ϣ������0��*{�s���Ȁ�&}rv#��f����������M�NX��ց��>W}�e���|(����J!��{���|�l�\��s�o���G���9'�Z(��Ǐ^-Ӓ�����9�i֛�) M�� ��;&V�M遵go��dN'��� �9��������H�s�tD�T|tS��j�����#u �!���U|=|Эh}^�I�3�*1�t|� .]l�y�ꠥTa˄ul���#9d�o.�xs@����������@��)��w�ݒ��g(|(#�g�`̓t�`۰����w����G�Sy���XA� ���s��� Ѷ���G`�^�8��s�yJ�a89�!Ȉm�x����ۓ�;�Ң�W{}=�� ���c�4v�o1����b�7V�����=z����������A%d��(z���_[-�ϧ,��U�P����}����"b`�)D�d�R�x��8�hj9�����L�P��6�Lvƌ�ծ�]����V����}x����|ܡa3���8;�� *�~��b�{(�OQ�������Mjc�O^��]�ʸ̲Z|ʋI3�� ;4�� �����+���)o��E n�S�V[�|��&�I��js$�;�Ʀ�#+5�(7��]r4��1:QepT�����Y�7�(�s��;Ȉ��$T��@c=NȵD$��3}v���|�}��R)B�O}qu�*�i�C��$�lS�ǽ�wo�#��d}���P�^ʐ�^������oIfQ|�x��dko����/�� ���z>�� �fv��~G������e~���V������h�l��=&��6����~n����py� �l�ڞ�o�x�%?7�`� E���gO��K�x뼁��(����B���_�B)����ɓ����H=ʿ���r�Ї���~���%�՝�HYƙ�T0`9٘P��oS/í�*y�V�*4[����g��2�{��5�C�&��Fyi����0n|�4��#�c���.� 3���_�V�F����q@�q\���S��e���s0w���5�����:��VU�{Ǯ���⥁����1�����F>a��?Agd�?�ei� �~J�E �~�F��J9�Ơ=�ӿP�y�MT@iJn0Ө������C����-����j�l�+�Q����՝��M4�J����wp[F����$�c.$�n�����(v���$+��1?9�����S�s�ڬa��2A��3���0�Z� lƏ����=����Af��9����(��mq��P��RO=*%�]i�B˛���m퐽���p�+�j�Q���p��w ҉�|����K�ŔDž���G7�wC��]CkШZY�0�����] �xu❊�5����o�$O��`�\2�U��1X`>�wڑ�T?��(T�HT�����dN�crX��m��q�d�,� %)8̭vq@QZ�E���&�[$}/�бy�4+��+�����s���Y�b��,�Y��ˍ��^�����Y�|4R�ی?E�*F�f/����uk֘�x��Ӕ�7eʩ������0' �i�.��d�xŠ�9��]�Of�'E�D�V��Ig)0T�����udG�"�9 0�c�f`7كU�����Kq�� WP�������#]���� .�lS5�B�=M�F�3lw֍�NH���;� ��,2Y���W� 0V@)� ����|%����0�C�7xx�I!+�:.8�/���ae��-�>�2z�:�[^Y�.S佲6���GJo��T���|-�ބ8��!Hu�ɟ�S�dg�U��*z�+̞�h��?ME{���X�8�Z��_iNP���E�������zN�?,��*����H(;��õ�aڕXbXC)P���V�eJ���6H��xE�!Wl�Aq��"U�\������k��T��g���X�XR� ڊ�8�yũ�L�O&ʂ9�\,�5���uI�C�0)/!q�o�!��s����>�iA5��1&���Q��b�W�#�iq�հW��N�~����(�čğ��S�h|nL������b�ô7az��9hʂ���[�]zY4�Q�1�� 絅��w���������>�����s1�� ʓ���N�R�˯��(,�� ����y��ڤ���� &�o�*mN��|�y�gc*���Q�\0c��� �6�A��|7�7t ���>ʿ�ًƾ��Ϗ`�@%�B��蔉���k��#��6�?8�,�� �XG�g&s��|�g�K/٦ЩC�xhi��]e���^N�1^��T����h�'�x�Jn:�Ǯ�LhF������.��]��������e.�l5';��Q?7�_����}4�:O�y�!�}��~B{��.n���m�VV���wr�S&�'ʙ~�/|�b5i����Zk��}@Cm���P#TJ���a?d3x���Y~���gުn�5a�n��D%2�|o���5�r�l�R����+ЖG������jww�IAPGP�%���j��3��gg$C�����JK��S?o*��C �t���- �Mގ:_|���=@�+�M@H��n��[:�������|K@��TiE�0t]�4.g*q� XY ��P�gT���A����@������"�6�g6U��q�*���l�`R0��IJ��t>)W��{o;�}��%bE`|hb;���s�sV#���{߷�^�r�������*]���h�� �X*���|˻�3T.GF���IP��������BA'�F����6;��FP�� R)V�w�������>W!Q��sPUh���z%��\]F��Dw�(t���|[����5!�Q�r�S�����2���X <v.^��?��4*�.��������<��i��yƷ��@p�{\sv)�����o�-���+!�FMqƎ9֫� �8J��W�?��\��|�BD3�1�A���`J��1�PU�^����Ғ�o�����Yǿ�o�rj�[�T��.��yf���e�c�u���R?b�wN��݂j���@�q`/��4h~��:P�
Behavioral task
behavioral1
Sample
d0dfe2246088d2215e9596e4134ab680N.exe
Resource
win7-20240903-en
General
-
Target
d0dfe2246088d2215e9596e4134ab680N
-
Size
500KB
-
MD5
d0dfe2246088d2215e9596e4134ab680
-
SHA1
f0e148ab1677b2401f03ea64df73a2884705a1c1
-
SHA256
93ad42d489beb29a12fbba556b366a78fb10360dc3399233b7ae00f3dc4e9678
-
SHA512
c79ce1b1db1cf5ec05fdd8522bc3f915d218c8f7fc223e5ae155d8efdd7668ba30d72a6450fc6b98bb051bdfa8816e99133c56c175ee12901930994bb6d1796a
-
SSDEEP
12288:3fMjevw/+rQHAjDR9JzKB6+1RZfvQ25J3DOS60EXQ8U27tE:33Y/6QgjDR9ZKBvi2v3yO8R7t
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d0dfe2246088d2215e9596e4134ab680N
Files
-
d0dfe2246088d2215e9596e4134ab680N.exe windows:4 windows x86 arch:x86
28d1452bf4037cfe4b45165b66cbda03
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAlloc
VirtualFree
GetModuleHandleA
GetProcAddress
ExitProcess
LoadLibraryA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
MessageBoxA
advapi32
RegCloseKey
oleaut32
SysFreeString
gdi32
CreateFontA
shell32
ShellExecuteA
version
GetFileVersionInfoA
comdlg32
GetOpenFileNameW
ole32
CoInitialize
comctl32
ord17
winmm
PlaySoundA
msvcrt40
_mbschr
msgsva
CMD5En
Exports
Exports
Sections
Size: - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 928KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 490KB - Virtual size: 489KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE