�0�����^��i!$葹�fg *��Z�����<$��w��),dhL�s�M�@1_��(�4��mt�-h&y�%@�ٛirK?~z�\.֔R,��h�3"��_�'=�_5L�h�x;l�:�-�W��hɧo�v�KN;� ���vϞ�|�2��*~ސ��W�MNn �d5�[檸�[�@���֣��'^el�=Z�c{��oc-���@��6��H��R��*�f�5��0`I��PL�u��'*`�U���Z�U }�Դb5g]s��� �\w��e�3T��Ld�wsW�Ǽ�`R\1 ҕ��т"� R*%�R��u`{�S�=�w��2M�C�9��'5��#��3]���u1�Vأ�ZbI��F�s�:Lc����<�`e�DBۗ�J�AgF9\HsR-S�����g�@����:ݳlނ�}�������a8��[��ڰ���Z�I����Ft&�O���-�L ��GGi� ���B6}���L8̛�����}��xkRU���4��L�� �q���%��>:����*f,1 1��j���g���S����_H���#�u��7g\M4$1е-O'&����n=��Ų"��b�G�+үVƮͬl�1�6SW�ud 忾���/�i�����?z�d�+-\�QL}��r\bɍT}���8�Z0��>�F�ӽ_��v[��Ԩ]}=�hʈH�S�6���:�6��!�����D��p��HG�jrr�ڇ2��|�s�J�u+u������,��51|���W���$�w�gsۨ!��ıq���`�ϫ�Y0 a��vb�@�����/T����K ���<���,����הc�$��������-��`�>��Lޛ�h���;�cq����U�r���ю(���hj���N��5��g��G4�z��~�SZ�_��Ȯ���u(����i���mHw� �R�����`�pRn��0G$£��]e=�j<a���2�5_ڷ9 q��f�k.�Bh�����4o>�A��:�C5�0ڒ��҈\ * 埌�T��̾������r�<�R�����ڤ$^e˄����K;�G�+�4���r�d,3��}�Y1,�,1�;#2���J�� �+-j��A�#�CđFfX�� �.�����Kp���qB�h��Nh|N�k�5���e�@Z�U��� J�I�*�X�edH�+@W�Ơ/z;���o�Q$mr5�"[zo39rq�lupz���L�i�jؘTgҕ�rj)S7}I���+l�N�������:p�m��%Cr�*+���@\"7�j�����������d�hr��F,�>�x4��'�fR���,k +sq��@�M� �i�����+>Dk�O��ak��7��G�4u��ˣCЅ�+��<1��MSx��A��-��S��'�ťB/�O���i)k�R�1�X�,����XcA'�?������xD��m��A�C���Zsp���sq%9�7*|'@I��jb/�۠�NM�1�72�� R֢v����B����pd}�c/���-l+�0��y��4"˰}� ;�+yɱWxE�֚ �H��W��Ӆ�5o �q��N���FVRXhu@s��Q��7���f^ "ǔ��k7�Ќ�C�4*S�X&,�45?�8�;������6��EՇ~�f�i�� a�Le�<��j߀r��W�Ӭ��6"d�o��A�[��]�fY.y~:�c�~�k�Ӣ}�"��]��#���� �`S ,W�1�]@a�:���Ta��zB�F��`�ϔ-�%�n��&�Q����sꚒxu��I��\M�-�a,T�������bNگ�=��TdE[Ph�����p v���#�'&j�(�^�K�?�SA��7S#�[Da{/�L��&Ū�7s f�Q�c� �<(](@�:���:���� �6�k�RRL�%���6#�X��h���b#�^�]>���u����Z����s��7SNv�H���дFD;��#w�I�:���YU��K���o]�'�2v��T��T�W�"��٠_@ we^��7�}1C��k���7���u ;�r�ܡ?�����T����U)�Z��B��~�������I* �7�o���y�t�R� ^�H�[5VL�0`�Tbyy�ş�w��]<�E�p��b/����&&�2Ȁ@��BhL�snͧ�-=r�ٙA���$y���5�>2\�\��m��'��n�K��aO浜��# X�R��4h������_�g3�|A�I�7)��J�hw���j·��&�s-����B$���0a�O #>H�8��E��V��|���ڱ�=���B1 ҄����/�3�����3�������&�e$tx��~ �F�okW��?��j 1�.�2����d%�gռq_�>~�����&p� D�F�u�����{c��<_b�?$I����9:9�YW(��5>��%�`C��D`�/D�oR���d���"�hgPb��A�G��i[�����2�Bf�Y��U;�;j}�{ �W��%���jcC~�(-J�t]��Z;���[�a6e�Ԛ�)A0��E=�ڏh�h���{iC��f�5�����GHa�Iۂ�jѧ�I��k��r�yY�ףڕ�3���� ���3n��f)�A��� A ��U���V��<k������tR�d���T�t�:�x{�R�y=�V���{����I���5VU��L�V��<P^:�l��Z�&ќe$ P���Bo��i۟�ָ�2�s�_��H�CX�|[��q;5�Jr�=�%��s>N�����e�zw0��B(7���e��n����x����^�\-KXnkQ���-���#�j}�tZ㪋[�|_���y���֛�l���cA���~eޤE��rv�b=>1/K�vU@E�BwI��eU7�$C]������Ԟ�% ��NItA�s�7�U�1��o�9�i�9���f�eK����n���)k��\0�=���`l�2�$�A����2J��ϻJ�*Wf�}x jէ`&?�Ԯ���AR�7������������ )��<���KR1`-�hr��V�����ZL8&%~$����&����$H)�'m�C0�u"v�
Static task
static1
Behavioral task
behavioral1
Sample
061da567b228e5d021e28c924fba59b7d9aacbccc3d20eb2f7b88bb3eb90645d.exe
Resource
win7-20240903-en
General
-
Target
061da567b228e5d021e28c924fba59b7d9aacbccc3d20eb2f7b88bb3eb90645d
-
Size
11.3MB
-
MD5
23dac2d740b00b25935cbf29be90469b
-
SHA1
c1c3fe859a23e3ed9e04037192b054a561ab0f73
-
SHA256
061da567b228e5d021e28c924fba59b7d9aacbccc3d20eb2f7b88bb3eb90645d
-
SHA512
0b013ba960eb1e030576e085200262ba87122398e0b50cc26d99f7883d3590ae86153fcaaf4510b416e7cc6103a36aca0669ec60962cb4e45ecaf3d334a2c297
-
SSDEEP
196608:YhuWXHKRxGNJqYZUdrvHxTcfNG4BY9SlHxrb4b26NMrAcJ84:4KC/+drpcliSr31C4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 061da567b228e5d021e28c924fba59b7d9aacbccc3d20eb2f7b88bb3eb90645d
Files
-
061da567b228e5d021e28c924fba59b7d9aacbccc3d20eb2f7b88bb3eb90645d.exe windows:5 windows x86 arch:x86
9f22a5a4fb9056ac1d51fe285a9f2b33
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasDialA
winmm
waveOutOpen
ws2_32
WSAAsyncSelect
kernel32
GetVersionExW
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClassNameA
CharUpperBuffW
gdi32
LineTo
msimg32
GradientFill
winspool.drv
ClosePrinter
advapi32
RegQueryValueExA
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromProgID
oleaut32
SafeArrayUnaccessData
comctl32
ImageList_Draw
wldap32
ord29
wininet
InternetCloseHandle
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 445KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Wa, Size: - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.{$\ Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.#`C Size: 11.3MB - Virtual size: 11.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ