� �b�@#�{ � �B2݁����:ҁ1�N��ɺp�R�:ʄ�p���L�C�<��KvKg?�����0f�9_�#Nr����z�qݰ������iYX�I��M�:R%o2#X?tK�H���9z5��몶��L�6^j�i*>�����������#WG�w��2����o�J�����-��<��ҠQ���?^r&��M#�b\�������N߇͖���~��2��?M�c��S�n"6���r�������sD��E�D2�*���{4�r�6E��כ� 4v:G�_�����✯���Z�EFP� �}\V��F��Υ6���eCvv�����p��n59���rkT�m�X�͊xrwu�ƾaFx��.Yz��xP`8]��?�Q�HA�(�^i2=�o1��WZX����UK�O'���<@��R2q��ǯ�/&i���L��m>�6��l�O�� �/���à���F�w����/���N-\�= b�9���x�7�7���Pn����wJs�v��gd�I�>���l�֥B�a�3?C���%�4p4X�����#���eJ[;`k�4i�a0S(���1��KǴyB�Eq2f̞�P57M�4����)�^B�mɷڸ֮7��ZШ���_4���I� |>eϬ�~�c�6�s��"=/�)���&�+ț���{����Q����j��m����k%�a�6���[���,{��ᣯ �ܥ;8-���_���t������:����������t��A�|�Q� �I?X%�z��RK����[+�e��#����-��8�)��F�̴�v�]��pl����O�&���:Zh3鰬�����\���7�b�U|�j��3Aqi��ol�tB�r��S!,1S� ��"��]�D�4t�����La w���n���.��U=8J������d�lC���dk��D������H�=��������ى!#��CR,�K���K����L���れ����v�����<��4��*`��tKbn߃�z�.K����ĩY������� >�\� � i��t�蝵^(p�Zx��aҳm-����������\���'��&4�&d�y nI��SJ�wpry��K�%iM��� ��.����$�0��S���Kw=�(B��A 8&��Է��.$%!���)c���ܘ��33�R��&2�L=�N����4�����ld���W�B4���w��KAW�d9<�H��:����tg��� ����j��؎'���2��g���T�ȱG�i�e���m��\`y�XV�m �lf��9�e.0!�J-�ٞNI��#t^���U�������uzD����p�'�.l����z ���5˲�x=&9�X��I���)���.��;� �E����D����u�>�M��/�G�w|�x� ˩�^�C;���!��6/���[s\I�dž������2�yJ�U�h,��(���mS'�ŵ`��[�1���P��&�cN�@���l+�t��)�_��I(7*�U��~��� �aԼ��͑�qKs�z:�w��J�?�R�H:^�ͅ�����>+�Q�Q>����c0����2�H��ܕ���6`XT�{�.��?���i0�˚B���H���f�c�J��/����`� �`M��8�RS��I�^�up2�j����P7r����kqNa� �e�"?������c3xPlj�'LUeR v��Y�qש������l��st�٤ �|#��L���AA�W��;I���ݛR���W�����/���y�ݖ)��7|6��Fw�`b�Y)ʅG�eq�sz/x�K��>�rǻ�~>�����XuQ�-�{����I.��<[�Mw�w)�<,���-}�î&�Aė�C{�wG��-��� �b�og:��Xq��@s�B����/ZGJ0|p� \�+��H��G�ØD2�/��45�8���;��`6��)6�Nb�����rߚŊj��x�[�ؒW�cp�Y��/�H)Â_h2��2�f.�&k�r �l�8���D��:v\jY!���[���(�( �4/�$�3�7��F��A��~e���$�r��E����[QA{4 ��,!5����D5��u�_����J�8�X���xG!A���dR��(��;������h<Jfi���Y�] ������.^k�u`L�\_�Du�� |�Cq�L���)���U�>�x��L2�LjO�G ���.�Y���X���h�A�xf�6�>/�Q���@w�Ш���.(�H�ʤ$6Y�#>ڢ�c�1<�+�{j=m�ԭd���R�kKp�����vő� X��E�҆�Tb;��0�2���zL�=c�_��ML3����iWe��.�z�A�Ð�k���9�-U*�"h����_�W�5��*���q���5�I���&�V������v�+��{ʧ��/��ۅ���؍G���_uW����q�|a�x��h���#� ��X�%�%�w!A���~��P��;,4�N@:t�(I���ԮR~�f��Nqp�`&�(7��V�><�{uP]R�\Y��R";�B�2�4N>y�;����1��I���a}�m�>3�8�w���:�� L�b�� ��*�l�iE�Đ�;��{���ɓN������v��8۔����������e7B�t������h��:`g�i� �ƑCȆv������ ��D�@\wTֳ"F��Z�RML���yv����=��E4�S '�B.zSC���@�p�}G�GΣ]���D>(�-b����f]oO���m�˵_����h�E�4Ԫh�:d��z����� J,&�A'� �� ��kh엽w�;ݎ�ܓC����!������y�Q������٣ð���ā+Z����i�!�<x����ؗ����Ɏ8b/(��E��O��;M���3�5B��)�5�eXn����CRYA&���c�cX�U+��ZT��{�'���5��ղ��Ң�OwW��G;���]}爪�L!�S���`OU�8S ĭ8j�y���Gy�U��aZ�!�(lWtڡU�ɬ��1���ƅe-�6��bĊ*����
Static task
static1
Behavioral task
behavioral1
Sample
f00e78d2f2168d790b736b4fe3362e49b749bf7b40b99749aeb90ef9cd337041N.exe
Resource
win7-20240903-en
General
-
Target
f00e78d2f2168d790b736b4fe3362e49b749bf7b40b99749aeb90ef9cd337041N
-
Size
444KB
-
MD5
44b0b2a74b154c9aac8d1a653acc5be0
-
SHA1
d7867174c6e4ab2c06d5745701b986fb4241a0a4
-
SHA256
f00e78d2f2168d790b736b4fe3362e49b749bf7b40b99749aeb90ef9cd337041
-
SHA512
ccaeb4033276b39eeeb81fa3eab2d68ed229d069a0a1d30ede646a9762b32380996b14bad0947d67ebd9f5ba6ce6f3cff4c32b42a2ac37d89989ce8edb5c69e2
-
SSDEEP
12288:+yv7sEXQg7abyvCEJlm44EWiJcdtbKIHd6Atz:Fv79LoyqsEhEgdtLYoz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f00e78d2f2168d790b736b4fe3362e49b749bf7b40b99749aeb90ef9cd337041N
Files
-
f00e78d2f2168d790b736b4fe3362e49b749bf7b40b99749aeb90ef9cd337041N.exe windows:4 windows x86 arch:x86
65f229b2581b8567a442999cf39da49f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
ExitProcess
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetCommandLineA
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
GetModuleFileNameA
FreeLibrary
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
lstrlenA
lstrcmpiA
WriteProcessMemory
WriteFile
WaitForSingleObject
VirtualProtectEx
VirtualProtect
VirtualFreeEx
VirtualFree
VirtualAllocEx
VirtualAlloc
Sleep
SizeofResource
SetFilePointer
SetFileAttributesA
ReadProcessMemory
ReadFile
OpenProcess
LockResource
LoadResource
LoadLibraryA
GlobalFree
GetVersionExA
GetTickCount
GetProcAddress
GetPrivateProfileStringA
GetPrivateProfileIntA
GetModuleHandleA
GetLastError
GetFileSize
GetFileAttributesA
GetExitCodeThread
GetCurrentProcess
FreeResource
FreeLibrary
FindResourceA
FindFirstFileA
FindClose
ExitProcess
DeleteFileA
CreateRemoteThread
CreateProcessA
CreateMutexA
CreateFileA
CreateDirectoryA
CopyFileA
CloseHandle
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
CharNextA
wvsprintfA
TranslateMessage
ToAscii
SetWindowsHookExA
PeekMessageA
GetWindowThreadProcessId
GetKeyboardState
FindWindowA
DispatchMessageA
CharLowerA
CharUpperA
MessageBoxA
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegEnumValueA
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyA
RegCloseKey
OpenProcessToken
LookupAccountNameA
IsValidSid
GetUserNameA
LsaFreeMemory
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
ConvertSidToStringSidA
CredEnumerateA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ole32
OleInitialize
CoCreateInstance
CoTaskMemFree
StringFromCLSID
pstorec
PStoreCreateInstance
rasapi32
RasGetEntryDialParamsA
RasEnumEntriesA
shell32
SHGetSpecialFolderPathA
crypt32
CryptUnprotectData
Exports
Exports
Sections
CODE Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 544B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 88KB - Virtual size: 320KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 354KB - Virtual size: 354KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ