3�-�XE�ǭ���a:�O�N>5��Yq�%x\�����0�K��`L����J+���,��,�N�L���\sg���JWuV���a����W|�{���P�k�_��,�"�9�z��kY�6�W���Dm[�$�����8bKP���������:�˗�JW�܄�Nb��&(�Y�4Y�*���f�4�� < Ϟ��a�n��?���9��r(��.3�#�R}9RU���>/�R\��]���2��ۖ쳧��V�'��[�_���T� 9�@�a|;yd��c���=�����������Ȃ[�Z1��P�e��=�Ĩ9�R־6M-����'��N7ܰg���ܫB��r���o��&�t{@��{��~�p����_�\�A��$�TL�6��E�k˕���eF�L�q>ޝ�����3��H_���6>Be1�"�i%��]�)U���1$��#�V �g ��?-J�X�]Q��&�6�\-��e���|l�-�����j+!��֘ (�t���[�����tuB�K��sH�c%���Д��)!6�[�9����nh w��:u ���1 �4��p9>��D��k����1Bl=p`FC��nSf�뇪�3�J;��C��`�Hb��!a�<x��j��?-���%^���H����sd`y3�2d����O`�� Q,Bѵ�h.)3���?���u��q7�&uG���a9��2s��~�,Y�Y��S�"#jw�#501��wӈ��Q���������߄O#��kjf�~�1����4ϼ��1��|�l��� ��J�C*�d���JK����=2xC�����ڙ���bi=�9�(|�1�z���4>�h� ;:�����LD9��>��V��Z���͎��`3;a.NiGk �J�AZl���ym!�nΉ?�� �9�5�1۔@�i��|��sijOO�V��������>���\we�" �A���~�^4)4A�礮D�l�Sx�w�?w�c�D26)�f{�%��FN��� e!��V����F��`h����D�}{���3�*��ǔb}5\�X�Z|D��#����l��?Q<�{�nּE��z�6Bş��ꂐe��;O�������S�>MG������"[)�n@������\���I��E���bW����Ȫ�T�G����Ny���gY v�s���l�E{�?�c�`0��p�zn��n%�N�d�Jm�^��0�����ǞWE���U��V�� ����ѻsBb*�E�:b`�q�+jc��c�5��B���s�?9����7�/D���|$����r˕t�ER~�0K��z�����F�L+��Kx��D�7��4o���c���� �jq���=?��m�1��J���Ű&_i�y�7���-S'���5�C�2�N�WQ��Y "q5��i��j��nװ��8�*��x��K�^m��tQ(GrG�;�6,�B@���Kڑ��G�K�dU^Mݻ�O^��Y���}G�D�#�Ƀ)8`�NbNO�Q�t�0�f��N.��)�~F�3W;/�O��hn,�N�0�rE,�d��hY97`B���F����{��rR��WR��n���)�g� �R�x��o�u(��7�s}�E9g�h ��K��ܫo�? �8G��s-��6����hz��`�rc֧{�Q��X(�zE'����f���0[��}{:�zR�z�),pܸ�����O�Ř|���ҳ���)�ثB��=�i��JПc6K�-3r���Gᐜ5d���?�:+hb�n��dn�?��(���Ɉ�:�w�NQ�̣�zn�/Q��*n ^�T�ΊI>�q� ry/�Bϙm ;��[�����#��:(��Olx������� [�Bs��0p�K�T ��r���?mPD �m�In��f�g� �� �] �$t�+VaCS ��ЀD��v�У�n�6�~�6����,�w��m�9Q��T ��� �$�*��ή��x�����5�7���v�cp��f��%<M���k��0k��]a �D�>��ct6hv}/��� �����1hm��R�c\$[1B��t}K��G�W�[�9�D� <���1��� X�D䒭�ڙ��� r N|y'�2��ȳk&-��XK9�zQ�QUh��dK9i�-����$�?N��[�m����1 ��^(PS��c03�Ǔ�gwāP:�:����[U��� �6���#"��H2�Gf?d5^�'y�f��_�9��|�Ē@BR�J��|�����Oɹ�֒���i�܂Baγڅ�L������ـ���t M��Pޤ����M�/�o\�����=�dY98��,��c�wX�ހU�z3���~���/5rg�^��Vr5��B�ڒ�rF�!�-k8n�s�FB�����T|V� }�m�Nd��;�{�e4wݖd��$���׆�E'KaCrk�u�f�fP�a��[�N7'B5̷s#�-�J��=K'5]<�y�|Y��Zc1~rý٨Y�_��x��ϕ��ES�1��m���DqBMg~y6�=�l��ׁjS��]B�Û�����)ͭ�� {�Xn�mF���J����dh�0Ԙ%k����n*�����!�'�I�;+���<r��ȹFM��d1�<�`�����*X��lԭ��X�y�/B������,I�"C�� B�?�`�g��M�{᰽f���J��4b��Y�}�O���Tk̾���u.�ȍ"= ���`T�c��!7e����Z��L�]o"tۉ�d�(�c˫XZ3i�=�X����N�T����<��o���e�Upz�� {� a��˩"-��z֒_jT�.Q{�}��2�����x�0Π{1���$��GC���w�@N��Dy��j�1�E�(�@c�3����$&�=L&|�93��L�?��Tп�C�V�L^� ��q(�������A�9������Ƞ��e�tk^��_���E���(Ƭ�따�bۨ�i3��[p/nc�y!h%8����\~=�J���JX�p�ͦk�n�RHw�zHx~ET�~Hi�ڗ6�oq+��L�;�8chlsw��u��Xe��2���0�H���{�O��%8�dܽI��Z)Tc����,>%����6T
Static task
static1
Behavioral task
behavioral1
Sample
a7fe362b69487a7db13961ccd39ba99408fd2e607ef3142f1fdea62bb57c818c.exe
Resource
win7-20240903-en
General
-
Target
a7fe362b69487a7db13961ccd39ba99408fd2e607ef3142f1fdea62bb57c818c
-
Size
11.9MB
-
MD5
60a7f0a82e113b648c32be1bac2bfe06
-
SHA1
e4139e273e6569934673ebe409684a79dd10ebf7
-
SHA256
a7fe362b69487a7db13961ccd39ba99408fd2e607ef3142f1fdea62bb57c818c
-
SHA512
81bac42e9252db94a175291bb59a960000cac3565f7d1d06060368a2e6f34257e0ca685513480736370e72567521a3f2d3b152a12f225bcdca172ce195c50aa7
-
SSDEEP
196608:Lpzf+vNosmLi2FvyabdE6z8gzbEeevbr9niMsIXYRo1/HxnGYUBhHOq9GOIC5:Lxfli2Fv3LjbEZr9DsIoa1/RnSBFOqR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a7fe362b69487a7db13961ccd39ba99408fd2e607ef3142f1fdea62bb57c818c
Files
-
a7fe362b69487a7db13961ccd39ba99408fd2e607ef3142f1fdea62bb57c818c.exe windows:5 windows x86 arch:x86
5f0062c381728804ddc30b159fdd02d0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadStringA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
SetDIBitsToDevice
winmm
midiStreamRestart
winspool.drv
ClosePrinter
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
shell32
DragQueryFileA
ole32
ReleaseStgMedium
oleaut32
LoadTypeLi
comctl32
_TrackMouseEvent
ws2_32
inet_ntoa
wldap32
ord29
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 713KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 326KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 11.8MB - Virtual size: 11.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ