��8�ͼ���B������f��P�)ϴ땂���#�1 ����F�[糛9e��`=$���q�'O���@u�DZj�,��Si���D� ����]���#����g���vy����3�(���@��|[�7:�����P��9��,7�`ޑJ��zd����q���d�-�C7�+�Au@|��O7_����ML����y�Xq{6~B���:�z��F����$`\ ��5r�{��r�12 Sب�Q�{Yv���P� ?U�"O��eA}l�������*M�r��r1 �� P|��*�y����<t���d7�;�M55z�mS��`G��Hn{��[���<#:ʕl�`�o<%Kت�id��0#�(|�E�KBF �Q7�M����W�5�g��W�7= ����A��� ���\r� Z�0�X冩� ���/�L�"��K�5ۋ�衕����B��/(���P�N��wI����d�1�*������桻��(y_�<���9#�i{�#�b�=� ��p��4�-�H�/��$p��J��W���$z����F�=��*K�˲��.�"�Jl;�����oE;k�d� �n<J��H���v����?��]R�d��"n�X(\k�t9H95�`VV"�wc"��ڗ��r}�˵�� ���D��>�g�����K4���R?Tû�����/O��WS@�֡�_D�%��0c�ƭ�:CN��g��$�DP�f���4�F�F�[q$ �����)s�a����2a} W�5 ��>8�]2�*-e �%/�^/���9�G&�E� K���c H뱂�I������^���Zoڍ�iCל����"3�{��ۄnC �D��;Qg�x�-�s���ޒE��W٥�� Lߔ��������_���8��[q���+=l�T<$�[���B���>̪CN ��d��m~�|�۞���=�}K2���,X��j�n.����M���3�?r߁�D��^�A�lܷ���r��;^�:^0zP�M���+J����GH=c�e���5�v��ܡP�?�^��A��y+tWɎKY�n��ag|1�3���Kہ�DU1`�~��x�����~�<E��$��7�_��tT�2,J�$1U��חg���/5\5ĭ�_a�ԟ���̼�1��>;����������� �I�q$LW�N���5�\�$�9> @0� <��;Wm�a��n�z� ��;�L:�YY���7�ns��= �����8��7�Fee%��EȌ�%���1ę���B?�Ӫ��(��q��;v6�*$��89�B��Y���\������[M��ƾ�@(g0�VkWb��jWӁ����q4�O�2�&�qP^���C�����������#~�z8s��F��$��c�*��?`ux��R>R*=��6i������-�H�CT����c u���5w^�~�X���x� ���Z ����뗵�����`!�� P<�Ū:1�t䫴���}���%�Nģ��)g�����7��d��Nt���a(�z�:�������yd>�`��CF��أ����a*�o )D=�'��Mݍ*�)S����#���A/"N�t�K��i�KS�Smc��{�"���HIO�U��u�.�-�W9 �� EQ��F)�қ���#�2XlJ^Yt�� l/��7B̬��б!�z '��ѱ<o���7J!�VEa/jk彉�2N����L��-�����������,�3^����G�l�d��I.��1l��,���'c��J���y�,���?�,�قٰ��'����;r�WMq�����=�u���}vS�IJ�Q�6��ϓ�Q���Spr���s�*kWZ�@��cՒ�'�j�Z_��hv������qK�s,�-������� MюŰ�Cg�ITd\�g^�^�+��(?�]��q�G�Sv��fW��Bd�[�n�A�������vUkA��]C���/�t�n�������O��~��VbZe�K0�2�N��b X6-+�E��@�o2�I��?�+��r��p�Rg1��ML"Q���a[��䀚���T�-�\��K��.�ޥ�0W!��Ͳ���Q���y�7#SKʹ�n�x���͉I�N��Y�$�įV��]�<��q�jwky&lE��ߑ ������� �-��3��Dz�?;�q��i��.0�Y��M dj��V���B�@��9�$u�K�Ȇ��R0��;�ӷ=�=�B,X��:bWȺĿ�@�8D���uۄ�XK�h�`������bg��F�B/#��O�+��x�J���]�t&~�M�+������3����wa4��V�!;� 51Ӕ���Y�[>����ǧ���Byb�K bL���\���A�Fps-��O��%�J�i�q/t��y2��UK�}���2dT�æP|��4�j�<?\F���P6nw�H&\V��$h o�����S�:t��>c�&n"TNh���)�W�_�D���K�ȕ>h6��+��X?������l����I�4�.�@+��b<�0�폣�n�r{#�A�կ�z�B�#����AUx�����Һ=��5������CҊV��#�gJ��=�nو+q듾uW��<���Ϊً#X/&ST9�z�H0� 55�u?;!Ո�'�q����Ks��ȵ~����>���y ����-����7ؑ�/s�gS�;Ӷ���`�Ij�є�1�L���s����V�����2�b"&#��[i*�J9Avam3#h3����S&�W�0�f`mS M&���q2\�/tS�濒$�g6�h�D�`�"���@�.!7��qzG���ٟ=_x^�KЀ�J��(�)�0lR��Lo�(����I�u<����1��+�vnAv��=wL0}.�8 �h�ҡ6��r�t�� ވb`3=_�b�q<ܔ��i A�O��2�BDO�Wq���D�wM%�x#Lڊ�fle��W��S{����sYrذ�z��X��fY]�K�AB���^͍���bW��]��A�@�w�]�2�R}A�;J�8>� UG�@:�i��������>�G�%�P�.v��;������@1�tHt`$eL�
Static task
static1
Behavioral task
behavioral1
Sample
e90f79e456062cd1c54774b37cd9dba4a9a638a8910b75090471f73565d8389bN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e90f79e456062cd1c54774b37cd9dba4a9a638a8910b75090471f73565d8389bN.exe
Resource
win10v2004-20241007-en
General
-
Target
e90f79e456062cd1c54774b37cd9dba4a9a638a8910b75090471f73565d8389bN
-
Size
2.8MB
-
MD5
3f41a968411555999cc8b19d2a7e11d0
-
SHA1
c11209bd93d04ea229a32b4ff5556c86a4f02603
-
SHA256
e90f79e456062cd1c54774b37cd9dba4a9a638a8910b75090471f73565d8389b
-
SHA512
5170c751a4b2dca252210c40efa3b1ca284c1af413dd67d283f8535384c637411c6d1fddb630347fabe2570529ed95df9fcc6901199b9e03af5dda114328e427
-
SSDEEP
49152:47/BJH+Zar1XkSEItiiTizizUGyafTmhesD0L6VhIHbx+/B1jYdy/7RS2A+2k/xK:6+aRJtXjz1ZfTxsDphIHUdUy/dNA+2k8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e90f79e456062cd1c54774b37cd9dba4a9a638a8910b75090471f73565d8389bN
Files
-
e90f79e456062cd1c54774b37cd9dba4a9a638a8910b75090471f73565d8389bN.exe windows:4 windows x86 arch:x86
4cd9cf51af43eb6b0b30ad27d0b3abd6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
GetProcAddress
ExitProcess
LoadLibraryA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
advapi32
RegCloseKey
oleaut32
SysFreeString
gdi32
CreateFontA
shell32
ShellExecuteA
version
GetFileVersionInfoA
winmm
midiStreamOut
ws2_32
socket
rasapi32
RasGetConnectStatusA
winspool.drv
OpenPrinterA
ole32
CLSIDFromProgID
comctl32
ord17
wininet
InternetCanonicalizeUrlA
comdlg32
ChooseColorA
Exports
Exports
Sections
Size: 400KB - Virtual size: 768KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 208KB - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 28KB - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 128KB - Virtual size: 7.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
1 Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
2 Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE