.��u���S����\�8��5ut��0ۂq�Z?Rb�{�?�O�c���tB�U��i�g���R'˫�z���BY��Kɾ-aPz��� �b�� �?� ���M`�����_��J�y�Z%�h� �"@G[~��m>)\�;Z�+dPU%�S� ����$���t�{d=:�G8����D���y=�8] s�{a�]L��� �S�����o&��������ޯp�>�����墣����KxWk�C��@�?���q����1�ܬ���+!;@�"R%�m������" 'e��+�款q��}�OV�'�=Wk���/�2P�����˶5VB]P�} ʴ��}��q�C� r ��Y2�&�xc9G/�R�;;�� �+��z�龽���x�5����o�N��Hs��*�-["g��cL�U�AkG�M_Sk�^L��A���Ѕ���Tt�� 5��8����¨Q���{��\gr3����~3)áb�1P�Z�̠c{��Of�ߦ����T43�P������?M�8��J�L@�����S�_.�Lu���SQӸ�/OG���h+T���Ě��%g)w���w� )K\�/� ��8�R��#�H9���2k�@�~�=3Ҽ�,%cI�,3;[j�;%�V��{�����+�r��x��dc�+�虡a_�n.z֯H�ކv�65Iv���*���dn�5�;��h �t� �0���� 3�~F��b'J�[@��ߪW����*wQ� T�á�ȽA�j�G$?��ͺ����?��\��t]��3�j@-�P�!Mx)s��U6�^��5W�}n<�>Q,5���zm�Eg%y��&�}?67o����UR����\�h�`m�Q���j����P����z<HF��Gp�1�[��N�����Q���=ߵ���@{:��]r.�z��:{a��]:���덀���n��C� �쑜�z�/!��f��.���5̓�GgQru�R�V��D�������X�T=����~X��h?$}ݦA��R���`�%��<��Ż7��\I/� +ͦ�����ޯj��^�=�x��~����x�P؍������Kn.�Ⱦ80��D�T���g�6�1OT�8��Z[(��Xs�%F2����_DžBM��_WIus���.���P�Ozq̸j�d����ץ�W�4HªpQ�N^�n�i� ��:�]�/��-Ԋ㷄M��y��nP����R�M�g��5���+�P�`��(y�;�hF�m��Fa��2��_h�ku�a/�z#�����[�wG�/D�0پq��/(��Fm��֘n������q��8�Ƨq,X,��t�g�gTM��9�\f%���ǥoXE\��g n5��%���z���X$3�VWKL�f���<&�RVFgL������u�ja-���_�pe4U�VcT�l�c�y��!`T��jgjg�s+���f$�`�+u7��ݕLh�EH(�y���^����q6W�lj%'����:�� �v�|���x��>�tS�� v��":b�@b�ȩ)w��G�f%�Q�v�|�y�);\�̜+�����dҔ��+R�'߳<�� }�V��v��$q X�t���0�x�Wr>�����o/�G��c*{�%D�;Μ�#��fJ�l%V�5�3Q:�~(6��JS�Mg\���\:\�P���v�'���E�[I�K��D�ayΤK.�2u��U�||F�'i ���%���G�? ��mJ�G="��������Qۨ�K�"H�7K��,{F[��4�o%�Η��+ �Y��JYn��E��At���-��N����$�ݒM���^�Y���h^sNA=B�u���ݱq��ry^�1I�%R�]�c��m�\��S���B���Ƅ嬠���S - ܚ���r���P_>�X��[D|��É1ؼ�o���A5�@�ְ[Fת_!����]�n��+n�>z��^�Q<�g[wŗ9fa飅\���8��}8 ���}�p��0����ʬ�ee'��1�d��w�Q7t��fԜ�ŵ��[$��Д� �^�);҈p�v���3��BG�3%�kY��a�/�G���u��y�� Yz�v����.0X��]�"Aߟ�z��j����͊�� �I��=?�>n�'\ �o��S�]�,�`/�(����Ŧ}���vV��a����Fm��Z-`�7�f=��4�JA��P��.�g0Q:��/��>^�����I���)R��1:��J p�����^���E!]��HTy߁�[email protected]"�����Ȗ�w��yi��]m�5�m��c3�IH@�0�BX��B��p��L%��Ư?�+#�\!u'� :ԒQ�_�q�t@�w�_ �O��s~cX�XW(� hU����� ����K�%w\I�x��>|���X���(����jPO��3�疼_}�4��Ў�|tqpZKs2�բe8j��k��hf�~ĝ%Mz���>�,�J��?{���ϗ��?Ce�N+�:E���4�lxkd�m.�M��vȂ:ŪE����wpz�����P�QZ�{��N�N��X�f�vG�w��T�>��oH���ɽ~���ݍ�\��R�n&��9x��t���b�]��褧����� ����� s��Y¯"7-�G;#@M����tmN,�bap{X �Ьy{}���7/`W�C�P�Q!!}!o��Ѳ?���5��>|���,t�{�#`E.��y�V��yec�-����2�?[F��Z'*���#�:�n'i̐��@`��uw?��&V�gCj���/��E�J�3�����z:�r [�F�8�}��=!3���>@�K���*!D�%Y����kv����b]�v�T��I��~�s g�������F��� -k4jچ\�S���Ԟ�f���n˖%,5DU���'��e���p��o�Л�9L͈w��Hy�5��o$��k�Z����������ϕ'Aɗ��pz���F�L��R���A�RU�����%5A)���0^��g��<��.>d�gy˲�[�;�I�R��Ւ�0g)�+O�-\]���*����N(�w�3(}8�K@P�F�NZ
Static task
static1
Behavioral task
behavioral1
Sample
1532ee54b564d8c1e9639d6b0cd228a524cc79debd34a2e752f5fa2990341fb7N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
1532ee54b564d8c1e9639d6b0cd228a524cc79debd34a2e752f5fa2990341fb7N.exe
Resource
win10v2004-20240802-en
General
-
Target
1532ee54b564d8c1e9639d6b0cd228a524cc79debd34a2e752f5fa2990341fb7N
-
Size
7.3MB
-
MD5
c742a0d0d91f289ad8279caf0cd7f750
-
SHA1
12c6c66b92ef9256c02becd137c778bda6de162a
-
SHA256
1532ee54b564d8c1e9639d6b0cd228a524cc79debd34a2e752f5fa2990341fb7
-
SHA512
2b5944b51d244a08440eec0d928a7c540c9361c6001b76b03068c886ad63861bd94d6463c4b34ef6e5aa23b49b1bcc073ab60a1c63e6de44a2e5e8293e815f6a
-
SSDEEP
196608:sREEj5wzcTdhZIaiKquFfKlDTs7n9yKQWJmzmKx3kb/8WcR:sR1jGcbZIaiKXzQWemQrX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1532ee54b564d8c1e9639d6b0cd228a524cc79debd34a2e752f5fa2990341fb7N
Files
-
1532ee54b564d8c1e9639d6b0cd228a524cc79debd34a2e752f5fa2990341fb7N.exe windows:6 windows x86 arch:x86
ac8b135716e17c472fb5732cb9e5902f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteProcessMemory
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
vcruntime140
__CxxFrameHandler3
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 13.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fat0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.fat1 Size: 7.3MB - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ