=>����9�2[�,[���GƘZM{����%!��曕�]/e�:�7��`�;����!^�^KEq�Dj���#���Kߣ!3� $��'�Ƞ� F<o����E���T�� B�e�r�Ԁ]�r~�W�͇�_�����n+(��R#ŭ&�LHC/�UR��-T�S�Z��2���N+��j�B#_�[C]!Bd?*�3��y~���λ�9}������}��! �j��l@'�t�N��L�{�yy�E��f�^Y%�L�,|ulג磡'"4=ϐ�G�Xj(�ᆬ����2���ax������ϐ�Z�J��GO*m��9Iҥ>W�*�d���VH+�2�\�ԋ4I�E!�F��8��2pE�q��*&���F�J-�mc>�Z�h��T�6������z���6 �Y�xB،������H��6\�A���9�@�5���Tpϥ�]�婞Ǩ[F�GyM�� \��'Q���s��R�#/�L��o�~D��Wxȗ�����W�a�\uf��p��K���m��+F�?�kPG �*���`-~���"\�]�*-G�3�N�4X�v���:�7q�!����������)qnZt.HL��5�V�����/�S��Y�)�xzNT�O���l�ɝ�|�Bc$<n`�z"7U![W�"P�4K�/�X�F��U|���P���N�5�!����o,��KQ�%�-ZzIz���n�Z+<g�v�Pe?�T0����UW~`Ͽp�^�"���ŧ�����?nc�$����3�'�b�T6v�(��緲�{;��ujK��XP=Hu�����pYC~<�]�8��_ylp3��ӵ8 ��[��� ��W���( �<��sZc�q��z}}^���8���&��ю�̒�%H$~����I�֊'x_�P�� u�����D��`���b���cP臠D�'9gqT��98K�@xou&(��g3�ڇ����t��17?�b0;��3F>��/�Q��3{ޗ=��� G�t;U2{�%=O:���s�f3�����kv�Q�����g��CLe qu{���� �S��S�%���r�����Rq�73��ع�䤥n�K��9/�� >�XϨ^���w���&�K�BQw]���&h�>ltN�� S��$bH@���i���a['Eˉw������})������K�%�H�QMHE��M(@xR���Xn�5����J��n��j���s��dE}A�Z,�J��MHH��L.�"<Wל ���|��C:�*W*�bj�W��!�3���}D���vC�:�l��@����Z�7+�Ҏ��r;2�s�xi,(�<Lc�CPo:������O\�CT0b�["4�)no���4��&.���=;uCƄ���d�.�1�8���ii�=����+Ѱ*��� ph��=��F~�� �#1���v�ꓠ��m�W�����#ҹCU�k��P�g�.P��mӟ>���~����k�YG!3?�bj$�#Z�a�TR���狉L7�E�8Xga��������e'|X�|��A��9��1)A;y��7 �T��S�=P,����3��d,�;�x�-M_7� -q3 �����tq}����Φ� k��✦�b-��D|�ZL���Q�.�X����k�c�ل�����C=�F�NԺ+����l�v��,��*�)��ᘷ��e3��7.b�+ȱXz���T1w�������]�v2���#�uMўf����DJR�:n�������\��@h/.F2'_s2�xs�Fo|e3OZ�@J�rA�^\���ï(�a����� ��x���IQ��G����s�o8M_�����ݏP��#��r������ aN�'�ӏ����v���|i���<A���2�c@�8:&�;��R����JU↕��|y�BT֠�R;�eˏ�ɔ7�W{n�fzLY��k4�r���0P�Y<�½���2���O�/#$����ꫳ��sC�N�;�w�N��!}K���U�/e'�}ݟ�=�!Yg�i����Fla{��6ƕa؊���/��Uq�Ūz"�L/�P��@u|0�d�3ĩ������{kŊ0F��+���߄s�b9ǩ����a�~�|�m�XSo�2�>� ��,Ey�ـ��Ko�fJ�<u._W/��=�)��=�=���u�&o������R�������\�l3ך2��Ѐ(���>3�A�Klo)D2c_��"dF�^��،����ꛭòK"�� �<���F���0~�C�@M'�>#�m��SD��ZI�BQϚ�Z�l<�GI3%��Y� !jc/Ók�*�j��tw:�P�슾�$`@�G0�fzVW��.����S����-���� x|���o��ބ����C���́Þ��?[5�~at^�����H�CuC�>c�M�-��z�}�f%+�11DI�������@��j�i-OPDON��#���#!J�~w��yXhq��͉Ps#2p�(}T��x)D#u�-�{ibxA�e6NZUg��':u�vqڌ���y������qS�����]���+�R4<�m`�ļ����K�ĉvQ���p���>G2;c{�q��m�aax�f>W#O�w�� �i��Xvm'J�>�@��e�QXMh.I]$�B�&�3�]����%UE����_.B���:8O�� ���*���ʵ�B�Y����S�@��IOy�&�a�h�]�h!ż7�$�c�<��=4���ϧvBG��f�B9�E��z2���, �;Py��QFP�n�Eߒ�m�4�� v��Z![x�f��[ ��8oX7�� y�}��u�z����%�}ɴ��ۿFI�$��v�fѳ�"�d��d������<#�fl�!�6�\cYe�9����e�ʝ>�)9��Iz�A�K]t���1����L��+�>�%�� �uJ��X;#a���),���,�O���q���J>�õ�����J�QcQ'��Yl�u+��l��n���ȺF�+8a��#S$��CG�z�f'Z�Ț˜.�A��7ᬔ��̋�\E����`��y� �����
Static task
static1
Behavioral task
behavioral1
Sample
ea9231a080d96465424bb9ee7d6f3c2f4d9ef1b524953defa1315373683015fa.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ea9231a080d96465424bb9ee7d6f3c2f4d9ef1b524953defa1315373683015fa.exe
Resource
win10v2004-20240802-en
General
-
Target
ea9231a080d96465424bb9ee7d6f3c2f4d9ef1b524953defa1315373683015fa
-
Size
9.1MB
-
MD5
27cee1c2810d2b618455cae25a5eed30
-
SHA1
c557a57aa60c39835d3650af4f31950ffcca07d8
-
SHA256
ea9231a080d96465424bb9ee7d6f3c2f4d9ef1b524953defa1315373683015fa
-
SHA512
cf12e308eedb80d6a4c343c8f6bd11cf281b1377019109e45e20a84945f81a3028c5dde608ed675587168fc51bcada905eb0308e06dab9b6dbfc09445de95e51
-
SSDEEP
196608:bnEugfF5pie03/WVm/3gpn1yRJ65cYWyt6/3uj0/IPq3:DEugf5i1PWVmvgp1QE2h/ujD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea9231a080d96465424bb9ee7d6f3c2f4d9ef1b524953defa1315373683015fa
Files
-
ea9231a080d96465424bb9ee7d6f3c2f4d9ef1b524953defa1315373683015fa.exe windows:5 windows x86 arch:x86
c0f28c4dbf9c642a1d853d81b617fc69
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidToStringA
winmm
midiStreamOut
ws2_32
inet_ntoa
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetPropA
CharUpperBuffW
gdi32
LineTo
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
shell32
DragQueryFileA
ole32
ReleaseStgMedium
oleaut32
SafeArrayAccessData
comctl32
ImageList_GetImageCount
wldap32
ord29
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 918KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 406KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.|~X Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.CsB Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.c|( Size: 9.1MB - Virtual size: 9.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ