�?AT�u9���ۋ����U�1����ՔYk���_���eg���A��A���3�H��e���?�/^�w�����4��3����U�'ۑ �c>M����6�*���OXپ9��H\�� GEvN~���Ň=R������qյ����|��C[��5Q<�^��yW����D;�|Q��W�[,�V�^4��������8,�ǹ����xW�ar�(�L��}�D ,�� *X����o\ZP2?��h:���P�L��04�yf�������b�$�*;MhyPO��Dda���g��� ��so��H����!7�IaW.mW,��B�*�$�#�������wP�a�m<��!�g����N��5H�tˏ���$��� �s×+e�������<��k���&��~���E���V�譊��0�+DN�-H���7�������Z�g 5��4�ej>f��۱�U=E�]���*Yz��$�3Q�S�?6-A�V��N:�|�]�1G�1s���fyN�}��~��ѐ�#���K�D{�h�SH�̏@u��2�lF%To�Z���I���G8��5_�Q�AKh9�͆���q��8Pm~:�iB�W+K��v<9/5��Ia܄�ř +�Zk�͏j�m����C9@�Y�>�I</3���[�t1-�+�tz�n#E�}��[�3F�?t��ۮ�Vr���b�O��_���!��n֟�Q{��5� ��iQ-�Ýђ��>f~�ˊq�������8�w�I(�:��� �E6,��x,�>sݴ U�$"�������u*a9dK7��9�d��@=p\�~(�`��F`F���OhX--tĝ0`�Z_ۤ����"3�6/�6tXDd�D��XTă���\t#�Ω�w~J�e�m5-�Zd{��j��,����L7.j�p�6��z�!�i\��]����«�m�䑓 �ϩ�I�IBͿ��b'U2(]�5D����4��`��NbyE��������sl@e��_�^xkՀk:W�=�Z�Tt�ۺ��y[!����&7��*�j������lu��-6�Q8SFLJ���ԣ>���������+�0��u�2!q1`��m��N�����.�h1��9~ �_R�gWh��]��8S���&�3wi�.�h!3};�ǜwW�i���ϥ� �m|���HW���{���F,�V�PK��F�O�=;��~ՠ@J��Xr�u)�v?>RMN�y�+;�����-WY���]��L��B(NN�h����"��~��(U���K�N������!��~�*R��\g�����EwG(��,��M��!G!^j�٦qi���c�� F=�X��-"�|�a�S�P (�c�����4�.rv����^��v���uoX���-�S� *H�8�������;?���[}Y@ɢ|NZ��Ғ���T/�\�/�YzN!���-�JM�'vpF>L_P!��*��<�;� ;^c��&���*=�"5cf�$�s�?��F/�����b���m�s��kl)$+?��$8�`���J��P�i�F�.�J��$���W��c��pW\���$<SB�y�V�m�O������]CJ6< Ts���~�k�Ӂ��JzD ��+٨�\�<{�,t����)�lx�T�/����t��YF!�����V!��p+�y�+�%���K]� ğ~��� ����Q�SH2�w��v]?$�7��G�_�v�O�CQ�UP�[����qw\R"�a��F�CA���d��n:�p�,z1���ћd]r�D�. вWQ ^�y�.�Ƒ$��E�SM? N��샽�(�9 ��K̯~��?�Y��\r!�����n9�;M1/�eaߏ� �'��ܳ���a ��48 �^��'2��J2�_g'����h�$� * ���f8I6��<|�"ٰ���*���+�f�׀�* �͠�H�O��΄Ň�s5���ͯ a�1̗G���P���V�Mw3t�W� �uR�H���B,��ĸ�w��_ -�������(��`</����eLcK�����3&��@�l��70^��F��0�<�?7?���=8·�B��Pڸp�o7��uP ���M���+ `@}�`�[���Z�X;��|@�WS�mK���oK����`�V5<8P틄��w�$o�t��F�6�S������K�g]�%���x�lpDʞa����j CR���d�d3*_�'̃�Ը�#�mW��i�ڱ��:/�X ���&����A/j�XT������t��~r�Ta_J�,�%3�;��l�X���T�A�3�� ey(��~��!͟cx����XY�A0�Jɻz� �G�*��<�n�x�Pԗ���q�ްϛ9��鼦 �P���IsԪ���Vi�����N���耥�Vr����K�i���l�LB�g��@�R�ܞ� �=���W�벁�D�wH�e-D,- ��͞a �"Ya�(�;3��MUFg�7�]q���:���EՉ���2��ຽ�[J��H6�i��u�f�H�%)����L�Mm�F�.�BЂA������������A5b��z�6��F �;%G��,��hȂz��Ӱ}�-G"O�#U�t�rr)�n|�*�}~kf:<�Å1aܗ��<D���oD}%�a�1` ��ݫ��0��䌈�9�h��/��N}�\M�d_cyC�̆O>���:�/r�W�n��v�N���0B���a��r+A�����2 ��?k��``F�%�4E�������4T�����. ��)e��t�����g�NUj�i+��X�y=�����eD��}Ҟ{��tԠS���ݏ�Jb�H������?����^�����Jm�0Q�1��lAq�������M��>`5�4I��Gewe-fp��pP��W�p���J��M�\|yb_�H~��'��7�q?7LciO��̻�OK�l���Y1{��ΰ�m�;KJ�J��B��H�('`�Ƿ���>Xh�w���-_g�O�@�zu�z����Ow�H�n=��p�yK58y-&����ծ<(Mr�2���B��;�&{Td����1�#�a�
Static task
static1
Behavioral task
behavioral1
Sample
55dfda727c6c234a825a78de30f197e33e29424fa61e3bc69c7005cfb70ff211.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
55dfda727c6c234a825a78de30f197e33e29424fa61e3bc69c7005cfb70ff211.exe
Resource
win10v2004-20240802-en
General
-
Target
55dfda727c6c234a825a78de30f197e33e29424fa61e3bc69c7005cfb70ff211
-
Size
7.2MB
-
MD5
c76ec1f6c0244f28d8a56ed62c231ce7
-
SHA1
0c3b5894273724785ebfc6a120ba6354af1353e6
-
SHA256
55dfda727c6c234a825a78de30f197e33e29424fa61e3bc69c7005cfb70ff211
-
SHA512
a56ff81b09e696fa2dc3921f6367edd388783bcd02dda94a712cec0cf12f45e097075444e945a0dc96fd62868ce7b77492d12a41d50c281abbc0690b334fdf8d
-
SSDEEP
196608:xbx2SMhDamDu/dDZYAy7Iror9k7xFWCIXY5cBaNeXGdMrB+CHjzyuy8:ZsSQDxuFDZYbOtjUY5TNeMMr4CH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 55dfda727c6c234a825a78de30f197e33e29424fa61e3bc69c7005cfb70ff211
Files
-
55dfda727c6c234a825a78de30f197e33e29424fa61e3bc69c7005cfb70ff211.exe windows:5 windows x86 arch:x86
2e7f86a2818b4c84c11d9b00d592209a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
wsprintfA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
RestoreDC
winmm
midiStreamClose
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
SysAllocString
comctl32
ord17
ws2_32
WSAAsyncSelect
comdlg32
GetOpenFileNameA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 859KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 7.2MB - Virtual size: 7.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ