qLǍ Uq�͂D�%�6��0���, fK��j����%+�_J�i.G���@�D�PA�ڻ]��ĕ��\�W���-}��K� ud߲c�ѥ˾�[�24=O�4j"��֔K�ܘ��n2������I5�ę@�{���;h�nqze�(:ݤ6��l0G��~���wtz%AN�T�����>$�m��30�mYƂF��ebji�%��gp���Kt}(���q��~����~�S�_Z$��[e�+t?^b\({mf ��[���t���;��L�W�����s�J��!I&�2�c�Y�!�������m^�U�� `�Rᴀ�OѾjն���̡����TZu0���+=��/e�;����GA�tH�k�����#ʝ��e�98�u�WU��� �~u�8������(����� ��,A7ʨ�J�}����U�������\��M���n۾B_E�qK�S�� <�/&����W���{�|S��z�b��u�b+r����7hl�����@�����FK��eO�I H'�X�����@2��/ �*��ߘ�/GWq�t6ˉ{��iic������/��p)*T�ʜ�量x���ֹ�M��_�Q�&�Q#$�b�����q���#�N�������:#����iF�h�d�R�P�W�#"�qý�i hn��·�$&\���?85=I�Gitީ����CEx!ϥ7�.�Q)�����> �Q���ƅ)QL����`�b�u ��!|���D���Ja��6��;ȱL3�e�,�`�d ��ܭ9�+ na�z��zd/���[8�[I�� �3eN�ჟu{FMa�}>��R�rm}�L��dp�U�5�XC�����W����%Eq�wfq�k��eEW}_��BJKó�Ljy�֝ e�p�( uX������� ��<��Xa�a�Z�p�����.5g��\�D aݲ_3>K��_ؤ??����"��mh��Ǹj{A.�T۸�A��9z���̹Z�fq}��$9���C���G�I�kٲ�s�(A��9��$5X�� ��{�jq�9���=,�5u�<ږ��־U���߇�����u���9��0)J+;��N�K�����nл�_K����`�x )��a�ċfIyɣ7�9�����UZ�T!;?��u���V��J���bz�U���}���qd����%��>l&��f�®o�"1�>�j2��'a$%�w_2�d�z�#��&�ᵰ! ����L��{�J��G�4=�k �V7T�2iZGt'R�!�����i�K ���F�<9�l�`Z����@ʙ�����Z����F���.���X" +�+�Z�@@:'�:�+5{(gV�?C�,�$g�q9U���#a�kdڦ�zϷ�6~__�"�����\?+�'-�X�Y�W�(_���"N���م�z��F #�L�u�>4����oH�^�3��G���q�S�1�}�+C�S���m8�\Fn�3Fp~_�)�����9A����^����SG���Bk*����"����gd�e����5��LC���FރCE�H�k��f .�2g��}��8�ݷ�N��``���* E���hX����Q��p�/-�s�XO���4�m�J���Z�XЎA�ߡ�X+�*X�,*!���f�s�W[���:\_I� r4�vE�������n��u@�0���\;�Vcb�����H"!'N���=���\?+�'�;Ń��}El�� ��R�v��dRg�8 7�Jf/w�u�`U2Q,��P��fC�W�ʻ���ۂ�!T��!��M��T�o�Ft�W �w[b�<f\1W����f�f��,�m��u e)�:!�tWj����+5K��,��f�8��J?��g>R[�n���4���@����ZIM9H&�V��j��a�q|&=��U����FQO��1AA%#�}��`�$K6�l%? �(�����|@��r�W�9�_����9�,I���� �|�i�N<)��Pd����r�k\�m��nS@��3�ȃ^��pұ���$)9����넥��Ue�S���5��Xp��qÕB1������&��K6!3����8_^/�l�z����/!t���F3I"s�1��T� ������pƔ��H�Et��1�Ϛ�7�?ń�G���Atq�Cۘn�:Jlw �|��L�!0l�=�+�M��<�"!���V����Ɂ�x̅O��+����a-^no����n4�[�[�xX�\���S�'����J��v��S֦�6�?x��J8�̈7L�Y���������v�D�a�v1���X���x��L�b#����D���WM�Z������BM>��k�c����$�s�`�G�43w�C�? qc\�7S�~���(v����|8�� ~V�̵DG݇� �V~$��T@9��+U�+]D�d���⟛�XR�����RHd� p1�:LZ�X��o�dzJjXe��GGr�3Ԑ�`G���_�4����}i�i��}~��'�F�7�A;�P��#OK*c���k؊/�xR-i���S%�*C������pì�G浉>����q`i���9�=���B��[E�� ����\�[�˖��\tM6T^����C��Y��c����DŽ���r�4VW]>Udr���������<�2|/z�����(�E�W�����x�!��=��֕��@^�~���bZu��x�d�|��(͆R_���d�f!���\�Pu:4�l S�ƓB�R�@|�`���@Ҏ7Q���0JV�ըza��_����ryL5ï0+z�ƒ���R_#ʅ!�̱G��\Y]���J���2�sf4��:���� �� _�|V�4�>����MC���5x�{�����(W�fZc�?P�G�e�ߕ��G�K�X�-I�� ��{c�������:~IM@f��R��rM!�g�Z�F~\Ig!7�B��ފg�\=�*U����<�Er*�Xl��g��J���t)�rr S��RIvhWm,�r�i~y��d8c/lq�����II��6찘�9���>|�6B"i�ZxJ1�E|+��}�?|�� �۞�0-+0
Static task
static1
Behavioral task
behavioral1
Sample
f1caefba5d3d1e18b51b0b36779a7193863f5351e72b97fcd61b9b14a56da3e1.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f1caefba5d3d1e18b51b0b36779a7193863f5351e72b97fcd61b9b14a56da3e1.exe
Resource
win10v2004-20240802-en
General
-
Target
f1caefba5d3d1e18b51b0b36779a7193863f5351e72b97fcd61b9b14a56da3e1
-
Size
9.7MB
-
MD5
03ef685fd568c3b1844a5538e4c0876c
-
SHA1
c8e3ddecf66d1f9022e5aa57711ad297c0c9d7b8
-
SHA256
f1caefba5d3d1e18b51b0b36779a7193863f5351e72b97fcd61b9b14a56da3e1
-
SHA512
c32fc49a5865ef1a6e84783c89bf4313784d9064423d6a21ad47af70ac5fdb39cba4b64bddb2d397b71056fe9ccf2b623d4914dfe1f6609595d5661c6d830f8c
-
SSDEEP
196608:uKp4izUCHJ7A2PpdufOresYg9WL3v6tjXMy4S9oByu9YV02nUVhLtEDcY:sMUCHJ7A2PyQesYG6fCLB9Up9YVhwhxS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f1caefba5d3d1e18b51b0b36779a7193863f5351e72b97fcd61b9b14a56da3e1
Files
-
f1caefba5d3d1e18b51b0b36779a7193863f5351e72b97fcd61b9b14a56da3e1.exe windows:5 windows x86 arch:x86
46d0c95e7e58633f43288e482f40964f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsIconic
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
ExtSelectClipRgn
winspool.drv
OpenPrinterA
advapi32
RegQueryValueExA
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ImageList_GetImageCount
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 435KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 9.7MB - Virtual size: 9.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ