�l��K�@P�n�wS1x4�h��2�E48�q+Ђ��%I��-I/!I����"ǜ3���Oq�z8�Z��)���+}�兹�cٌ!o��YY�3[B�a���$��W*�������i�*i��Y?@2����2�ZH��hl��j!K��]W~H���z<�R�uv��bH+�a���>�R�z��z,z9�H�xY�U� ��� 'j=��]�}�X 8nv��%�����_�����vۛ�:o������##��>�K)��K?�(~���H'�|ϸ��N2�,G������n�*@˷�%l��%���\,0��r+e����L���D��=+��Z����j��s ޫ< ��P'�E���x����x��>����P;�~.1v�ģ��}k�g���O�|M%J%~`"a� f?�$,�b�d,U|rϿ���'�@�[k���{)�r�13竗X!_1��|R:�����eG��;M���]P�)6�i$���*����밸s:��$�b ��!H�2�Ĉ9]�\ژBq�h�5�J��;&Z�o�L[?�R Z`R��_���1�V-�@�����l�ئ��0���)C��^��F�@Jv$T�z���C`�2X�]=$n�W�p���LO��3&P��Pkr�L�4���n��C��kr�G����=�\��i���c��n��'-@M}���&����iJb��p�����;ٯ�`�?3����:�<o�T���/ M���u�NɊ�̱�,<�f������$8����c_(h]A������@q��8@�X6��;���k�(y3�Ԑ?*�a��|w˹^�$����un+�1������6\�������(��_�$I�X�g�zeB��n�}��ʄю��L/\\da�8���F5�c8AM8O��$]cY�<M��ܝ��(��GOL�6e �����6Ew7�&Ew��r��Wo8rE���p��#r�W`�=Y���qg�� ��)�6]40��j�����<'b�h���.������McF��+S :��G��B�Sa d)���uʥ�-j��X*4�&�,A[^sҶ�;ɭV�do����o'+Fܰ�^�1%Ƽ4?.�C���k���?�_2`)�vy�B��c�ڕAL��Jַ����̧�����!b;z��_�<3j�9����#�0�ŝO����qь|:�s�Ԟ���������W���p�����y6���HB̵/�m���A#n$��Ӓ̦篞������L9i)8c,�4��z�cq]����se6�e��';����d��B�����p��,g_��ʨ]�6�v�|K�+q�q6n�v("��q�bY��m��`�� R}�Q���[���~�S���I����#ƿqj���"�Bk��S���<�;�P`2��-幂���q z��ojN�{�$�/f~r��i:h���%�!�ǩ�9?R�Ծ�awl�ʗ��z�4�%��r������;*�+�q�Er�@��9��U*�:��z�[y�����ef�9+X�{!#S6����.i�h����W4�#���&�g�M�@�T��[sp�>*���i��5�`��d�Ç^B�����4�Yw4q ljOj��.;�`c�*����/���"��g���s|����U+�}�c�\�$�=J)�����p�u%�bp/RC�jdM� ff�ؐ�������b�;�/^��s�4��ռ��[vm�eʗ><5 �Z��>�P@���G,!�����+���،�.Jcym���)��G�SO�F�N~�y��Q�]�y@�]b��ה�I�Q%�|���&;�/���roy <˩��d����p(��$lEVr#E���e~k^����Ft]{�N~�Ԥr��5!��T��[2:g��62ዋj�0���'S�+PhB��*C�K��z1�)���ܯ\s�������Mg"�v������?'��f �J�4�C<���5����τGNE�Ɠ��$���w�'VQߦM��f5O�7�o`�Ӌ�38��d���ܞ��2M�95���{f_|T&j�t����ٶ?����m& �p5��b �:����<Bo�aᆲ�2�D� A|E=�$m�Gך�[-��G&�1nt~�6N`�Y8�K)s�����MT:�T Cd�T�;¦Rܪ��z���d�>ha�-�Sor�N��V�~��+��wN�͇�5Q:6V2�R�^lG��i�Kd*�C�j�*��s���^��н �m��$��m9_��p /56��rT>��X_x��fh�*�� |B�틄�mz�:ERi�1Z��>З�j�����X�y��l/���+��K�ԍK�wYx#��~{\���/�����eC��@.P�岞��K�3�fZ���`GS_u~����i��{�Rҽ��#hX��Dq[�,�}8,D�zu�f�,�9b$}6�-��8�;��8�h�ӛ�����\����.�;l �ޒ<)�)���xX��� ����@���r���H�5�;L*h�X=� X�w7L���O��A��R;�M����҆����v�K�lFaeA��a]5�2)��� �B�� Q^�NP�u/�L�?���n�G�f�ŝs�5�����.*�Z :ƅí�̶�� ��a�h<.������#�e���h������U �VT��~�O����4!��!gk�J��{������4��5z/� �ȵ��)ɋ���7��0�c����� .��x�� }o/W� ������7��X-��_uQ�B�����ǹϘӮc���k*x�>2�?�(��b PM���r�A@O���aN!�w(�r�!I.bB �OJ�h7>�)P'�/I�'O1�ᅲyAR���v kꓽ���K�Q���� !�.�*�P*�S������WL�L����wi�v��Rvg��b�gn6嗁�''�Cb������Zэ�W������3���`��� :3t�1q��pk,B����K� 0 ��,�Ac�|B+UB�w�)?9 )*I ~�Pr���M2!���!��k�갭��03�)�4��uՄF����6�>���hq9��<��eԬ�z���wkgt�aN�܌�x.�<_T+��n0�1��봋�Nx�T��� ��A[���[6�N��L5^}�Ǽ�����g��VC{V�Ow��pP�Z �Z�_��� ��C�X�ev)]�Ö��5}�{ijS�e�S�&�$�/͊l"`U�rp;x!�暈�Ś������v1�/%�~��ԁ��3�h���v�z;��gj��:dz�p��������$����?�b�FC?�x���}{,���B�,�Sm8�r9�n0ڪn�~n�CE�0!;V2^n����{Ϩ�����5`v%���o���K���ġ� ���8���V�G�k��R��V���u���!M���&hU'�ڋ�?�w���6�����S\�M`�N�(��;e��Y�}����E��Q�/���y� �ۑx��Leoc^v3i��P�/�f;_�h�z��"7Ps�Z��?^V��$}K��\����1��"��
Static task
static1
Behavioral task
behavioral1
Sample
4191a83e75ff16350dee3dd622a2c35b62aff3b6dff841038a1498fc3c349db0.exe
Resource
win7-20230220-en
General
-
Target
4191a83e75ff16350dee3dd622a2c35b62aff3b6dff841038a1498fc3c349db0
-
Size
4.9MB
-
MD5
8f702214cdc90b55b65d5f8d1d1bc54e
-
SHA1
b7c251801b37a8b2cbe8aefe7a97630a50338e90
-
SHA256
4191a83e75ff16350dee3dd622a2c35b62aff3b6dff841038a1498fc3c349db0
-
SHA512
af94ee6e0901e57805a6b6bd6297589004906cdd88c9b7b08508bba0f3abd648a9cb04786bc22f161a85b00d2258e00645f09d641f11dbd1f54973f2ada8d1d7
-
SSDEEP
98304:yzc1sbMucfoc7ibZyshaiIUtpmsS3VxoDc3BxaHqJBvgr5neEeI:yzdbMucAUi1fanUHkxoo3aKJBcN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4191a83e75ff16350dee3dd622a2c35b62aff3b6dff841038a1498fc3c349db0
Files
-
4191a83e75ff16350dee3dd622a2c35b62aff3b6dff841038a1498fc3c349db0.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 549KB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 77KB - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 67KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 173KB - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 182KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 13.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Rao Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE