��"pm�Wjg�8)����W��Hb�4��t��~�wvt��\��� �E��OQ�α8}M_��f�����G�ow��j_ ��%��T��_�U>����r�ʺkd��������^|�����?X��L^t���'��U-n{����y����`��*Zh��X�hҀAE��8?k���o?Z�qy�k����DE��>�xW-����E�e-*�S�=� u�� �Fu�Ƒ�<�I)��vl��'�\ӣk$� �;��Y�HY���t�WB�c���+ڑHo��p�`7=��ݺ�6�`}sI�m�Q��|��-����]; \9��Nƻ����Z�������5Χ�0mŌy���wM����m~g�#Jw��C4��m����g�ϩw�`��j:��htשi5aLJ������X�8=ǝ�K�L�(����zrQ$��xڅ&,��^�p�����Gm��|����v�z��^Yܾ( ������7+8��� Ye��%�-��"L�3x�:^w�k���<�0V��!! ��W�d�IgT�F�by&��(R4װ��a���~�[c��@�����t�AU3�ˊ����d�Ƿ��=�O� �iU�y�a�hw��m�%|k;W�N(8��d��ʜ3��7�pM�2��˲&Y�`�������(ЍT�jr]/� Ҽ"�ߵ q�M��[�NV?���V)7�����G6�o��sD��n��@�<EX����ௐE#5ٷ����:� ���ۧ┬�qc}��u�g� dҳV�͏���wpn� pe���KA|��H�$�\:(�"�+/Uq��{ʠ�Mzv�?�w�좰� ���r~웏'���@�_>�����[��Vf��_ ��p]& E)!w���J�d-�U!����L3�#�=��8�R��+���W�[�@�����^_6�l.zW��%�RN�&(���]��c�� o�hBl`d�58�'�_�Nr)<�l�& ���4ufZ�%���i��t�������8���p���I a�O�_�AE����Lhd��|#�xɻ�66�7�z-�u�:�<���6 w���Ə��������'�0�)�H��w>Y��3�th�_�9�d����?�~Ӆ���,����~���L�IZr��.b�*xKy�L;��o�%���i��'H;���Q0Q��w�n�sPM"�rt�龓��U�2��A�#tL,�:@�i�K3�~0���B�L��t��>�6!��۴^�r`�In��i�ɮ��� �Ġ�W����+ K;�A;��Daq2w:��da�;.��V&��I?|�܈��lʎ����E��4�H�l�����yg�Z�������R�'h}���ޙ�Q/�2���Zb�gX8�I��Gi�J���3̹L����CB��� X���$������0&��U��� j�~-Sz+%yGu�~D�N���[T����ΛB�g�GC �E?S�>_�����4ծr�m�kJ��9N�(�� Co7������~���.�a����H�NP��G����`OMP�����ȌH�^��_� ��54b`�g��m�h�`�3|q���T��������l�Y�c_��:�Z6�D˧��%v�ՌT��!�G75�[Eӎ�(��u�x����x�@�ާ~Q��4�����b�WAb�]Y�{�Em]Gg3_:�6���r���;K�iҋ އ�H�������5PX����{��Vu��&֕��:�u���5| iq��A�UwH��Q���>U�7'm9���G�����9҄��� ��JR?Uy��L�=�`'�t�5]z�[�@�xECc����NwO�I�r���N��"kKZTx4�����ݕ9��)��C8�L�����{�$Ҧ�` aHsħ����>C�Ee:���W��(֯����ߎl=�����&A���g/��pE`n.�+DҘ���5桅-������*��ܶ��kyI@��t�?ܑ�:�6'4��|O:HzO4ς,B��#��KL.�H~�sEX������� UzQuڄ��0� K/�k����BO�E�9P�ki�cѳ�����e��������!aHk�����rm˙5&d�e��ⷽ�ө�3�)`��FMI�iB�!���ҷ_�\S�ʁ��_.qn��L0i���"������r��3<%<V�ͪ��M.����Q��c�G �c�l~�\��m����~������u� �^-0�����f<�@'�, ���M����3�.3C~%kD��(��YN�D����Ǡp��T�nIo����1�$����o�+�WIq:mMt�U ����]n�j��\#�1�A� �md��A�x�����g��R���q��2�}WBk���i�M����a�<Ų�q,�4��bDQ��uZ2m��N�\L(�ښ}k:������Yv!�P:�����rd�#� ��)MTk�����5J��BN9�7��к�m��R)�i���� ���4 ��7gz���q��/<�����~�`���H�w�v9�W0p�����Wr,t:#{��m��}�ŀK��� VU�m���}^����\(4Y������j9��-m���Is?� �ρ Ű�rr�~4����=�i���g�$j�x�$�.�`1��W�_�%O��X�9ܐ�|�+Ґ��G�����Q�Uj p�O�F^�כk8H�M)����ٗ�w��$�PFʲ��6y�-HkD#�Dv��d4�-vWo�s��9� ���"�G^R}��٨p$����HE�=y�Բ��<B� C0CQ|t�sᆝ1�~���`s�ADt�ڽR��iY�a��Ͽ��T��E�S�\��x+��L</l��̚\o�ٝ�� =�Z�4<ؤ�����4�����{�ڌ��!�#�0�F�Dn���#�����.c�i�DP�=�4�i�?i�J�����+s��k������@�Mm��J�ɷJ�V� ���X�\4���P�W8����?�'�C��W� �|���!"�����t1���xy�q�J+"e�T�S\,���"�ᑏ�����Xf������Iw��UV>�w���A}r�=\�Wh-�w���"��P�y1
Static task
static1
Behavioral task
behavioral1
Sample
fcf04f9c5fa462263f59243b59bbe33e697f30c56d593405bfbf27fc28376d14.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fcf04f9c5fa462263f59243b59bbe33e697f30c56d593405bfbf27fc28376d14.exe
Resource
win10v2004-20240802-en
General
-
Target
fcf04f9c5fa462263f59243b59bbe33e697f30c56d593405bfbf27fc28376d14
-
Size
4.1MB
-
MD5
ea3b84329ac7c294768a34d27f4c4fa6
-
SHA1
eb12fee8c72a2b1123bb570bef619bf19d327378
-
SHA256
fcf04f9c5fa462263f59243b59bbe33e697f30c56d593405bfbf27fc28376d14
-
SHA512
605c4574895ca95028337c82b4fb255f9802420476f402c3ce7f38accf5b898d13ba9dc18e9179f5e27a9e18a1682ccdf1edee4fe1b291a57513d92d19e504cd
-
SSDEEP
98304:WRZMxQVR0Y36DZJdLeAAyE5BiOVJa5sliBm93qjogjZS:WRZ0QVR0Y3MZJxeSE6b5sx8hZS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fcf04f9c5fa462263f59243b59bbe33e697f30c56d593405bfbf27fc28376d14
Files
-
fcf04f9c5fa462263f59243b59bbe33e697f30c56d593405bfbf27fc28376d14.exe windows:5 windows x86 arch:x86
e9a98ac34d565a4ca50f3811401386d5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
GetProcessAffinityMask
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetClassInfoExA
gdi32
CreateFontIndirectA
comdlg32
GetOpenFileNameA
shell32
Shell_NotifyIconA
shlwapi
PathFileExistsA
ws2_32
getaddrinfo
wldap32
ord143
advapi32
CryptDestroyHash
ole32
OleDuplicateData
oleaut32
VariantClear
comctl32
_TrackMouseEvent
gdiplus
GdipSetSmoothingMode
imm32
ImmGetContext
winmm
timeGetDevCaps
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 294KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 17B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MT0 Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MT1 Size: 4.1MB - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 408B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ