��z� ����~�22sd�`��}p5��?nG�ţ//Y�`�2����1��q]�f]}���t��w�}����#Lz�!��>1"�v�S!����յ�7�s�>��v�&��r�[���iԠbu�r�. ��i��j�P��p��0��3�=է�l�z�^�Z���J�xr�X�z�$��p�n�V�Z#ߞ�ZT+�]��1������'�1���/I-x�_%�N����M���Pʡ"QC��Ì�Ð���)�R�fNO8��cœ�~�8iQ��8�G�:�N����gԯȊ���b��x ����#|�1�=UN��.s���,��ģ��{;�$RSR4-�*]+�,y�ou�ɉ �6Z�f{��b���Kٕ�[T�7%��� �C�F�` �)s�B��RDŽN��{'���][��X(��U�$_�� ol�{�z�pY��o�H&�p�(��_Y �H��O����y��i�u��#��H�3��Z���6/(1,�ӵV8DYD��vi�o��#>~Z���׳�R��Us���N���;q�P3М�t�c���JڊBT��f�*vi��I����� m�m�u����.�(oM��v��.r��2h�0 tJ؏?|��"����oa)轶�l�!��Bs�@��Թ�G䘫�47���ػ�a+D�l�kg�B²<?�Tu����5���3@�N"���WN� |� �YBVc��[���Ct#n�/�_K�Lc��3W���UO[�v���B��6�[�_�\V�e{=P��+-���� Z���(тK�f��:4��u!���k٢/�K�b�\���E$���d�sW����WPM *oW��V�l<�j4��Т>Ǵ��xg����*��˓q撌���v�y�t��]T��@Ŷ��rٽL$o��(��0I��}��@π����\?5�/� ��H���qB��o�u�����r����m�ʕ��pm5j��]c~��ʎ�z.@!����:-~��g&sG���`�Wb���9H�$N�l���Y��������<��t0A�������g�Ļs^���� ���ᮐ���H�d*��X~p]1�/XcM�㕹�7̆��O�7F}b4=�-����䃇� ��=��j�9�V�[_�>�����������x��3����ACa���d��r��4��x�d���z/v�{�h��q�~F�9�3�41��>WxT4d*ltxWT&N^��_�>m ���2@�j����=���=<���xzs�������c:��c��ߴ@0�0XA��\o��x{���~GM�`��Aٿ/*�/������C_I�!"ŢPbp�Z����g_�X��L �&W>����z ��U���M<\I�#�j��e'P�����1���8L;���2O�͙WՏ���ռ�è��&��-�J��M�I��>��� S�;����_�� 6aNsY?)�4�������OՋ�t25�S� Q ���vE��#�6�V�m7eb�51�����B��Gt���*��x�Hט����)�#/�>0���fD����ɴb C��wa��B����2:���)�*|<P�p���c��L���i+z�!:s�/�%��t"��@�%B������6ak�!�U����D�������`/�v�<��q2��#�3��w�ё �1V�E8-RQ`�z�8�d��6����3�%-$������B�YUj#$%1Gs��Q�o����"��F��8#]Y�è�����ʖ�i&��j� D2 ���'#df��JS�}o���e��������{�����]"q�(p��'�堨-� 3�#���r�h��������G�&7]c�E�+�O�s� qAU�I�G�T4#�����[Ï#{����d5z�y�3���>?��P�B��@OF���0�Xt\Y��]��|F �*\n�j����r<�{�q"5���9� �$NHf�!G�d� 1��m�������h �˳@��:%��'�M,�\b$��o��3��7�\8�zϖӀ:O��?����&$0xg� �M�y�|���Սs�?��|�:�ri�*-�ꮡ�(��!��?kɬ��F7r����� v�M.���=�c��]���{<!^3w���ݰ�g �Q��q�]�iI�܃4y����0|ʸ���!�y�%r^"��r^����_�O�L�4m�\�a@xR��WX'����c��tO7�����O>��X��yO��x��Ħ�|'����~a%���9�i�9�co_�="���f�u�~�"-�oq)Tt:�I���\Ѱ�q�#�QXo�R��I:���#h��:��,����!�[>a2oElj�V�V�Qs��Li��F����/Ȃ\��c��%�2��W�P]�~��ԋ�"7ȷ�-<^S�N˚�H�� .36Ӥ�:�������.�m~��~��ܘ�hqt.v!F utQC`�S_��Ԕ�K�E��8p��E��!-ᅸdk�#�7��B���1v�������{V�`�F�N�7|��0���Ob뮗�y5�N|F,� ��-էJ[= G�����|�6R�@5�����0���mD��2���dD��r�b�������HT���9݈?;\��ʙ�Uq�0c�r��B.�I.��`@1��Sj�B�%k:�s}`s�8"*<ь����Jmi�J��u��S�r[�W�;c��NK-{��b3�b�� ��&ҋ^oS��.M���T��*��϶Hц�n�&iRW�R������a��z=�i�r��I��zn�2��P��%N i��_��i���'�.O)�2��i�R�j�Q %:�D�Ƀ�K.��6�d��>�SgQ�-��N,���� v�X�����H�%���HƵ�e�_P�՚N���(��#��%=r���2�����tUxQ�۱G�ѳ�4WI��cA��|^�&�4���4��W��EH�І��)'�Dݱ��l80���@���(�c���U[��F�`���a�p12��.�Ա��I����ǃD�o��M�@���\K''�D�h����Hf}���
Static task
static1
Behavioral task
behavioral1
Sample
e030d67647970c8125b8f42244aa38d80a7412cc8bfee1f246cab8f0e0a5051c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e030d67647970c8125b8f42244aa38d80a7412cc8bfee1f246cab8f0e0a5051c.exe
Resource
win10v2004-20240802-en
General
-
Target
e030d67647970c8125b8f42244aa38d80a7412cc8bfee1f246cab8f0e0a5051c
-
Size
9.9MB
-
MD5
197b79b310d355c2e7f7bc8d426cb3a1
-
SHA1
ffeba71de1522ff02a13c295090496b086a74efc
-
SHA256
e030d67647970c8125b8f42244aa38d80a7412cc8bfee1f246cab8f0e0a5051c
-
SHA512
893ad32d5f64ab6a62515e4b407cb0febefde6cbadb03b95260515f2314ff068a14d0083e286d80dfed20728ebecba7ec5a3efcd690b772f9625a80c7753d536
-
SSDEEP
196608:CPe4WvCe4E+Cp5wQvvP9wyAMamD86nsD77Ji1FEpqU66zdhf:CPe4OCJCpKyAMabdqmF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e030d67647970c8125b8f42244aa38d80a7412cc8bfee1f246cab8f0e0a5051c
Files
-
e030d67647970c8125b8f42244aa38d80a7412cc8bfee1f246cab8f0e0a5051c.exe windows:5 windows x86 arch:x86
c5f59bd5a686196b77b8f5fffe23dee3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
midiStreamOut
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetFocus
CharUpperBuffW
gdi32
TextOutA
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ord17
wininet
InternetCloseHandle
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 1019KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 311KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Gnw Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.\H2 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.T~I Size: 9.4MB - Virtual size: 9.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 424KB - Virtual size: 423KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ