����$�.Ԥ3�f�Y��F9������k��h%X:�pa��-�nlOj�]$G�o��}\蓂�B��$˕j��Ke7���J|�f���O���!��$$!6{v,�(����ӆݞ��*�s!5��ׁ���:)\�`���Y!�w�����ͥ����,%��-)�G����"a����U'%��M��,�lQG�Ͳ3"�$8|��,o�o�#RәJM��cސsz�N����5ٚC����ڽ[�U�Y�}�$���+b��,XRWޅ%���p&�$�p�[� �L��B�:�A,�g@��vp=Ž��$�� ��H��Q��MV���g�Ej�JHm��-0�]e�ɺֱ�� �EN��������}���������&\�Ɋt��N�[��l�~ 3��>��4u �o"N����2�,U���3l3�i����I?�������+�x4����a�Yp/@9b)h'�pwH��q�j��?����T~�T��K�`ZCg,�L%M���ao�,bJdi�z&�����P�+�:�g�e"�`�����"��y�0��dF�p����O��4W��]|"���0 ������[�\�>~�[��Y�D�BI��ܿ+1�B&^�p��;%���g���"v�x����/�xs�枲Tk�ъe��&����h#ĥ�S�U�����a��tRq��K��R��'i(i���]/�B8ؓU��8Q�%�t�D�7duL��;" �^�.�Ӕ2��A���/�������(~G��KX#�6s�a�EGz��T�:��.W�k�祕`4���^���Rr��U��([��̖��w����t0��X[t8���+�j�=��R�AȎ:I�GwUt&�0I�B��/����'�3���,]u,춙��ثh��&u�(AIµ�=�`�3��ݱö.� ���㋮_����qw *�O̳t�ymO��xb"K�,��������P�|��J�0Jб����w ���ze{J,�r�&�G�������ȝ�����š�h�Ðg���a��z�.i����{�0�MIZ�!��B��ܙ�n�#�����8}�5U���IV�|?%�$ �? v���Im��៊�J#����[��p��e�����bI��5���c�� z~��%���)I��'&/K(5C�*����e�(��������dw����W�bo��.xf���Em5J��j�MYyn����6L��=<B���V3��O<��Kŷ��Ղ����6e�L�?U�\�W���j������Dڬ�[ݜCO�'��G-2~#_2��{V��j!s�"+-����Ay�o��5��N[��7����6O�(�G'0�@��*���U���{ pt���;{p|���2���̙��zk|���4=��S��!*��G +�H_-6��&��idQ?�K�)�<\��F�o_�Z��V} G�;�Lx��9��G}3�B���m�\���uq���]��b��э�U� �'�~.a�Ӧtq��r ��B��uk.�~h����ڜ5[��&46�6�Og��@\��e�=6��q�@o�,�KW)���Eg�_ �r��b�p�ts�J�2 ���Jƛ��o 6e}� ������s�@��ѿ=e��폠��z��w<o���+�Uo�cH��8k/.=x�p8 J��K�9Ep$����o.��/���)tW�)~��ͪJ~����O� �( ���}�A T��P 9n�����0�ܜ�82:�y�G^�@��P�`q/8b0S3�yZ����J �,D�J�<Ng$:,����Ջ��=�m~��%�0��Ӻ��2�(����di�-p��b��y^X� ��]74��b��z����#�r�%w��@I:=� �7���-�`���3;��i|��)��+���}V�y7J eX���d�5�WE���IU�x����2�6�L�{@.V�!bi�NE�8<�sv�_s �u�Iael骹��{�hZ��u����yn��|�� ;y@p���>���)����;]%ǭ'6Zj����U��Z'.�K|�;ǭ���J0$͙�Z6��q<e�� �Z1��u|������x��>`����f7�Z�*A�"���)�~�C#�X�w�f�胓 oqo��8�ܽ�n�WD�94C,3�8j�$�5�gk<߀L.��A"�/��o?�\�~v���C��g]����P�]B�-1�iCm4V��D��Q��v�l���zGJ=t�٠�,���g]��uK^k.+�� ��vdlw�w[W6�k����?4O�q��f'n����߈gXJ�R����|8������b�-�>7r^@�g��Ht7�ٙ���W�Zaj�n�$���(했�ׁ�%xžh��~~��fW\/��w�)pwMμ|E�?\ŶGeiJ千�f�ӯ����Y#�63�я����AC�V2�3�6��kO�ς�����}K����Z�e^)���$�a3��(�bvh�<l����A��e��5�d�K��_��D�¥Z*�;W�n_ɇ�(3>T��y:��+Sv ��R�G|:�&��[f�W7C�y���z�~��;R���J�����.��u'�}�j�,Խ���N�n�\oܻ��K��\�*�V�>�JAL[��6[�?�+��c��u'_Y���?s���H���R�ӷ�゛v����|Q���"�\�n��N ��J��ޞ/v�>�Q�v<���.$�s*�����f��۠���D�k<��]�M)cS�p�g��; :�L��E����G�9_��n:X�;��Zͱx�|���Q^.N)_�S;$|������h���K���A� ���i}z�t>ԙGP<i�����D�tw�9tG�,١�\��6lfWz3��[ʼ;�X�$b�� 5�L�x+�*S���2�E��h*_�[Ě�7!��f0�Sʧ&�O�NYT۸XҭM��4� @�Tf1�3�!jx�.e1H�9ӱ���r�m�s����h>�x�>��4�� .8U���.�H�7o�� ��� O��#�WW ����V��jt���%[,귥T�ܨN�W���k�M|�ȩk+�F'*��*eQy,
Static task
static1
Behavioral task
behavioral1
Sample
e55832313096f6cd11f0d6e394172e0f3070894d339c624c3b8642b816d37812.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e55832313096f6cd11f0d6e394172e0f3070894d339c624c3b8642b816d37812.exe
Resource
win10v2004-20240802-en
General
-
Target
e55832313096f6cd11f0d6e394172e0f3070894d339c624c3b8642b816d37812
-
Size
9.9MB
-
MD5
389707c4f8f0c31e2291135a4145e30a
-
SHA1
319c48460bae6e6cc005193e51098371cb7de0e1
-
SHA256
e55832313096f6cd11f0d6e394172e0f3070894d339c624c3b8642b816d37812
-
SHA512
e703efd3ec3b00bd2636ad1242861aecbfdc2b0220a5dfd29fe8d1e3f7eb431d827a587592bd7a6e62a7dc28fea88703cc1a0a6f5e04cf11cf01d42722d482fe
-
SSDEEP
196608:tuJ9HKIbqWGSPTXhsf31Nloa67+SXgzSiFL2d3PzkX/xYb:OAIeW5XOP1NexrgznNv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e55832313096f6cd11f0d6e394172e0f3070894d339c624c3b8642b816d37812
Files
-
e55832313096f6cd11f0d6e394172e0f3070894d339c624c3b8642b816d37812.exe windows:5 windows x86 arch:x86
06edeb26531d9f9b0b2a8f1560ab1fee
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
SendARP
winmm
midiStreamStop
ws2_32
sendto
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ScrollWindowEx
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CombineRgn
winspool.drv
ClosePrinter
comdlg32
GetOpenFileNameA
advapi32
RegCreateKeyExA
shell32
DragAcceptFiles
ole32
CoTaskMemAlloc
oleaut32
SafeArrayGetDim
comctl32
ImageList_Destroy
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 898KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 384KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
dgZJlm0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dgZJlm1 Size: 9.8MB - Virtual size: 9.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ