J��n��}r����@��3�����)��q���yR�9������h<0��:�ܻꉯJ��FW�vHm��G��@����s<<�eO>t��1ܽ��H����.���VZ��3>*Ƌ��^\�>��2`��7<Y���׳E�,�6X�K`I�f5��T�v^+8;��\�(ng�,p�ޮ�,*w���څ��G�/B�?m�:��j����n@��/�}�e�2�%QG|J}gq�}��A&B}�B�F|{]o.��ѡ.98�����h��ZV.���8V�B�rEz�ۊs�Bh5��%�]��Fg��g�l����Z�\�}>yI/<��a�Z�%�x���������l{ђ��v9s��a =�D�_�a+(�ˡ'(�0����B������]���m"7�������M! TKP�c�6�G���?\T�6�y/�E�3��L��y�3�pQ�����M�q�FKzd$�/���]�D\�eS�QKm#Nj�d�Sx`���*�U0 �M��89s��Q ���-h�B`�)4?L��|��B�W����G�N����'��;�xǰ/� !����0YЌ��⤡�i�C(�:�F�}�}��?i儺�'������E�'�9�@��FL��?��Z�3�B7��CԚ ���NI� ����kي�k�YTqQ�'?:��Z'#'q;B]��WQ5�����.{h�(\'���_=�1q� ����#�7>�аS�l`.A�^�K^�m#��� �ᡮW�9�x� SPh�Ҧ��&���K��L��t��Y���ir.����b�)�W��I_@��vH�+/�7�Ww�ӓWJ�,{���0��sC�`M[��D�cN��)��<ʼ����Z���D¸�P��D��5� ��oD�+���Q=dǖF"���|'d�m���;���Aײ�|f�@�(�X8�t�����-�F_ߡRI6 ،U�Xno�d��� 0�;Q����*�>��jD:�0zw�NX��Z���ֺf<q�'��_Dλ�`-*�D�Fʆ��@��똒��w!�(�����W�-TRK��ڇ�� �)�)��ݟ�=�k�/�|���=�kJ������8J^���_�M�K��w魀4D�(tְX�fY%*�AG�+�c�U�"�=���6ͪ\��a���kz�̍���k���(X�LGa�ւ�I&�ĥ��a������e~���|Ĵ1����uy���fފ8?t��V�s��E�+�����VF�Kt�+�[`B��*�[ʐ�X���^�� p ���[#�)I���6���D:gW�������C�}�,���A�eE��������[�Zi܉x��P�+���Py*�.�Yj)X�HI��������1�Ob��4t�w�1�(�(�h;gskԋ�h?v����Q'����F@����9�C��������Y��[N�Y?ı`�>*�ND�������ݘ(�Z�jUV{ l�?cܽ!�W/"x�/FL���?�5)�נ�;X�/I/��HuW��O�$����a�A"*l ���E�ϡ ��1�g�C�kIM ܫ�L����)�s�v>�"(G;5�WS��Ifa\�g�$N�Z��?Uܐ� �A3v6G;�qd1$�OV=��m�jݓwnI�h�/.>��F�}��VUX�Ȼ�*n��Ԧ��V3u���Dz�i�`���2�0���M]���lw���;8���e+/�Q�wMtG�mtD<!B�j~5��S0^�l�:!`f�S��`��� ��h��l�'6��o�?�#0������BJ�R!Xz�I_�昘N�/�6����?����P��H|�m�}�qS;��2^�v�?��ǚ�d�w�Ԧ���z�;���:�S!�#�됞�������)^h��IR̅�&q�b2sQ�� �=�D-0X�-��?Q�3X�.y���zո��Qp�\��E�� ��P�ל�^����{ͻ��{r&�֡*t���H �S��kW��2�^�Z�����eH����m]�F���Ԙ�G�t�*�]��3Oo L�:)���D1�����Kyj'd5�_c��JE�� M� ��ܭ\>r�)"�[�G�+H�5����]���f �R�����|@�&=�ְ��Z�k�=@ UZˣi������xm���)� �$����.C��r�*�����7q��άx��^���fp�����kX��N�� �ur$�PUJ��Xt�)�ߖ��}f�"�%:$�@��X4 ���;,�m�)uMrc��������4�"h�F<Aa^g�� Oi�����^/�a? ��V����<�&��O�\����"=��>��?�ֽA���Σ^�6����cu��"�gvLJ�_Ƈm&2�W{�ͥ��gH�l��+x^A��.3�}^Ȁ!l,���-��X<�z���Sn%����!���kQ�Yin�a��~T� ��O�V�����ã�4��}��8�����S��5����:�\=A(ܳrE噻�l��ɺ.�F�N�'*j�&�T&�Ӧ��#�`�$�G*U��YA���,�OF���7q�4���ݏ�5?4����(@L��Q��[*r>'�f#Ӌ�q��H!���l�O�"��l�jVJ�d��:/ĝ=���ϋ��gg9���3�Y�9^��4���L������i�<V �k�c+�"jo���7�����~��W3I��f�죪b���$(Y�x F�4K�u�^:���)>I�(hJy�p ���=}ŀű��c_)��rHO��4+q_#p��`�)��*�K�\��§Ԩ�����r�hu�8Eȣ� �G���1} ������&���$E`zT���x+�_��f�AA�t��e���@Q *�� ��X;��/��Og�H�N6�wz���Y���ٙ��k������B@f�_�X�]�,�*ÅXZb0�;��V���d���=���[W���t����yy i��O�u��"�u���#��eh/3�3����E�P&��l.�ʟ�e����3� ��Z. |��t2��O����e�X�;��p�I� �۳�s�Oc5Qi>��m+[WԂ��?ɏ��}��: ��(�x�v
Static task
static1
Behavioral task
behavioral1
Sample
4386ddd7ea617c5c6e3f20ce306426518108392cbe803230e3d07232334d4eea.exe
Resource
win7-20230220-en
General
-
Target
4386ddd7ea617c5c6e3f20ce306426518108392cbe803230e3d07232334d4eea
-
Size
4.9MB
-
MD5
911162f6031b2f7059c5ce6c7c03aab8
-
SHA1
438f92cd7923227fc137c56601cce34dc343cf6e
-
SHA256
4386ddd7ea617c5c6e3f20ce306426518108392cbe803230e3d07232334d4eea
-
SHA512
23d91dfed96afd1d05f8f820d986e3a745066085094c38628e782dc3501b49038c4eef74546bb34762df864ac7da2034e8a8e956ffee04e5e7d6b9c0226b3ef5
-
SSDEEP
98304:wJAV0FfczsC4FNVHWmwA6hFnWs8LTgRzFnetFHwSs8hb/AUmobDho:wWCfcuv0ZWs8LkZ8XwSnvbD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4386ddd7ea617c5c6e3f20ce306426518108392cbe803230e3d07232334d4eea
Files
-
4386ddd7ea617c5c6e3f20ce306426518108392cbe803230e3d07232334d4eea.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 549KB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 77KB - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 67KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 173KB - Virtual size: 352KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 182KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 13.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Ying Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE