�l��� ��:L��^�ܶ�COqh�����{|9��c����{�OA��I���$�o��Q��ر:�GS� jު{�͔�z��f��B��ւn��g��}E8��������� 7�p���4N�LF�����C/ ]�+f#IX�;�].SR�-��'�`c5U�����J_E�x�P�7��|�p��I��Kլ�u<J���b�Q�BYU��F��l��5|=:��Y6H|#cZ�%�gW��I�{�2�A�|{8}1���u�Y��3m�td�soEip����1�x-~���ql��)���z�.��<���������،��ޭ�x(�.3|��j�{����I�Z����P��s'���7��p%�x��"+�J��#�;�c��� G�� ���c[uM���c&� V4�N��B�k$G~y��?~�5tZ�����}��1�k?�V�{���}%2�m%��ӳ�*s��� wz�e!�*�ү��ђ������ ƥ����x_�P������I��ޞ�x�"����V�8��|rr��d5Jݳc���xBX� DSA�k�3�f�����#�}���S�����P���&���C����q3��b��d�V�=P��.���YEA�d~�4��Xs�a~���0d��f vԪ�"�.5\Z���P�X^"��ό���т$� ����2�a���x=���O��������Lɑ �/��O�@\��'*��`�tyW���7־�zJ7U`��}g��tA�P�Lkq��Ĕu�n�4 {���4{�.���r�k?���9���Q�;K1��� J�z�t���1<Z�.���9G��{Rř��G��4��n��Ę�Z���V���-�h\ii��A��������#@FK�Y9&���I��,�|+S��4ȡK���\�Qs��&��� ��O�y;69.�l��v��B��?�/���]u���pF^�����f�Q�a��@uWЀԜ5�<�<�;��q��n�uD2ѣ�I��2�Kty�yʣ�/ML�ߜ���B����3��$g�]���k*�Be���2*n�4P��Pj��&�� $1C� X�%�,��T�� `�cKt�G�����ؒEj�@{}!��W��iC ��UN뺹|]��|���ڣOnc��s_5"���b0��.��g�%��;op�ʊ;����kƠ5�g��(ewZ�I�05n禱��fv�-հě=���r ��ۊ��f�?�D���w���S�A��>�?1��Q�{$��5W�k�u���w-��rx'����_W��7�;V_Z�(�b�`�3��.�����/�gK=p�~���7�~��7np����Y&���{�^�Qևm$o��ξ�o��Kb���eI�.������Y��gX=��63en=bI�~�Q+�k�ސA̤���iNEZ�h�������;������?�bU~�B Xv��|i#'��d�I84T{�����5]�J $�e�?��3H�j��[;����cY�kl_��O���3�B�/��:h���D�Fe��`���Rw��J�)��$�T꽐������m'�ߏ_1X�}�9^�#���. EG�?�_/+���Jy�%�,�F�昸�Gc/g�Fha��yv#�a:˼�~��{�^ȡ&Cq̔��Â����J�A�� \/����~�!��#V�.��5�Q��Q��}h��t�q~)�������(����! ��d��> ��f�P����n��?���MrY��ޯ �h+��'�8�F��w&_h�)��<�7k@v,��� �OSam{��*yቤeF�n\��sb�ޗ�M�[����7����0=d-uM�:���ɋ�^�5"¯AF�v�,���AR�v;7Jc�[�W��E$4#d,\<�� � %iЮ��ԕ�Vo����~� _��a4m�k ͧ/�DI[�£�X�Ԏ������wmZ3�k6DJՄ�x�"<H7x���n�Z����b�6�tGf�||�e���~m�ȡB�u����c�F���Iӓ���Ȧ���&`N��:��0Α���~Ds~��Ii(9�w�B�9j�>�ZKi�m��w��2�/?C�e�{�韗�#�J؝��O���Um�Z��It]�_%CK���t��#��F����%�ձ��տdT"�s��2gւ��|�)V����7�;��y HV�1�m����=��+��Ut������d�i�ߙ+zS/A�-�2ޞ��t�T��:�if~p�u���<^`dq�We��1��9��%m�� ��q�J48��_5p�O(`��ؑU��O2�<��8ۺ���W-�F̬�t�ZpŹG��F㓀�u��M���A��퐓c�O1rA��j{�>]jJ;Ƕ�/�JHlsn��!�P*js��y�����h�B(���!�!p�3}��r�ҭcꮈ%�G��Z�V�aI����h������`�a��zOMy7ƞNXE ����AzGЎ��&j�䊋z��9\.��^�"��\��v��o�2vo�v7���Si��Y�wMp�Qz�*>]�I�0�.I����ۮ����BW��y����sd��tO+q�g����w2���oGY�~��5U���.��MY�n+V�0���nuFsMű���R���s�-�`YI�"���ల]G��s�e��h/�*D�6�����Y �f����*E �t�/;%�T�ht��M&�N��Or����8�f(N�`� {鰤�*����,�y������m�Y����U�pl���0d>�O�?�cĐ�U�x��,�1��<8�S_eM�V�eLʨ���uJ4y����;ob�����0�kv����L,\�?7=N����Fh�:�������� ���P�j�]b�}J߷�L|����`��)R���&�Q$ T霃�d#�P�hv��<Wc�Co_�ݻ���xf������g�Y�? bF$���.�<<q��eh�h��>�AXXV�rP��" ź�Z�{��T�Сճ����U������L)�`Z���&XG���p��п��H�2���14���|��eJ��Ӫ�^h~(r6 ⺟o�U����R�N��w����A��)���&���)�хl˕���P� ��*�?����������݀�2�W,��I>��������<^7��a��(�5�İ�:M �����\��P���
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230220-en
General
-
Target
tmp
-
Size
3.2MB
-
MD5
789abc1df75d0827e9e2e3e054838fae
-
SHA1
6c2135b98e7428b189bcaa8fe3076d46d0b82478
-
SHA256
64fb473a4029d49887d96f6bed34a02fc148894803ab92b8254f3ed9bc911285
-
SHA512
60b8a839f014cf73f5559e3b7a1ac319e445c45e4d7c1f1b8efabdb498fd9b037cc33b8cc00e5859aa511f8ed641a2ea1a4dd7b182cc3bae6c30e075c3f705f7
-
SSDEEP
98304:GWd01ExfeBQ2CYgr1YKB2lF2MgAjWO4G55WO+NWuk:k1IeWvYBo2F2mWL06Nj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tmp
Files
-
tmp.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 140KB - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 42KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE