����a�*J4v~��z<��l���ʗ���Q�L�(����ݖh��Ez�ȀI�v��Ȓ�y_&>vG6��+�Z.Z7�C��%Z7�A���Jh�m�t�Dj�o0 Q����l,���cG��N����������1���Ǡ{k�ȍ?�l�������=վ��I�yY�ʯo�t�]J0��q�/+���%�w�d_�$e�-r��2�z�ի.n)�[�C��,B���'��O!�y���R��4E �n�]����q�.�?CuZ�H��+w�I�O�[ǝ�P �s�mO��k�b}Ƨ��4?��\W� ���_u&M���{ft���]�U�y�Uq 39��%<'�>��&�I��4mO*ZA��]n4b,�vY���ų�n\Ѵ�/�é"��Jtd�j��I��k.��U��,�>�x� ���~Ô6�{��$���ԋC<QPW�oz��P��0�J�((;�Bt7"���y0�����v�����|'��q�����>�0v�ٸ��a���u��B�Y�<gH�<q �N��dOZ"c%��~k�@��q�O.���#=�(W��к���ݎQ�`�I���nc[��_�8c��I�'��a��i��4�� �u�HJ�OK�#X�~X��D��I�V�(�Y�̂f|>g�AFYBGUo�T��/�틪gۈx7��l���L��ͩ�PI'�i0v�ΐ2��@�Z����K̡��P1E�)<0����&<��h�B'i.b��}��o��*�]�GK6dL9]����{��{���qDvUp�p�T��y��أfP��m��n��sJ���։�/v}������Nf5?�xXH��aj�冘s&,�mr3}��2p।c>=�۪�����n�9��7W��0�{�?�p-ݤ�aa.]������$� ^5�1�l\�1�����k�Qn�WC�^�-�9����������>g�P#���T�j�.�t���a��h��X�E��� 8��u������ט��>16dV%E�<��4״����Lrv�~p��Rc��/E������2]��eq���5�����(-EG���wm�Ev�!�u���xف�![�f�1�1����N����D���i��� VR�z��>E�례!�Y�;�t��0��z�Q�I��$�K��~\�B�U$�ʁ����X�tx�ra�eʛ9��� >5�ȁ�D�ڌ .��\x=�T6k��S���xBOz�K��<����'Wa�1}�x�o�j=_$�N.�N���:���� �s���z���o6P��m� �@����0!x��}�d��i�J�!��Jj�f��\Y��ZC�o�5� ��ւO('`��)��}%������T���'�f$$4T�ѽ�����i�APA�}��*Z$e}���&6�M.%*}=e57*���p��FKĹ S��~̚���"�QHjRL6�ʮ��u�2u�?�ȴ�H6���|U��l��&FG�j�~4z`w?FH0Ji`h���/!n���WD^���ɢ��`S"��R����1�?z����'�T��l�h�\�ɓ+j� �J�H4ټ�Y3�c���]���@H�VM���Dq2A�^�,x����,͌&Z��G0��辸�|$�§?�ݱUp�[��`''�l,w8 ���0u�=�!�>i�5/��6E��N��l�}6�#�绳��x ���9����C�=�<�KM�F[eRsz�x������U��(ČVdVK�:�` �iѪ ���l���R�Y���7q #���<������P����[&�A�Ǯ���.��E�ƶ�$F�u�QP�_���9{�;B ��~�-h��%�>��`��R2���&cW�T.@����<Χ���.W�1�����A+n���'�:�����Q"F��T�VO�� �%�X�x��r��~�4W8�[fFj�I՞$/����NH����{u��Bc���>~��R���Y/�I/o;��Ӭ,.�ၩ�z/��g�0�?�by5���ӡ&n����y9�z�0��Z�a�����'�-ML��a��2a�����ٿ�%�l]*冢��J�.�S��۔̨����yo*�������/��*���#���<e�����Nz�j������F�C<��]2m��2Uk;��]@+�ᵩ�~��VV�15-����o��;�� ��q���\���H��@Y9�\oՖ�����9�e�[�i�*2���|�ͧ�l�SPf� |�Yvq:�z9����<��0QD�Y����VeM4L[���{O�*�B�]2�Ҵ��c��_���5����0օ���o���.~�q��$��s0�t1%��V�[�E��aGbvuB�~֪���:8��C�Di?p�6~R��|l� 0{u�~�lJ�\��>�����!��h*٩!4H>8��f6�?���'����x"��vT}��-7~��G��G(G+�S%o��Ik�� �~'��ywx�����L��d߽�C���J�L!:'j7-����ε-'!h앛���A�F��p%���� l[h�-*�E�S]Ȕ���e��t�<�� �Ĭct;�#N��3�a�V|e�p�5|��W�)���Cy������V[/`�E�b�4��~�-}oF\����zp��G�� k�_�k��,��j��1����4])xҍ�ڻ�')#�����*�pԴ��˗}���jEm�����\��Q&L�v�v뜽ǂ�ȯ�Xdr�^ǐL1����`%Yp��.S�2�:��In/�F(j�e�y=q���>r��X����IB�GϿWGeG�O��HMj���+�pO�E`ÅXo;"G�%O�Ƕ容n���f/�o_֞o�dvCo�)���am� ��aG'_C~�������}��Sw��(��=��p�%L��35����)�61��^�3�4W�Иx!6[Ʌ�������U}�Q<��%ˆ�O��`_��b`2d�ߎ�����[Lx�WROc/'}丮�`�j�#Qe�eqH>`[M|���X+�-��Ey��a������qf� C�.FSĦ�@�L/
Static task
static1
Behavioral task
behavioral1
Sample
8102a6626ea40d6e87cdb90a59ea5b8eea101018dedfc64bf0cc0e221a0dfdd6.exe
Resource
win7-20240708-en
General
-
Target
8102a6626ea40d6e87cdb90a59ea5b8eea101018dedfc64bf0cc0e221a0dfdd6
-
Size
11.8MB
-
MD5
ef9ec6b32230d8743ea97068d9d0be84
-
SHA1
3c15892440207557fab083eb7331cc8e5a99becf
-
SHA256
8102a6626ea40d6e87cdb90a59ea5b8eea101018dedfc64bf0cc0e221a0dfdd6
-
SHA512
46c06bc66d490f09b48d5cf810f0d29445c12c297c58eabe85f5db60839f2aaee38a37461a96710220133ffed0c020bf893691f4d367717d74b14653681f6757
-
SSDEEP
196608:KT4SpHSEcfXMMb8B8qvkUhPXB+MmMtGmjHEks/9XbTLNrQdJ57ut3WWB:tSpXcfXe+qvks5+8knEC/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8102a6626ea40d6e87cdb90a59ea5b8eea101018dedfc64bf0cc0e221a0dfdd6
Files
-
8102a6626ea40d6e87cdb90a59ea5b8eea101018dedfc64bf0cc0e221a0dfdd6.exe windows:5 windows x86 arch:x86
7b8a2dd6dd8a1e6004e94987fdd4c3ee
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamStop
ws2_32
WSAAsyncSelect
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsIconic
CharUpperBuffW
gdi32
ExtSelectClipRgn
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
UnRegisterTypeLi
comctl32
ImageList_GetImageCount
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: 788KB - Virtual size: 785KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 104KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
XuanWu0 Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
XuanWu1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
XuanWu2 Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ