<=���ȋ6n2��T��?��I�� 1���@(i ��,�aM1�L.�<;�+��#/��/[�P�W�(�kv8�}�K|��ÍV�1�"/�%�*mY0c�O�6��5EIW03z~A'��p������cć��+�P?�죱PB����y�^����;�`������jSq���t6 ��)��fW|H Z.�.���X�"o)��%��w<��\�Aj�%�]A�Tf�-�X����K�-.��jIW�본��i2L�_+�`�b&�<%�(Dz���XW��6���ϰ��+����|R9}� �>�8�F�Z֠�OBL ��1y�{L�oӏ%��zw�y~]� 0�1�/� �i-D5j���ځA�uN7|\ؾ���_K^8����^���1ga�?��X��)����-�+�c|cп�"��>��:���+> �y.��%F_��C�ɝL8k �f�:x,�Ġ ��C�{���ף≷Lֿ*�4��*9:N�#ٿ�.��&aKNwͲ�b�O�}�+��*�����x�LJ�Eyf3��13��7�NeMyQ����f�ooz��9�N7�ꉮ����X�X�� �}��Բ��,� �>E ���},�ƇȰ��MS�2��I���՝T��t2�����,�aA��\��-<�{��^�`������4� ���[�H������-_���|���7Z��/B���e����·��)����dӼ��z�S�>��*8�ヌw�v3��Z4+v{ �[TVn�n���gQ��@�'�?j�4զ]�ye�,�}��YT`ؕ7�v XDn��B �W<�G�|��N�i�(\f!������"kK�;����)&w�㧟�v����E'/3.˖���b�&��<�߰�iacK�Y�Ee���������ךq�.����[ �Vb��3't(�~C�lHi��r.nޣ��m��M�3J'��N�g9���C��,1D�@���� �&�"Ļ�(��ׇ؆?K'���ۅ��\���7�l�tA�*�M�6�X�hyo�TK.+;���B�"\��՜Z��/N��_���sbG;�=D�n��[D�I$�:����G�A�z��K�X�Ë��l�_a}}��]��]#u\T2+#�����kHH�ɲt��5\x*�zƮ>ҿsJ �3��Eb��J�����p%|����SV�Kp/"�kW��3�VU\�΅V!�H�V�A}�?n7M$�k3�L,t>)6��L��Z�L��J߄��T��-���hm�X�t��s��H�_uu�%���-�p](]�1�ta_x����N�TaC��{����-B��� 6f�i�tRo1������"��F0�=�L��Wy�F7%������yƅ�Q�_Ϋy�dY|eh�:���v�q��Hz�p�2AN����*.�-5�=���$5���t.��\h����צ�K����߭e1?�\�����I0���H2��J�PbV��HG�!TH�`^�Es�S�*LO>)7��� j��9��I�bY~Ƙo؇�2.�4��L��a���Vm�h�mW�"�rW��-�Tk6��MF���d���Ǎ ����Ⴥr~a��/���o���� C��r�E ��U���j��F�� ���\jbnQ"π2C��otX��;!y�����k�7�䍆�}��_0��� �M�DCp�����������;b?�z������}1���=���'��"��)f�_r/,�j�`�yg���ZO[i����������V_�ʞ M�Z;+.H��S'�^�3�?��]8�X q��x��[�b ���Z���8��I �g��"$�k�M8�ͫ]��\p��p@�m$����q����;���Q� /&��m-�?��D*c�����~X9&�]�� ��d� �H>g)]�������(�م�m`�� ZɥX]b(�`�RyuM���r��8;��Ξ�[�w��O)�S������N�� qJh�{j��jYrMK��5�,���s�Iem�������Eo�JŐF�� �%���mo4��� s �(���(�ߛ�WJ�I���:���!�(���*\�aϴ�Xs�&�'�Cҡu��_�sj1h���WvO%��k�C��eG �����L�����xc��١����;�h�̴E)5Mj��Ae�t|� 3p���tP���"^6B�AI�݉ebYj�����,��H,��et�A���h<lb �����jWVAa��4�}�5]M���=�EJ}^L�����`��{�6���X�ݴ�� sT�#�̛'��4�������I����,@=�0�h^�̈́��q���u3?��~<�6v�3�V���>t� �����bh��P�l�6���o=�mg�S�� �?�t��D���4��7�V��WJb=�LxD��-g�&#o�(�\~���,���sp��W�K7�n-s�kd@S?�2'/�%^s��;�0tx ז#���Jֈ�Y?�r�fQ�AƉ����h&�K�1�)�]�"o�>F�à���Ն��%�>z6Sx���0�Je�3���]���wB^��Ip3qO)�B<J���e��� ��7P�̴�.��/��*(�̫@���gPVZG��S�����ΝO���Gp �W_�na}ၡW|�D�Ľ&���e�M�A���:-��!̖�E\��ͧ�+WU� ���A�Na��t�����Zq֮���o�� ����p�&��C��=�(w�A���C�1C���Sg�vi�Վ�|�����Y G`��'�[Y/�Z lΰ~�@b:W�J�H:���f�~0/�s��@E�M�����{w���eӧ��{ٽ���]�l�i��b#O���X�\��VW?�ԣ�V �l�����$n?��L��c�ڨ,�)uT��_��, ]����%Z�_Y��%j���p���� �\��%c"��=JtZ'8̊��=���>~�/�}� ���m'F��C/h��������fr:�3���>��4��dF����P���g���g���0�9��y��b�����߷�d\��5 �=F�U��� z��AU
Static task
static1
Behavioral task
behavioral1
Sample
03428e1b9f524d36ba8363eacfed20aee9a03651e0f85827b6d5452b6e4c84baN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
03428e1b9f524d36ba8363eacfed20aee9a03651e0f85827b6d5452b6e4c84baN.exe
Resource
win10v2004-20241007-en
General
-
Target
03428e1b9f524d36ba8363eacfed20aee9a03651e0f85827b6d5452b6e4c84baN.exe
-
Size
5.3MB
-
MD5
c13d6d5a9aa229499ee0ff1f698a2ee0
-
SHA1
2a7ac214047525c963cfd8d1be692c50bdbb9c46
-
SHA256
03428e1b9f524d36ba8363eacfed20aee9a03651e0f85827b6d5452b6e4c84ba
-
SHA512
5c9e4b30dbd6c5414ea04a70b109e6dc9f8287affe014e47ed0797ff63ac904223751557e44bff99cf8ecfce3c8b748cef55c1d3db88905431f4049039042059
-
SSDEEP
98304:aOQGc830HeOIk0ons6U523lPWZIERFog7icldle+HJFD4:hrj30qkXnsr2YIIog7if+HJFs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03428e1b9f524d36ba8363eacfed20aee9a03651e0f85827b6d5452b6e4c84baN.exe
Files
-
03428e1b9f524d36ba8363eacfed20aee9a03651e0f85827b6d5452b6e4c84baN.exe.exe windows:6 windows x86 arch:x86
80d7645077f68672ad71e69f9e52e664
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?uncaught_exceptions@std@@YAHXZ
shlwapi
PathUnquoteSpacesW
vcruntime140
memmove
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.malte06 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.malte06 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ