�0OK���K0LXLBSQ뭀���P�6�^���I¸�k�����"C�`Wҹ�aG�/�ư�ԙ���ʎ����a��mfв~�@d����N�,�I��PA���]�R�2�x���2l^�+�w��.}J��Ai��%�M�8��q����(??a��m��@�K��`��TޡpK .o&~7 y7F,�o4ي�@�ol���/��L��� ��hh��!.&=kw}Z�E���?�j��6��7P���]���������U (�jH�=$�o�G��?BB��b�q��Jz�W��tt�x�������U�M7Wr�E��<� y5#�� UB|(: um�H�~��������~����'��С68�b����Z���j�Wӱ$X��!9���x``��)�ɞt�?��F��)Z�{��������li���H#*LaE (�H����!���)��}6�� �ܥ��!y��hj���¥w�!(�?���ܱ��h�L�?�����!>�ޣ�b�'��*�<j$�ov�'R�}Z�=,�3�J�d"}��E���^��9��(�$No�����6QY7}PG$��yv�����7���;2�̵�����Xǻ�4�L��&�Yg?����@��)(l�T`��r@��s�^A�����WP ,7��z�0�Em��JUi6������1/u9��&�Ka�(�;�^��j�Y��Y��u_���DYs]��j)��Y�;&@|�y�ܦ�F���_���܇,7��1]�8R�&n��s�RM���l���P�¬� Byv�@��t��I)3��4�{�,Fd��Хu�ZN�5���O�\H˯3 �Ak7�TlB��p�r` T�b^�r��m�������^��ɣ`�&>����%�[�{���*y�xA�aZ�hr�|��5���I����ztu#R1�eb�Y�5ۗ+�k�4���]���� �/� ��ֿ�S7e�9+[�䂼�{��o �r�dX��M?�@���S��@��q�se08�;3�����W|7��zV��> ʿ�:����lW;Q��h�1D}���U~W��[�����������E����^ݐ�Eͼ�a:�~k�:�}�,���m�gTpG̔��%��*N�B��MXNޑ�H�S��F� �[�Q<���� 2MG�E>q'��M� Tb�����xM1��nN�M?����h��^<�b 19`1)��'e�D����&&:�(�P��BČ�m6��v�124Rk��T������ظ3��IR��M������p �$��ϽoJ�+��]g����H�Nt��2�V�]�zpC�B�F5�3� ~����M�{c%�O%m�u����ܾ����SV��@p���X3����^�1��< �������-F]�#����*���v�vb��Y���u���Y���A����^���模�r� v���8�)1:'¡.�._`�D����{����@��{&��>QEg�;ScsB � hH�W��=��P�0J�?�KҐQ��� �� ę�lfCխq���8䏳��ސ8U�.rv��҆ϣ.靡��k>�`Zun�<6w�V�c�-z'��ſpC�X[Y��0A`.�3 �P�>��n((yű� �0���u�W6I=lL|w�/��� �Fa8�S����G��5U܍�I��W6��a&y�<���6{�Q*��<�̊���� Q��wCdž��'�����6N��.����V �8�#����Y�P�&�I�T꺗@M���<Ç �9_<ͱ���8���\F���'NC�Zo�ܜ�X�N��-�=��E`V� ��"�[kk�M�6<j������r�p�m�oRW���F3>y cz�q����Za���'�9:yǐ_멓M^�(��Af�ű$vUwكSpeD��5*8��RM��2��0�G�m97�h�tC�l� `�e��{�R�Dԉ=i���z��q����xN�89!�b�$���]ui�w)%E�T�%/c�hnY�"�1��Pݵ�?�1_H�p�{���]p�d������b�Դw5�}A���N�iq�G*)�g�b��N�R�:��6��u,������ŏ��ns���2�t��N�z�tn#x?�v?�G��IC+�bצH$Ү��|}��|��a�}�������h�Y76bQ�UNd����%7t�z�BC���͠�;BV^��q�� �-$�=���ݗ��B�?�P4%����3�m�D��,n�^C�m���A�6�����i��I�Ӭ����svz��H����d�w���b�^�6CA$ӹ���ҩۭ����S>)t�e�؝:�w�����pr�A� o" �X��_��8�1f~����$��ul+p�����;b���h�[+��8Z���GK��~n��5l��0�wqg������̸ V�0(rB���r��4DB8�1a� �c���Y����iT�,�w�E�L� ��輴&���A��IhU�?&�aᮅ�n-5L>0w8!:1���_C�њK�܍E�o���?C�j_�^��՟�7I��4��"���i�DB���� -D�<lVci!�P:��~K��2�~�y^� �W~�b�އ:����L���Z��ץ��>E8<BՖ�/�/ui"n�:���#��DnT�Q�������2e�47*⌲3�eф�vZ��o�˰"(��_wΓ�x1cx�w��kDÞ�/�4=Q:���R�N��o(^��k���y�� fRie����ɮu{�D��K|�v��Ģ�W?��"/6P�� >�m�����-��������3�� ���;./�P�mF;�RL���4O0s3s���d��R� �A��L&�,��!8��H�<dA�XZ����G���L�G��(�*�Ʃ߇�]�Z��I�/�%S���+����\| ���!E���d�f��d���������?�m<��UpE8��d���J��d��)�F��_�Bh�L�1S=���3N?7�jg\(�/U��}�-�_�3�A�k��a�03x��Y#m|�5v�oP���
Static task
static1
Behavioral task
behavioral1
Sample
953c755d28559a20bf5fcc468c68cd045050dd37db0afdfe47a6630613888dfb.exe
Resource
win7-20240704-en
General
-
Target
953c755d28559a20bf5fcc468c68cd045050dd37db0afdfe47a6630613888dfb
-
Size
10.5MB
-
MD5
be47985bf610ae067b331183bc4d9aba
-
SHA1
6d074eadbf8ba443038d8945c452fcc523d9e379
-
SHA256
953c755d28559a20bf5fcc468c68cd045050dd37db0afdfe47a6630613888dfb
-
SHA512
98ffd97524c0d1113aec0a41e3e318661e623faa7727e039e81996a56b820edc369b1ddc1e6b0f588e915470bb58bfacdad71728efd00f1bb4517e118540268c
-
SSDEEP
196608:OMCE4ETzBhSyn9xk1+0qt1/HehyuQB1GVJ4z5GTTUnYjZioL1Ea1chW:OMfTSuY16t1P+JQKjU5GTTEYjb1NE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 953c755d28559a20bf5fcc468c68cd045050dd37db0afdfe47a6630613888dfb
Files
-
953c755d28559a20bf5fcc468c68cd045050dd37db0afdfe47a6630613888dfb.exe windows:5 windows x86 arch:x86
d6de9432e22b0f64c472e9ae6ec24458
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamProperty
ws2_32
accept
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SendDlgItemMessageA
CharUpperBuffW
gdi32
RoundRect
winspool.drv
OpenPrinterA
comdlg32
GetFileTitleA
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
UnRegisterTypeLi
comctl32
ord17
Exports
Exports
Sections
.text Size: - Virtual size: 524KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 329KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.AMBy0 Size: - Virtual size: 7.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.AMBy1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.AMBy2 Size: 10.5MB - Virtual size: 10.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ