B��� N@ e9���<���aY�2M��nO��ͫ��>��\P`�ضx �,���00�aȹ�B�s�j�N��\ƺK�=����a����&s�.�a\^��aZ����"ڞ��W�����}X�C?�'&������w8O|d��L�PB�8���/5]�J9 y,�% @��D�9uF�A�j:�~H3;�q�f%����Q�l{��ި(&;8�8���g��l�ý�c�^�����]G�+�d�J��er�R�P�����t��S�cXA����u��nQذ����0`39�k�+��e��`���Y��ؤ��b���橞�I��Y��B�y�� ѰUU~R�Je"����zg���ѹ%�g_x�Q�Δ�v�Iю�[RE���[t5�|>0*(�E�\iC� |WfR&me�@.s<�ۈ僮�2����GEI��3�i��zZL���5��r��0�y��7CE(�<�M���M�!*K���u��r3$�y��:���V��1�����JZx�lv�m���z�M���nL��r��)�Z�~��q �n�#LD�E_� ��Y��[GH��B�U�>��9w4�]Ia��� 6�w���,��^�lB�8�����l܊d��D\��=rY��K7�k!Ul%n1q���]h�ϕ�~ �zYp�G��o[r.����F�j��������쐀�-�b�@)����,�$��{Vo���#��e����Kyh��jd.a�w��y1�h��]��@%��9�=�ÂZ�PB�K���f��)l ?�r����4�m�N�.e%���@�SC���>t����R��G����@J�eh����*����O���U�uw=f�,r��Dv��K~���0&k�epw����� ��E�n|�Ig��$��O��R��E�9����e���+(�E��ۯUǸ��Aû��L5m�SAar�+�x^{� �k���a��5]H|m���x�L��>*n�B��r�T|>�k)��@[N݃*����2��{�����-J��8�X�C9V/���$�?�0Z!�CV�6~Ӄ �H�N\���@��Oh� ����H��չ��?�/P��V@���*��5��g㱒W O����{#����%HTC-��0:�l&��\�:�S�?�7N ?ܳ=��D5)~���y���L��MBVQU�dcg����Ї�vx����>,��ҁF��6�-��-z�D?����F�?���5J��GK������n��s��|��� ��+B��ϻu�^<���� ��r�M�ik���Җ�5��������RR��C��^%A��g�[OW�{�ke��s�?9�N��szq�x�3l �_r����:��㑨45կ��\�� "�[I \?S��$P����Q�2������k%���mV�r�h���XIqa'���r�|�|�F�a���r!ǿ@�P��78��� 4L��B�r_G+��cy,]:-ap Jy��F��RNy��a֜�˰�W��O�~�u�O`�����z�ù����p:4�x�/r�(`��K��k�cZĹ��O�����_�5:�eL^�����3�o`X�PX�h+�cr�C4��`ϥf�c%���{�29�hCec�w\g5u�9�����47���=���g;�>��I��U)�j�¢L���Y�� ��uK����K\WF�L}��:2'3m|�����5G0D�u�%�Q����|��b�����[�ϕ���JJ�m�ԍ[ko.�����]�q��s�/�� o;�<�����Pp�ya��xt�� [%[��:���Rxǀ�淿�V�^9q3��ń�Lu��=G�c�8]����jr� �o���,+㙚�b$��_�6�wj9f��%�������-+ň�ū�� R���l�%�F�����O�����z��T�.�6��6'Ab̌W~D���4�!,$ǂ��5�W�_�6#�+aW�dp��.ET�H��-����15^0;(T�{n�*!QQ]���d����(��D=g<V�+�Zus�j�#� ��y���oQ�˾��=�n��;�����&�d��Jا/Lu�K�.N�ޣ8�I����i����"#�R����u]�e̙�3�M����j%f�f��AV��3��帛CyfO 5O�01#F�|)�^�Dʔ{�e�'i�=���|-ч���x��N^RS���k�gՓ �&���v�^47̴3M��7Ka���j �&ˍ��㯕�7�.M�c�7}m�e�ّ�1B�.$S�9X�Vފ���pFj��K���॒�o� �B�WsU���*k���Vtݣ�xk-��� �(i� ����9���q/���n�|��������A���=�s�j0�. �Z��3iHں�SѢ+��(�-�E,�:]Z�tf�|��g1Y�ϹH�\HE��@�ܭ������4�b��6wB��B���|�$$�� �.֒Xz_/r��ژ�']��;�g�k)�� Z����]��Ta|��3_�q��ƃV�� 6�^$4� �L�qkn�M|�N?ʱ�fq����'S�M��M�a�OY2�[�I����/���wz�)e�����H��8��F>�k5D;f�!����{����s�Ĕ�h\�Dg���O&n�D0 *_cϵ�Lz����S�!�"���m��p���Rٕ�:�%�Đ�Ņp�[��r���A�1��V��2Te��F'oJm���P�6+驍l��$��aÅ,�9ndNO��LJ�p&�X\$���#죖7�j���*?Knv0gi��M��ۖvD~�0,L�<9B7@lf�Z�ʻ5�6KZf���ZB#t+�r'{"�������I��ie ,�h�<�D,lPL`O�}mx��8 �_~��|`�r$=>����>�O���F��}�8i��d�xy��I�;��v���@�e+���x�7;��1K�sX ��T�6k����.�i|�*;����ĽTr�`�����u�$5dRm�%�,����XM�g��殻fdzY�zߏ<�X<u�� V�R[���:�ma6�9�%��F%�\�/��lݐIX��Vm"*#?���^;� �]_�J���
Static task
static1
Behavioral task
behavioral1
Sample
7041cc0ab70ef89f6bf6e50fdc4b07ef3c00fda8ff62e48d5c4a5e4ec8a5def6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7041cc0ab70ef89f6bf6e50fdc4b07ef3c00fda8ff62e48d5c4a5e4ec8a5def6.exe
Resource
win10v2004-20241007-en
General
-
Target
7041cc0ab70ef89f6bf6e50fdc4b07ef3c00fda8ff62e48d5c4a5e4ec8a5def6
-
Size
6.1MB
-
MD5
101c331ab9af5549c7a823cd6ef0bbc8
-
SHA1
58ea2d838ee9bc099c5b15bdb013a289da924b22
-
SHA256
7041cc0ab70ef89f6bf6e50fdc4b07ef3c00fda8ff62e48d5c4a5e4ec8a5def6
-
SHA512
18945422ed3c0b49928b42f9f4b16fba7a79e4bfbed3433854a3264f89c6789584eaaf1436e3f1722937730318f2a464ae6bdd684012643a71ff8f6e49f19631
-
SSDEEP
98304:4+xOBJrGvFzbRgOIVfv0EGGSUTsXUv1fLB9eRc0Ajxelfh4m7jjfckLV83kC84M9:gBJryaOUfv04qift4Mj8l5R9LK9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7041cc0ab70ef89f6bf6e50fdc4b07ef3c00fda8ff62e48d5c4a5e4ec8a5def6
Files
-
7041cc0ab70ef89f6bf6e50fdc4b07ef3c00fda8ff62e48d5c4a5e4ec8a5def6.exe windows:5 windows x86 arch:x86
4aa8f8c573ff51c0523c2bd868b154b9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
������ȡ2.0
ord10
msvbvm60
__vbaVarSub
__vbaStrI2
__vbaNextEachAry
_CIcos
_adj_fptan
__vbaHresultCheck
__vbaStrI4
__vbaVarMove
__vbaVarVargNofree
__vbaCyMul
__vbaAryMove
__vbaFreeVar
ord588
__vbaLineInputStr
__vbaStrVarMove
__vbaLenBstr
__vbaPut3
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaPut4
ord698
__vbaFreeObjList
ord516
__vbaStrErrVarCopy
ord517
_adj_fprem1
__vbaRecAnsiToUni
ord626
ord519
ord550
__vbaCopyBytes
__vbaForEachCollAd
__vbaStrCat
ord552
ord553
ord660
__vbaLsetFixstr
ord661
__vbaStrDate
__vbaRecDestruct
__vbaSetSystemError
__vbaLenBstrB
ord662
__vbaHresultCheckObj
ord556
__vbaLenVar
ord558
_adj_fdiv_m32
ord666
__vbaAryVar
__vbaAryDestruct
__vbaLateMemSt
__vbaCyErrVar
ord593
__vbaExitProc
ord594
__vbaFileCloseAll
__vbaCyAdd
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
ord598
__vbaCyStr
ord520
__vbaStrFixstr
__vbaFPFix
__vbaRefVarAry
__vbaVargVar
__vbaFpR8
__vbaBoolVarNull
__vbaVarTstLt
_CIsin
__vbaErase
ord709
ord631
__vbaVargVarMove
__vbaVarCmpGt
ord525
ord632
__vbaChkstk
__vbaFileClose
__vbaCyVar
ord526
EVENT_SINK_AddRef
ord527
ord528
__vbaGenerateBoundsError
ord529
__vbaGet3
__vbaCyI2
__vbaStrCmp
__vbaVarTstEq
__vbaPutOwner3
__vbaAryConstruct2
__vbaDateR8
__vbaCyI4
__vbaObjVar
ord561
__vbaI2I4
__vbaPrintObj
DllFunctionCall
__vbaVarLateMemSt
__vbaCySub
__vbaFpUI1
__vbaCastObjVar
__vbaStrR4
__vbaRedimPreserve
__vbaLbound
_adj_fpatan
__vbaR4Var
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaR8Cy
__vbaStrR8
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
__vbaUI1I2
_CIsqrt
__vbaLateIdCallSt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaStrUI1
ord710
__vbaVarMul
__vbaUI1I4
__vbaStr2Vec
__vbaFpCmpCy
__vbaExceptHandler
ord711
ord605
__vbaPrintFile
ord712
__vbaStrToUnicode
__vbaDateStr
ord606
_adj_fprem
_adj_fdivr_m64
__vbaVarDiv
ord607
ord608
ord716
__vbaFPException
ord717
__vbaInStrVar
__vbaGetOwner3
__vbaStrVarVal
__vbaUbound
__vbaGetOwner4
__vbaVarCat
ord535
__vbaDateVar
__vbaI2Var
__vbaLsetFixstrFree
ord537
__vbaFileSeek
ord644
ord645
ord538
_CIlog
ord539
__vbaErrorOverflow
__vbaFileOpen
ord648
ord570
__vbaVar2Vec
__vbaR8Str
__vbaInStr
__vbaNew2
ord571
__vbaCyMulI2
_adj_fdiv_m32i
_adj_fdivr_m32i
ord573
__vbaStrCopy
__vbaI4Str
ord681
__vbaVarNot
__vbaVarCmpLt
__vbaFreeStrList
_adj_fdivr_m32
__vbaR8Var
__vbaPowerR8
_adj_fdiv_r
ord578
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaForEachAry
ord610
__vbaFpCy
__vbaLateMemCall
__vbaVarAdd
__vbaAryLock
ord612
__vbaStrToAnsi
__vbaVarDup
__vbaFpI2
__vbaVarLateMemCallLd
__vbaVarCopy
ord616
__vbaFpI4
ord617
__vbaCyAbs
__vbaLateMemCallLd
__vbaRecDestructAnsi
__vbaVarSetObjAddref
_CIatan
ord540
ord618
__vbaAryCopy
__vbaStrMove
__vbaCastObj
ord541
__vbaStrVarCopy
ord619
__vbaI4Cy
ord542
ord543
ord650
_allmul
ord544
__vbaLateIdSt
ord545
_CItan
__vbaNextEachCollAd
ord546
ord547
__vbaAryUnlock
ord548
_CIexp
__vbaMidStmtBstr
__vbaStrCy
__vbaFreeStr
__vbaFreeObj
ord581
kernel32
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
WriteConsoleW
SetStdHandle
IsProcessorFeaturePresent
DecodePointer
GetCommandLineA
RaiseException
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringW
GetStringTypeW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapSize
WriteFile
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Qxm Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.qR3 Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.$k$ Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 492KB - Virtual size: 489KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ