?P�#�/���=���%j:�N��\쵥����q��u͗-�\>���}7u�:x̒��j�+�(V�p�CbPFAc�Yu���Q;�Έ-�#>�uP��0�j��lەe�m����E���7��=?�}Ȳ��h�oJy�t��P��cB�)���ތ%�*L^�)�.���?Hv��-���A��E����ǿ `���j��Sk-D�L���[�9�a<j %�#4i�ٜ���1\+���{�5"�ʿ�B����1��/cZ]�5�2�c�eY�6�@Źn�B�(�`�y�CAm@f5Z6�Jgw`,����`b�v�oJ�$?nf� ��?Q�XO���g���o����!8KC����/�o1�k���{�ǵ������^n �xyB!r��9߰*�)��ӀGl���ZT��C�91j���%�X�߾O�h�c�Y�Մv�|$9kK���>9}�"���E�PI��$��6�,1���^oc6��?�ھ���6pCQk��ss���"{��~N�����C����ځ�ۼZJ�I%�b���;�������k���m܈,���X1����F��%2}:4��<�e�/��;J��c<��+3���P�m>Xs��"r�vs��ǻtٻd�]4�H*6B���MҰ?8Ü��I�q�o�l `��6��\�9L2�|[�"���m���,��"�'f�o.��9����r3��7��,��#��� ��?u�4����[9��$?�����d�\话�lҰJڑt0;5g�_7K�m���d��Q�SJ�Gx�t/���S��U�<R�Ċ�?�^!���]C�W +I�4F��f(�����aÎR���E{-�:�������.n�{"���2ip�d/�~�}4:������Y�t��UP���W��{S��<"H t��TI� ���3������qC���B�����0]})x�٭��[#�: 2ӭ��A�|�|� 3�¿^���,��9�v���P��RN�܀F�35�?�{6~�~�Ll��b�����~-`O���.�Lx��!��'h'�1�2"t��Ȳ��^� M�{��w\����^I^J1Ĭ\油�M�Yq��i�l�"%����r]�X�xgV3�ں��E��t����(�7���EÇ͜ i؎>���X�L **Ww�&���p\�Ƞ^���e�7�3�.c��e��H���([v-��Xr�w�cr��߈�l|����-�̣�MpX˨d|-x4z���&0�w�r�����ؖ�,j� S��<x�:iᇆ,l߂����0�~��SJ�U'�KI�X/K��ٔO���I+�y������v���EX�/g#.,�b'���O�sD<�x���j �/��z%�v~�+��5?�:�B8���2�����H �����gĸ]՞Z,�e)����[3���u lD�֢�M1�� �=:�i�=)�/��)a2+rB"UxF;�(���˺C���yD*}�0���v9�*f�:�����@�g2#��('U�b���1ҟǃ���OK�зc�Fș���b0Y0�i��&�u����J>�4rN��� -��MVz�&�}n���)���a5gJ=ٺ�Rbu>d� ��=eTݺR�}�/DYOR��qk���P���g qh�a^�QV��K�:2��t�W���+Sy�/(�~�G���f�,0���/!]��d픷X������TD0��hLw�ZN��1Z���I��FFc�0>��7�9�*�я��k�����c�g�M�ؚ�J�t�V� � w�������+E�^�l�,]$� ��YQ��{�������pg�T�SԔ�}p�m�+Jea�%pK�ByKwy(���d��8����&3wTܺ���QQ�,����S (y�� �:���bIFr� t"]=Y�i�;4��i����x�7�b�y�V��_�����/8d-o�`�����}a{$ԽU�� sA"��Joh,�;�4�]�b@E.X�l�g��y�4;u����y`�'*�r�}�����a�Rf�8����r-t�n����֒�x ����BQ /��Кً@�0-� [���:ۻh�4�����������5�������!+�u �(X�}Fy5`�?��=�>a-F�(�.,��U\�^M����v�JZ&�@���/Ť��0�DI�Q�{�^������1#�'�� ���V%��W����4W*M�O�I�:�\V�����*Bf ��f����J]=���y��Ⱦ��ɡ��pu� \+H��c��L��t��A�ԾՃ]�W��_�,2WC�V��Q�_���@K�n�Ƭ�f��fQ���zo�}��5?&M��AůChc-G�㟵�d�|��5u��wJ0��\���y�����T��|�a2���5~/�* �}�̴��9� "���m�U;�A�� ��J�+nva�\�9�(��B���~ʀN"(C��zJΥ/�����*9�;�^aږ��"v��WƁ���K�;T���l�x\P2�q)\�*��p�6����>Xj��s�:ߔ?�M~ά�[p�X�7Ȉc����v����2�����~��h����)��|[X9w��)p���m2)pG��]^w�n��Ku!n(�Ƒ A,[���}ƌyO^�8<r9�;����S�)���N[��L�)5���v����ͭħ�z�Fo�nP{d+����j�gP��l,زp�g@�jؒ�˱�� R`��̤��d��c<��rU�91m�2`�Fr�}-�p�C@!��d��TɁ�0�Ɏ���A�`�nK!��?� �=��!��B{�c�� �/,E�p �G�N�Vr_7fY�D$e��1�Q���Rf���_!����6�գV�u�ah3���ԕM��?ԙ����$$ϧ���?�7�����1�� �.C�����YH���E�JOA�E�C������6>n��9�����0��\Y����]4}dJg�W�;��u��\��pUs��>�3~j�7�Ž�8���s4\V�kC*N�EL���w�i����WM�z=�J'�(p:#;G�;,���.���v �)}\�y�����-[��
Static task
static1
Behavioral task
behavioral1
Sample
3b46f85bcddaf4b46c20ecee2f7f1c6294849fa82e62219e629ecb4bff3cd6a3N.exe
Resource
win7-20241010-en
General
-
Target
3b46f85bcddaf4b46c20ecee2f7f1c6294849fa82e62219e629ecb4bff3cd6a3N
-
Size
2.9MB
-
MD5
3eb10cd97fca8e1421e3e37d562c7730
-
SHA1
77902d4839813b5a56913bed3806251f8b824818
-
SHA256
3b46f85bcddaf4b46c20ecee2f7f1c6294849fa82e62219e629ecb4bff3cd6a3
-
SHA512
291f5b6558f5bb31c9c77f6a6250a6412a2fb92f72c4ad3e21868130e904fabcf7a36fd7f3f44ed3218f3496a7db3ed322aa4090521f4a5a1d5b95bc90f752ed
-
SSDEEP
49152:6QY3W/gI8qqmXBZEKUS5fR51rvzCGMUcW8LEjPQzUckWqkZdKt9Pw/B4WlLvdgc/:A3W/g6q6SZmhbeYQEjPQzr2kZdOOB+/q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3b46f85bcddaf4b46c20ecee2f7f1c6294849fa82e62219e629ecb4bff3cd6a3N
Files
-
3b46f85bcddaf4b46c20ecee2f7f1c6294849fa82e62219e629ecb4bff3cd6a3N.exe windows:5 windows x86 arch:x86
64f7eb0166f04162eb58999f7d5f5294
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
winmm
midiOutReset
ws2_32
accept
kernel32
GetVersionExA
GetVersion
GetEnvironmentStringsW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
InflateRect
gdi32
CreateCompatibleDC
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
SafeArrayGetDim
comctl32
ord17
wininet
InternetTimeFromSystemTime
comdlg32
GetFileTitleA
Exports
Exports
Sections
CODE Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 791KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 711KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ