�����.q�O&���l�\�b��M��F��2-��5�`�Q4y~���?K��E�j?"2u-�@{)����^�^�Ù3H�R�b� ߞ:���0��D���M�0�F���f6�2{�l ��'�t�灧��5���,�i��&�{���z��}��bV��t�0��\�b'��d��y����cɅ�0S��N���n���.|��V�@�1�tl�;%�A����BO�i�3u�EG/�,���$�0N���Н���ʐ���F�CF��%m@��Vʔ C��,�'��0��Cp��E�:�������X�@i$��:BdmLl��E�����#0&3L\��2�_��S����*����O��@�{&�lO3G���*��T��,fC��e���P��(h��a�4�e�����r��ivl�y9[ғ=�)��G�%T/e��XXyW;���Z�/n�A�$��P�v��_yڣ��MK@���z�?�K���A������`�c(�;+�:�7����+f��Ne��S[Jz�@�9!2G��y4��ew� ��*Gp��4��� e��]v&ao�t ��V�����K_�����~���2�����su�����#����/�s�0��]_�Q�? </����)��OJA���]�����'�mc�E,�Jz�� ,&<��X��%^J9Y;K�D���ȼD��0яI5���Y����@�!-�����ލ |ނZ�z����Ϝ��@��KSN�ȭ7���;�E�: �;�G���dC�k8����|vj�m`�ɩsX��/Q#�� S�-� ��{v��]�R���\̦�%sZ2ڔK�ݜ�mN�[s�zhK� ���[�O��>�Etųǀ�[�]�d� ���<įc����G�t1�`]����B�j��y֚�4^q\ 7�i�@����$`ȧ6t��*��p�}��uIVI���� �~"�@q�26���7�d�[.�%�:��a���ͱ�rQb���W@�1��X��qR=InȀ:I�f�ѻLL�+�n�-_�|I�i�O�} \Xb5�LH �|��jr?ؑi�� h������җ{�,�!�[ԅ�;�¹�g��!aB��8��]�B��(y��\��ZF��9$�����1�hx4p�D2��9�7��d�S,�$6<隒i���tJ^�ӄ�M"d��$�9~�o�h��8���?�p��~�U! 1��L��皈�(��L$jg6�� F�|���f7fb/1.���րAT�x ňu�{�ݺ�2Pk���$�1�-�� ������KG���u���g��v��R�t�?JU\8�'ڛ�F��B3*s[���2��\�^=�`�g}ˈ���~z��^~,����/�-(#`�cgν�朇��V� ��c'����;���0b}.C���F���bz��k�i��|pR��Ђ�S *>�:�rg�q�S�W(W�%A�~��v0�����5*B�w���L-k�>9ㅜ|��j��7�aI��h�L���E|r���z?��==����C��l�Dm�ӥ�!��P����$��O ��M���UE�B$�5+�7P��ߢʍ4���ҡ+Mp�Ή���rlq��F�^��6�ؔT��FJ��k����d�B�&܈|L�s���RfVlT�d�)������FQ������W�M���H��#hR�~P�ܦ"g(Qa�`��H �7>��q�?Q0s�I��*�<��_�xj1��t�PY~j\-w��10/��e-\����W�g {uh�������ea3S�]/���Jl�>��x�Z�v�x߫���� �{&���Z4+#����%�P�n6�c�[��L�S*�r���F�(��GIј�� G��!�G/b�铯�o��#n��!��y{��kl�_� �<B�:?a%��ʌ�Dg���ړM{�.��c�b e� rp�J_�ȟ� �Hw@�mG�-g�b�pWv=�r��<���ї��8�U�Onx�:����m��q��q�g����y1���_�|�=�;у�}�Cm�1�('�]�+���V�}��˞}��ͻ5��%��z��@o��{ JޕvZ5-�����Ӆ�g��,�5-/�Y��hjхѴ��B�H(H�pzJ���m�cw&��Oz��۳�)Y�a� ��k�6]u%�f��V1G����+�wo����T-P(cy����F�Ŧ/��� OB��~ ��C�Al��~��i0Q�T��� �����]�yU����8� "%z�͑M�#X��ŝ�l�0�<ğrhk������S����T�^_���>h��g��.g�eDZM���m���R*0ގQ��I=�<w`+�!w@��>R#W��f ����n�{�'g�0OV=�;���'���(`=D�N�Vw��b&6����D�`���J H�C�jU�F�N�G���v����nV��^p�<%�g���}7���{&��g�5���6s���q/�|}lU{����V ǘ�Z��@�}� �8lBu�0���M�ng=�T'��~�|V2H����O9�I֮�ȋf�]%�Ȍ��o��^���U�[����a��1ܘ��n*P�J�;a�����qۃ�k��������[eC:6�\�w�^�?����!�ʓfn`�Jj��՟9:�8�cI�8����h��^��s�E��I=��t#��5". ����Jl�ݹv����x<��r �v���RN֜]�� �hϿ~�k$�!���e���nڦѪ��7��c;�V x�1 ށ^��_:�{��r�|磇�4���[��mDA�)Z��^K!���HS�e�QN3����y-I&�M�Z����@^�M@ܴb�@(kX�&��_RA��n������/��Mx��/�@�g�§܈=t =���/mqm�߭����|U��R��=� ���j6������y��C�Yi��E���M�Ꮌ�\����ޥ*E�ޭ��B)1�j��X+��XT>��Τ�����FeI��a��=�u��~k8Ϛ`�o� NalMq�G�3sQ����"[���g�� �y+F��$��/!ds�ϳ�lB��N/�r����>&��
Static task
static1
Behavioral task
behavioral1
Sample
728bc3ea1f941d385b5787454203a49dd4af985b6f69b81acfa4a5df775c434e.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
728bc3ea1f941d385b5787454203a49dd4af985b6f69b81acfa4a5df775c434e.exe
Resource
win10v2004-20241007-en
General
-
Target
728bc3ea1f941d385b5787454203a49dd4af985b6f69b81acfa4a5df775c434e
-
Size
6.3MB
-
MD5
592dacb77f6d1131f35c70bce8d51648
-
SHA1
5c6e496719ebc9cc231b362e451efb71a9611715
-
SHA256
728bc3ea1f941d385b5787454203a49dd4af985b6f69b81acfa4a5df775c434e
-
SHA512
f6b5234d10e7493eda2305737f108d91122b133a5d5f277d6f0b13b36c1b06f77d69f5911a51c4d0df703686ba51cd524124b97b980c3b08b500461335d76150
-
SSDEEP
98304:7Liu/ALkYW81rAd1SOWBkpcqJCWGkhwOPvQfC2bjOnPOZsjYWrQtBymuW3:/iuY+flcDCQPunWqjY8fmR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 728bc3ea1f941d385b5787454203a49dd4af985b6f69b81acfa4a5df775c434e
Files
-
728bc3ea1f941d385b5787454203a49dd4af985b6f69b81acfa4a5df775c434e.exe windows:5 windows x86 arch:x86
ba95bf885cfc2e57fa7770f96eceaa12
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
advapi32
CloseServiceHandle
user32
GetTopWindow
kernel32
FileTimeToDosDateTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
ExcludeClipRect
version
GetFileVersionInfoA
ole32
RegisterDragDrop
comctl32
ImageList_DragShowNolock
urlmon
URLDownloadToFileA
shell32
SHGetInstanceExplorer
wsock32
accept
winmm
timeGetTime
netapi32
Netbios
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 50KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ