ܾ����:�>YBDq^A���c� �uŵ�ޮ!����%�03��6��k������O:��lA�����c�߅�[���\�נ#�85M��f�a��t4�v,�@<M!�Ar��k[�kr��q%�c-��m;<�ѱ�*�8Z�ݠ����~n� ǵٺy��c(w r��K;2s"��$-= ��V�Qryb�>RO�!�e� �q7��r�!DR�eh���ةVz����f�/eOf�� ��8+��o�������U���<H<]r�ֆ��1�00�UO���t�+~ҧ��>Y�k=���'�kb�? ���l��pw:nO�� 0p!�d���W�M*^��IZ�im�2�� ry�uL#�ü<�H/�f��kmv��u���x~��4ܼ�L�|��61�B-�5�QE�i�r^��l��i¯���<���+����7�d{o�h�%Ǒ�D�^ե[��|�j@XQ9`C����j�X/�D�8X�O:yO��C�>����q�(_�S�n���ט�Nd`���0_|t�p�����D4�K}-{Hiĉ��v���%��*��g�8�7�:A�= 6�����v�t��H�_�����aP���0s�� 6 ���c��q��2�*Od�����AV?�������w����g-�F6a� N����H������P�ɵ��H%�rM��ݝ���n�%�-��ֿ�縹��Z̧��^q��y���c駓QU���"e_5���V�T[�>��p�¹�2��3�C����&r ��6���@����]�Q9��D��/W|��,� ��$�����]�J>���%K7��"1ڶ���ltg~��K��9rT��71��Mۇb-O�-��ǵ�M�����x%h�&XA2�j����+�������͵cm���&V'��$�2V3���io�L$����������+r[���{8qm}��V ��h���L���.ތY������Or�F���^�e(�'0M��]���Bc�N�0x�{W�I .��3���ث��C��q����0ZV�x:uG��/�D���f¨D�(�eʌ��t�8,��3d��~g`��+�XOS��6(��AF�]�/*;-�C��^�|l�7M�av�뉰��].�fw�wSh?�l)�jv�:#e������oܹ2��CF0�i�Jl�����OR��U��I��<�����d]���N:r0�V�3�2h�k�:��\�7��#pr6�e�"l�(-:v+g�����/�ˢ�t��_�ѥ�Fȥ�:��nu/ϧ�j[zt�j�Hd1���CKt8� K�X�������V5WI�F~�M�0)�� �`��;c�:�Zl�~h�\2j�@RFc�e�g$xP�RίZ�I�3�Ri\�^E�s��k.GĨ���D!K��dȾ�k��U5l�LM��0�5�j���3d�x�m�7Cj�j �E��}��R��ޒ�:$�ٵPRt��+Q�%�O���\�0���J>��y���g���ӲwU6�� #�,V_�v�/��.�ĒnK�y_;�e����ѸF��%.�y�a-��L���w7��)��[ε��t����㻛]�4,��%Q9n��}q�g�>zD\�u��hab�@������(I���8,W[�Y,����=�����,G`AF#�kJb����PlV�z�V3����F�;沘ˤΛ������Q�1�*�������y�����?���p��+�8�Fz0��@>�T��=_��?�c��$ �nI|���W)�D��M-���~��-�=��.*-<o <_���U��ƚ�vg)�0���{�`��>A���pg�5��/+z��*ë��+H��J{��]�� ����庠!A5��((<�QEw�/����`�G�*3b�K��%�Ȉ[K%?�ߢv�+�(�hCv��X��x]�1�B�f��?��Tx�=G���2P]��q���n��s�3�����])���+�F�"�I�"»^��?���G�-Edԇ_��ҩ�O7��ۻ�e��Y�488S`�&���h��0b�[��̱�]�6��#���oҁf_�|͈���3x�E)"�߅�EV4n����Y�!�V��y�n���i�/O&sv�d������qK��TW<��ȑF��ywD��c6�R����� 4氾D[��AV~�7"��/�NVE,��D�So��#���S 9���;��IP��i3�茇`�s���#8U.��oiT���v[�
Static task
static1
Behavioral task
behavioral1
Sample
7a8ab65b7f2c244501e4d3c28162feb0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7a8ab65b7f2c244501e4d3c28162feb0N.exe
Resource
win10v2004-20240802-en
General
-
Target
7a8ab65b7f2c244501e4d3c28162feb0N.exe
-
Size
2.6MB
-
MD5
7a8ab65b7f2c244501e4d3c28162feb0
-
SHA1
001615c81756487351f6089550147177abcaf903
-
SHA256
825e2d4897fb9ed9fad70d24b6ec8d0279177c3c069b082c66fc2df5b6932547
-
SHA512
1d6e447e405f189ca9a55fe76470c9ccf0fb2fcdb4986f91c3e07f8ebd78f16828c36dd2bed7f3b7dc48f9d9ac181928fefdb528ba03e2a56751d5cd93237d95
-
SSDEEP
49152:BNNNitw4Q6yrhSdKqXdSpefdA8Mm6GUVF7HQ81MCfWf42TP2ONXwlkA:ityBVgKXpefdABm6GUbQ81MCfWfN2sXm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7a8ab65b7f2c244501e4d3c28162feb0N.exe
Files
-
7a8ab65b7f2c244501e4d3c28162feb0N.exe.exe windows:4 windows x86 arch:x86
6bfed7760a07dc4939ea7b15e0a2ae5d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SafeArrayGetUBound
advapi32
RegCloseKey
user32
IsDialogMessageW
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
SetPixel
version
VerQueryValueA
ole32
CoInitialize
comctl32
ImageList_Destroy
shell32
ShellExecuteA
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 552KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 19KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 15KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ