��^� G��zc��r��B�@ ������w����L)�_7�IL��-~RG�5��Pbw,RJֳvR3P�=5<a�����S>��B��Ao\�����e��p�'tFy1�r�g���� �1F�c�Wms,Y��(�]�����[J�a��W�A����a8nT�R��?��^��;���p�!�R 6da�����6��oA��g��B�w;��Pp�;��y>""�-�ϟ�(ql��T�����iĥ�vŏL�5І�MjDK��5#�������mt�T�� 1�e�@��'�xڂA)t'�0��\��y�i��NC�c)��M-t�o�ԦTCJƐ�r~��|���������ه�Ȳ��g��ɏ���K��:�B��8��)���5_-����?ͨmRV�G=�m֊���t���+Jut���Gķ�yKZ:����ozN�?$��� 5k�z���)���d�>E�g�A��wQL��� j g˭_�Mkq�Ŝ�O�-XO�h䔢���S$�Cg�P����l��fn���-���+W�d���A�{� =���Y�[>4P�[e;� ���y����[�������d�c*��$��x9�J*}����&|uK��`@�PH���g�x{�r��٭��$(�w�_.[5@geo��?��AV'���$�V0v���/���C�2ƚ���l�����n����ˏm�������O���D(h���v���\����e��:Ą��n� u1������`� Bef����\&i�E,uH ���T��rS!�gL\�1�10i ���H����'�k;�����[9�W�r���,��z��m8e:��:g�-� �J��+��y���k~�ʝ�R��::H'�Cs�������!�0�H���&��9,������u���:�w�p�8��b� E��/��4��"-3ui���_�〔�����`�z��T�ѿ��] tA�8h$�����8iP���֏�qe��_[�%��A����O�$��V����k���)ލ$���}�ǟmt�V�gb�wF� 9�?������g�����n���8Տ�<�G�j��[��)�"�ރ?��C��M��������k�ί�\sj:���O݊�ײ���#�ݟ�lW���8�T�[+��r#X{�MR7�X l��:u(|��h�rU��C2���6�lJi�9[��/V�ݣ�;n�19x)EJ��x3��Wˉ��4-OA�y��선g�jōR�x���Af�w��d*_ؠ|�aZ����8���ڞ���}�%����Ō�k�7�m���ᤣ�H�O�i�����K ���9���5Lң���T+o_�Yw���'В��+��v�����!����o�^*&���x��,0[���Q���*IP2 :l������! �8�۹ ѷbz5�����GSy6I�b�8ߎ&B�p�����t�����C�y ��p��� /�k��."�K���W��g��ol�v�h�����LIVWe���2 �[�BY�[�_����h3��[��(� ��Q,Xbv:)~�S}8˙?�p�{�J�/x���s�{��X�N*��nYפ�NL7����}->�.�[m�;��x��tc��I+$�n^O��(N����E�'���G�1��ȃ�hd���OfBY���s=��i�i9 �� e���S�4��B�ڜ���O�H�6�s�ׇ��E��u��怪�$���ʫsC�fa���u����aR'�9�(�,���i-�~�n!�B�h��N���|����ы�^��nsc?q5��]%D��%�4/9�]L�?x��)Zbn#q�u�`ܧ�\�8g�99H����^���������xɾ-���ܝ=g� ��Eh��V,}M���\l+��i��OS����]�{�����,(.�~���E�������u���Bƌ ��iF�#��zy۬!(<��_!���ID+.���ʣ�v�*�mC#�CU��T$O&[��W���F��T|�ʥ@��sFZ����OX{`|*O�Z�6@H �:�o�\L�M���w=|;�8 |�ƚn�p�?��T�/q��-9Z�Z۲Ɨ_���z������z׃|xf �e�^RX��V�c����.���b��c�Mq�����p�a �@Lƛs��>b-7��c۪f4{$�'� n�Z�Y����Z@_�ʈc�ޗ��VK�R�:�n)S[G@𤞸[R����Pj�b�1�A,q�����]s��7Ez]�Yvi�Xgcq�H{։É��7�^��v��y]{��H��?K�����F�� �au��M��eb���h�h�8 Qb_+� ��ؠ�P\F�K=��Q�t�� ����~)jM�Pp��Z�3��Cǽ���W��3�M�H8=���[��-$���l���J9�[�B#��ML[8$��w��V�E�,ށ���ۮ�&e����.(�J��4���~@�,-���Nj�% P����^��+~1]�稼껅&l/ c[��F���C�Vo�c�ZeM5Mv[}�i}��J�a���I��%�Za���h��].؟ckQ9�[�����IF�~�o&��ث/���g���?�O Ƞ�^j�n˛�/�HMJ�V�2��٧������j<mItל{��:bx��c��f������w�r=u�O��q4����8������#(��4�T3i�:ĎG����=��*z�r;�{6VB���1���מ�LW����\��_, ������!,�Ve8jT{Ȍ�\Ӳ�]�غ�l�HO.ʕ�fD�R�O�c���ǞͿV�g_j#�1%�|������<�7�-=ڷ�7���]ʘ��j�]ʹ�JfY�}���d���� �����c�B�f4W��>��u����JWyl�:FSH��wm��jO>=bƞ��J �˯��X9�X�q9K_ɥ5���`�����d��س~�t��[�����~��Z�~�����u�!��xl�5MK���������_X�,��Y�',Q����$�~_2&�ޢ�����Z(5F��S�}w&s��{�:����aU�l���(00|Zp�t�pDzfS���mѥ�
Static task
static1
Behavioral task
behavioral1
Sample
a3f17b79fd0dca35905f1972329cca9ae3030bec49710187d4b07e1678722201.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a3f17b79fd0dca35905f1972329cca9ae3030bec49710187d4b07e1678722201.exe
Resource
win10v2004-20240802-en
General
-
Target
a3f17b79fd0dca35905f1972329cca9ae3030bec49710187d4b07e1678722201
-
Size
1.6MB
-
MD5
37c8cc518402b5d6a02eba241686e807
-
SHA1
e6b92d0e12b3016d9223bdb8a0be32c78196fb62
-
SHA256
a3f17b79fd0dca35905f1972329cca9ae3030bec49710187d4b07e1678722201
-
SHA512
c2778a739466a3957b9b8c14386e4da2355283eabc5532bcba332f9940794adcee4dc92e1ba266bf489ccc60543c303be3c91bd71095b26bf153f2be84bf84e5
-
SSDEEP
24576:UkWGkq4E79C/Ft65npZ+lPuA7WV8eDuRAmUzanaPQy+t/t2NinJkezCZS1d7lw6L:1HVgt6IPuA7mxDuR/naPQ7mqJF+qT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a3f17b79fd0dca35905f1972329cca9ae3030bec49710187d4b07e1678722201
Files
-
a3f17b79fd0dca35905f1972329cca9ae3030bec49710187d4b07e1678722201.exe windows:5 windows x86 arch:x86
06e08980c49a89af9a05717756a1eedd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
psapi
GetProcessMemoryInfo
kernel32
GetVersionExA
SystemTimeToFileTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowTextA
gdi32
MoveToEx
comdlg32
GetSaveFileNameA
advapi32
RegQueryValueExA
shell32
ShellExecuteA
ole32
CoCreateInstance
oleaut32
VarUI4FromStr
comctl32
ord6
ws2_32
WSAConnect
wininet
HttpEndRequestA
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: - Virtual size: 628KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.beta0 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.beta1 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ