<=���ȋ6n2��T��?��I�� 1���@(i ��,�aM1�L.�<;�+��#/��/[�P�W�(�kv8�}�K|��ÍV�1�"/�%�*mY0c�O�6��5EIW03z~A'��p������cć��+�P?�죱PB����y�^����;�`������jSq���t6 ��)��fW|H Z.�.���X�"o)��%��w<��\�Aj�%�]A�Tf�-�X����K�-.��jIW�본��i2L�_+�`�b&�<%�(Dz���XW��6���ϰ��+����|R9}� �>�8�F�Z֠�OBL ��1y�{L�oӏ%��zw�y~]� 0�1�/� �i-D5j���ځA�uN7|\ؾ���_K^8����^���1ga�?��X��)����-�+�c|cп�"��>��:���+> �y.��%F_��C�ɝL8k �f�:x,�Ġ ��C�{���ף≷Lֿ*�4��*9:N�#ٿ�.��&aKNwͲ�b�O�}�+��*�����x�LJ�Eyf3��13��7�NeMyQ����f�ooz��9�N7�ꉮ����X�X�� �}��Բ��,� �>E ���},�ƇȰ��MS�2��I���՝T��t2�����,�aA��\��-<�{��^�`������4� ���[�H������-_���|���7Z��/B���e����·��)����dӼ��z�S�>��*8�ヌw�v3��Z4+v{ �[TVn�n���gQ��@�'�?j�4զ]�ye�,�}��YT`ؕ7�v XDn��B �W<�G�|��N�i�(\f!������"kK�;����)&w�㧟�v����E'/3.˖���b�&��<�߰�iacK�Y�Ee���������ךq�.����[ �Vb��3't(�~C�lHi��r.nޣ��m��M�3J'��N�g9���C��,1D�@���� �&�"Ļ�(��ׇ؆?K'���ۅ��\���7�l�tA�*�M�6�X�hyo�TK.+;���B�"\��՜Z��/N��_���sbG;�=D�n��[D�I$�:����G�A�z��K�X�Ë��l�_a}}��]��]#u\T2+#�����kHH�ɲt��5\x*�zƮ>ҿsJ �3��Eb��J�����p%|����SV�Kp/"�kW��3�VU\�΅V!�H�V�A}�?n7M$�k3�L,t>)6��L��Z�L��J߄��T��-���hm�X�t��s��H�_uu�%���-�p](]�1�ta_x����N�TaC��{����-B��� 6f�i�tRo1������"��F0�=�L��Wy�F7%������yƅ�Q�_Ϋy�dY|eh�:���v�q��Hz�p�2AN����*.�-5�=���$5���t.��\h����צ�K����߭e1?�\�����I0���H2��J�PbV��HG�!TH�`^�Es�S�*LO>)7��� j��9��I�bY~Ƙo؇�2.�4��L��a���Vm�h�mW�"�rW��-�Tk6��MF���d���Ǎ ����Ⴥr~a��/���o���� C��r�E ��U���j��F�� ���\jbnQ"π2C��otX��;!y�����k�7�䍆�}��_0��� �M�DCp�����������;b?�z������}1���=���'��"��)f�_r/,�j�`�yg���ZO[i����������V_�ʞ M�Z;+.H��S'�^�3�?��]8�X q��x��[�b ���Z���8��I �g��"$�k�M8�ͫ]��\p��p@�m$����q����;���Q� /&��m-�?��D*c�����~X9&�]�� ��d� �H>g)]�������(�م�m`�� ZɥX]b(�`�RyuM���r��8;��Ξ�[�w��O)�S������N�� qJh�{j��jYrMK��5�,���s�Iem�������Eo�JŐF�� �%���mo4��� s �(���(�ߛ�WJ�I���:���!�(���*\�aϴ�Xs�&�'�Cҡu��_�sj1h���WvO%��k�C��eG �����L�����xc��١����;�h�̴E)5Mj��Ae�t|� 3p���tP���"^6B�AI�݉ebYj�����,��H,��et�A���h<lb �����jWVAa��4�}�5]M���=�EJ}^L�����`��{�6���X�ݴ�� sT�#�̛'��4�������I����,@=�0�h^�̈́��q���u3?��~<�6v�3�V���>t� �����bh��P�l�6���o=�mg�S�� �?�t��D���4��7�V��WJb=�LxD��-g�&#o�(�\~���,���sp��W�K7�n-s�kd@S?�2'/�%^s��;�0tx ז#���Jֈ�Y?�r�fQ�AƉ����h&�K�1�)�]�"o�>F�à���Ն��%�>z6Sx���0�Je�3���]���wB^��Ip3qO)�B<J���e��� ��7P�̴�.��/��*(�̫@���gPVZG��S�����ΝO���Gp �W_�na}ၡW|�D�Ľ&���e�M�A���:-��!̖�E\��ͧ�+WU� ���A�Na��t�����Zq֮���o�� ����p�&��C��=�(w�A���C�1C���Sg�vi�Վ�|�����Y G`��'�[Y/�Z lΰ~�@b:W�J�H:���f�~0/�s��@E�M�����{w���eӧ��{ٽ���]�l�i��b#O���X�\��VW?�ԣ�V �l�����$n?��L��c�ڨ,�)uT��_��, ]����%Z�_Y��%j���p���� �\��%c"��=JtZ'8̊��=���>~�/�}� ���m'F��C/h��������fr:�3���>��4��dF����P���g���g���0�9��y��b�����߷�d\��5 �=F�U��� z��AU
Static task
static1
Behavioral task
behavioral1
Sample
f2b45a512a8c3586df555d52c068f516dd0bab1c8a24467bdf3e72055312185dN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f2b45a512a8c3586df555d52c068f516dd0bab1c8a24467bdf3e72055312185dN.exe
Resource
win10v2004-20241007-en
General
-
Target
f2b45a512a8c3586df555d52c068f516dd0bab1c8a24467bdf3e72055312185dN.exe
-
Size
5.3MB
-
MD5
37bc24bd5ce2067bdb0c34c0ca414c00
-
SHA1
3d7b67e7370d79533cb984330f21e5f5c5b9479a
-
SHA256
f2b45a512a8c3586df555d52c068f516dd0bab1c8a24467bdf3e72055312185d
-
SHA512
bf4fe4f5139bd206792b645509aaf42be2d58d3f003a497c799bbd3d860ec5c9193f781e4d1525ddd9f7798f8395d21e96ed74ceeb52c0ab43df3d642758ad8a
-
SSDEEP
98304:aOQGc830HeOIk0ons6U523lPWZIERFog7icldle+HJFD:hrj30qkXnsr2YIIog7if+HJF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f2b45a512a8c3586df555d52c068f516dd0bab1c8a24467bdf3e72055312185dN.exe
Files
-
f2b45a512a8c3586df555d52c068f516dd0bab1c8a24467bdf3e72055312185dN.exe.exe windows:6 windows x86 arch:x86
80d7645077f68672ad71e69f9e52e664
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?uncaught_exceptions@std@@YAHXZ
shlwapi
PathUnquoteSpacesW
vcruntime140
memmove
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.malte06 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.malte06 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ