�r���F^"5� �#�=]ύӿx�7�0#��]s��W�T1cߎ���dNʝ�_;��N��Yh��X��}���k�u���9r��_�6��^��=�"�{��q����_��P�#�9�,p��w,�_�u��i��`t��V%��[��>�@�+��[!���-<�\p#4��۬�i]z��ޖy��G���6R�|��M���squ����g�1/Ƅ���q�D:��8�w�W�z�.��t�C'��Ww�����:����iM���`�7���Hadu�I�gc�'${*�)��&���,�ʝ ���.#�/�si��<<y)��m!�zV�'�)C��?Tr��O�j�#���qVԧL̺4R�c���� �Lm!}�$NGq���^&��ofɨ�w�/H�x?O��-gy�H%L�D��X.EL��� ��*43��@_�S����z�D���4�����IZ�蠓����(�۾,�_q%Q_a�֬a����4�Gk��U�?$�k��<}J6�0�EH�Q\��]�&�*�-�Kv|�@��̓�āl�y��os����9��v���̽�xt� �o�}���Ly���TU]}C��S�Dđ��j��E��6% ��� �y���V1�1Q�6a��X��I�G*uc\ 䓏�[���1�?GW�i��W~�:܆Y��ef�̞�wv�۸M��<��_j�bȤ.Lv�F�R�1�(W[��(��)���f�M�!*��H(�K�� !N?țn��iŰ�B��]NV����M��%3`��#�D_����/�7^?��7�so{�2�q#���hrf#��pih���)+��7����g��~��5��$w�.T�p��_V�87f!�'4��δn ��MI��"��B�Sj��"���F�ml�,���u��mT8�Yb��Ywv -Q0��G7��+��\}��0�688��v7]1߫+�Q�����}v�R���� =U��������;�bЛ%��w%V�%V�.���c��`L �& q���!��~��֑δ߬��D%����4*����� �C�J����hݲ�Jh�)�Ԏ�����:�Z���=?�X��"��+v��� ��B�S��1 ��lQЧ݃(&j<�e�Y�2��w���Ы^��;�I��?^���!,�C<�d��N��gR?�OQ�+2�z 5/4�B�́�Β��Y�FJ#[�%��0N�'�}�/��z-DC�5>���v}�������jY�jt�Ryt�o�~�ˤ���BCz�Gs��Y �mڨ�-J��:4�h3��x��_X�Pg�נe�q����c�*3��-�>^f:�\po����&���NE��������n���8��"���;>� ;�R7��7ѷ B �赆;����p-W��Or-�����]��t4)��m�D�߅l��!6�W�h�PS� ��'������;.�q�euab`e.�%�W������U�!��%�2|Y=�����K��D�����*�H3_¥�Y�� J����q�j�����s�q��ޛ�I��:R��*�b�(�w�c��z�����|�遲c��V�z�*H���ᇇjۢ�M�d_�K�K�2v~CZ����C�M�H�%��ٵAg�2�$�]>ڨI���t3���G<r2�\�%;�O�]��������c��N�W�.�?CYx�A3��0��vb�n ��P�N�7��J>C�x�`� s�/ݥ?1K�-����Ot<�^���OS*~6m�2Uk�Y���|�ʥ��-{!��T J���C��M\mgm�`x*RʜxPU��PT!7�����|;�DҶ�����;VU%�� �������?D�<[�2T����Z�;!���MN��q��GmB~�#[*89����w����Eq���T���������A�e�g�f� �vΩ�����=�ˑ�����[������7n^�i_�>���# rm"B��e���Z���2�54�8c+x�D�#�6��I����݃z�ؒ�V0��̦X��3�P�lA[YU�@\���^��O�?Sl���b �P��2CN��,20o��B�����Ҋt�<hU���!aΥ��se�������L�tN�6��T5���.� i#N�$P��&|[V4���� d��0�HC��d���o��͉�ͣ��[�D�I�LmT�����^�w}�飒<ZN��{<,����G.r�Q<H���]�� �!���V�?G��s�aL 97��g�����Tt�3N ����{�Phj 2�l���}�p}M`64��#`j��9��8�ޞ������N�>�W�E��x(�$#��K������ލ�<siǝ�����-��s�8�����,����h��l�4���q�P, �q|u���z� ��-ܘ �%o��XI� k8����4�9�5��k���R-6���+2�uD�U�p)"qs�fB}�3��j�l���M�ᖤ���M�db�SAF��DPϞUE���*4�F���%�L��4�[������K&�1��\������*`Y/�+U��hj�PԲ�.�-���ݦz� �N�Q�����}# ����Y�|;X0@���c�u<��8�9�36,z<�f�P9Emw_��)S�oZ<�@2����yGi�]G@���M�m���7�ǰ�6�/\��ೠ�n��V �?X����?\�?��U�����)���)���7���ki9�ʞ��B5�p���Lh��(�ɂ�j�;"�=s�{��<^��jQ?E��Dp��7�{V���2��T��V��g�/��]#�z�R0�\�@ee�9��P^����?'oO\˩j�Dz���L���")���l��|�I����rƧU s.X�dr�Qĉ��t.��%R�|�I�ڪh�Ppʶ�5@��Ͱ�R(��M�bus�1�TD��ʙ3�]���Y�uB���fv���u� ����D��r�B~����u-�_�K����۱��*�+?mD�M<��<T���^�䝟��R���ʻ�+������TI.��VQ.�w�-Ԋ����zst�O���|��t��|1���t�l�"a���]�F8͵�a��(Κᾒ��WK5��,�AJ������I�����Y���h�yGT-V?�>g��^�N��Al�xA�F���Ak}�gd��2}%#��[�=�7�� ��������p����a���T��kU� ��!�Bhi���4$�㭝-V�ʜ�:^cy�#����ޤ�=Lv�_\�����$���,�ܭ ����5��p�`?�HC�ӳ��Km�;�d��]㭑�#�+j�&a�g��
Static task
static1
Behavioral task
behavioral1
Sample
6e3e85cd88b522e40d0751786f3882e9f65fbed62f7861e45096da1b58aafb95.exe
Resource
win7-20230220-en
General
-
Target
6e3e85cd88b522e40d0751786f3882e9f65fbed62f7861e45096da1b58aafb95
-
Size
5.9MB
-
MD5
3abe83fdfce83d61c3fb6624e7e18256
-
SHA1
19cbc7602c17e22962fe86cae73b7b7fff37ee1e
-
SHA256
6e3e85cd88b522e40d0751786f3882e9f65fbed62f7861e45096da1b58aafb95
-
SHA512
655e2ea2ed417f92805b5f5bc8d3f88f3690feb8b9d61ce2e5778f12cea4d5431b5c6926a2f0c3409d948148584e492821814b5e0cb8fee2cb46e7f4b9074348
-
SSDEEP
98304:GKUJhOPd89hq+TYZhTurpNt/IUgA8pFPvWx/kvJBqgidxBIAeA8RjFGVAzlgyYyg:G3JhAd8zq+kHurpNtb8pFPOdmBHtrRjp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6e3e85cd88b522e40d0751786f3882e9f65fbed62f7861e45096da1b58aafb95
Files
-
6e3e85cd88b522e40d0751786f3882e9f65fbed62f7861e45096da1b58aafb95.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 498KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 71KB - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 67KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 38KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 19.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.JiuLin Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE