俛tG����V��%G�23�6������Gt���X@t�C��- '���e�i�cN�1��H0,�Ћ�.��zkOEӳ� �Q,��s���6� >���*������H�Jg]A a� ��{���.%~�x{@n I��U��hՈ�������-�[��P����y�3N|V�V3/Qp� ���ҝ3��s��Ĕ��RU�LF^���xɵ���P?���ʐ��ũ)�!�l��;��~ZI�]z�h��/��PP�=C�u]�2q���Q)6�pЇ���Y�R��cΨ@g��-��K�k�o�7�x�ͦL�30�7�`�,!�=e��ǙU���L�Fh(��N=:t8�!�iF$����[��kO�:���M�ik��ߤ+<���*rB�Q��#�� \��V��1l���mKp�yJ��x�Io���Ħ6�H'���Q����AwA��02��NY�r�=�2�/UwF�,��bADג`��M�^P�e�0bef}k��������nwxw88�J��t �X�Z�9AO%��k���#m�j��ݼΟ*2�I�����*Dm��D-�-�_���F| ��ϔ:���C��p�ʖ�p��jcA��;�#���T߅p��U�rq��`LV!̎�p�V&��gF�t�8HV8Ny$Y wf 0lEU��+�eD��f4�ׂ��a"�jz'������[�ѿ.��� hW7��'%)�s��^���J�a7�y�9�<���S^y��fG�e`��%r~z��n.�����Y�ߴ�e��<�]����<[N�ߨ��]D��h�*�G��'����&�|7�)#v ���.]�`AM�{���7�>�^�`SS�Υ�vu�̯Űv(�MO���*���p��t~$s֭�V����M{��Ίq�;K��Bŝ��� w�3[����VM@��Or���qV�0;:S��l���oc?Vi��r�t�����Gc��<yLp@�����HͼD�$4�B�gN��;��sK�� LX�Z��"{�؉��i��:C��9 �<��y3��U��!N�e��sO����ayk�AM"��*��$Gr ��F�� ��@"I塠�2-C�q�?l�}���"��1^����a��ǽs�ٕ���UJ�4���Ŭ�u\O��#T�?�����ԑ��yM�H�xo�V�c�}���C���6�߈]!ˆ�%.���I�~yOA��f�h��I#�Y�� Ul���0IӁ���.Y�2�0q�����f�w�>�o�W���S���7�ebY �U���mo�8=�u?DV���-7��xk$CW���}��k�G;Dƙ2o�R;,b�`�>K��*).-|}���Ñ��-�Md��E����$��qAʽ�<J��;x�8��p�t����bz�H[�P�Śqf���_���P�i�%/�(�(�W��^�]��c�m�"�m�1����� f� ��*�&����>g���҈�3F璺���M��#!�1����B<yʟAIU�e��<��"~�Q�7�K�:��hM��;6W�7����[`$i�E_�L�}"bH�H@G���t�wb�GG+�fN�2�(�:=��i�|2��1����F[S�̻��#����v�m=vY:ߎ�P%q��R�2d��v���T��G� �X�q�-�琞rx�6f�>"���٬7QH�-s���F � ���Q�\�A �����>����@3q[.H(' p��B�m�`%[�I�Q�@[��A�q M�!VL�:���?���>��CW�Ȋ [�n��Є*�W3�K���X%��ʕ2a�`<]�`��(��C(�Ĉ��ֹ��}�ѱ19��R3��g�����m���˯�6-�Q.aa喠��:�6�_5 ��n9M���]� >II��{0��ͭ�ˀ��yl\���6�7N$k3W7G��.�|X���� Z�@ԑ���uA��^��<=W���Ĝr�I,��&�Y�oB�E6*�R"h�83�I����;|=@��_pM���7.7����� ����%2M[�Ǽ�lM�"*�͝Qŋg��,s����{Ϋ&��z��J���[#WLN��儫Cc��s�)���7�+dK_ϯ��o�i}l$ ��Y*�_0{z�zK3&e�}�+�SFΎw�a0�-<��lhb�6¹��-/}�E8���+w��^Z\ �ϴX}��RPݒ���,�61�v�P�Ph�Z;��g��p���5���<��0�E�����Ҹ�%5���5g��}�@/��=�l)Ҁ\���0`iU���/t��_(���6�$�B��x8�A)�\��[#o�V��Õ��[���[��t}��7����̳]v�=�\XA9��)���t�P��nS�~3ކ������7+���| ��BD\a�Iw��HH��/@{������gBO��=w_���li��� ��-���k��/���~�Z��<p� A8�Ϸ�ܶ����r�N2?�xu�K�(�o��g���x�ӏ>���ea�,#T���9���<�V��h��(�~;�&[g�1_HS�;��;TQV�Zpoi�������X��v@%e�n!�;W߳��@�D�[�oT����Wm{/�3~����6��(�G&P/����jTCB�s]��d� AlC���D1*�%��P\E��̼up�'�ὂ�(O=j�5���K�3���bw�����y�3�_ ��� ;��4����ݿ|�p��n��@B�\�w�q�[�._�H:f_� rd�q�Lv����3g���!ԙp^�4�����&[�� X�ܔk�A�I�R1�V�0�;`���t�V>��9d.��TQ{yp�������/� :�a�'f ��F:'�� �_�|��� 8m��5ߨg��ΫH�C�����c�Ό��'uA��b�ry|�LJ'r��� �\�̯�,0W6!�� '<t����@ �s1r�f����0߀j������P k��A�"�3bC�U�2n�`U��v� HB<ÏuFj�����D���0.x ��-����)w7��5s.����U���r�V/Y�@�h]����<�S?*� e��+:!sj��� �!���P������hQ�jsL2��
Static task
static1
Behavioral task
behavioral1
Sample
4c3a6331387f37800b414e0548cbd59dde3c101d8b8b931fbee54c7897066439.exe
Resource
win7-20240903-en
General
-
Target
4c3a6331387f37800b414e0548cbd59dde3c101d8b8b931fbee54c7897066439
-
Size
8.7MB
-
MD5
55be826ed814cf1ba2d7d3b48727d847
-
SHA1
c2d0c2f98508039dcaa08843d9ece01d5275d4bf
-
SHA256
4c3a6331387f37800b414e0548cbd59dde3c101d8b8b931fbee54c7897066439
-
SHA512
4f08f2aa8f4d99be48f4c82cb91305f0e67436523e7e7fadcc1da0347ead456ea354bc9813e8449959bdf40517d94cfb690dc8448307b4ab2dd1cb3cc86a30b0
-
SSDEEP
196608:ymrEEL55UopMitAGaEXq1k3jZvOjtGPdFYgvAlEL2x8rZ0oPH7JkdcylVwO:PhX6G41kTROjWd/vA+2xk0SH7ydcF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4c3a6331387f37800b414e0548cbd59dde3c101d8b8b931fbee54c7897066439
Files
-
4c3a6331387f37800b414e0548cbd59dde3c101d8b8b931fbee54c7897066439.exe windows:5 windows x86 arch:x86
ef8d37768b3d49b1f51c90f8e18f4da0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamStop
ws2_32
socket
version
VerQueryValueA
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyAcceleratorTable
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetViewportExtEx
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
OleRun
oleaut32
LHashValOfNameSys
comctl32
ord17
wldap32
ord29
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 922KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 273KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 8.6MB - Virtual size: 8.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ