i� �~���������W\�Kx:'S�f[�(\��n�c��x ~��i+Hl�z�7O�M��n�x�XpT�A�� ��� ݿ� w�jRl76 ����\`L�����Sf��{��7��:��16��ݠ{*2aA)��^�`��+sc���Rϊ�s�X6b�E^�V�>Zy�v��P��c\��rb��C�!���8�}�j3���+|*���8����Kb�~SF�V�U?xUZ���v)�i����o�r1�=դи�(]�C�"[�8S��!���5S��;������^�/��2���T��2`��\�7:��+�r�ya���5.Y,�����r~�4����hGԔ�])-5z�3s@�7�A�Ё�8�A�z�- � 0x�ws@<iJrxU9ڇ� ?,�����#��\ӧ~����o�VB��H��}x`��>���"���Q��+;c~�;.w��i3�'�1nZA�9��i�����`������<6��qn���?o1�M� �m߃��[��3�cew�H7�I]�� >;��@Һ�I�U0sk����������7�lcvB!����c^�*�)Y-�Q#� V0�P� G��'�������f�V���oa����4%J}���Q�k��UU4���Vwl�O�"��_����&E2ZR*`K^��T�M`�{� ������ȃ�u�}Tc�=PH��T0�$?E�~-*TGR&�W���4 W�W��n���V��mp\�pX_h{�,���oF��ũ�Zkr��-BNa��� @?+E� ���X�ݡ*�io�"^�xj���Z�R�9ip�S��/�q=|���V9"d �� ��$�j����̘��a�Q�y���$xȆ�93D�_���_��^��i��4�Q6[j>�B'N/�{A"��h��h� J�(�!#�[����ha_q@����}�W��+����F�m��1�%7�w8@X��Xn[b�a臔�`粄��5g��/32��s�Z��?)ɜ��P/O���,�0�QAP��O��)br}��5��a�bB-��:�Q}��)(���uB����Şc�k��b���4��ܦ�U8m�R>�"*&Um��\��ϋ��4_���M�������_ީ�ԳFe���4s���a�1�5��o�ڟ��}�)ᙸ�gM{����Zft�4|ȶ8pd^��2�*#�9�Օ�!�F�� ~�0����w3�-���0Ȳ���².�-+Y�����،�r/�.�@���`jo��579?�2F"Or���������R1�:���L+���#4"�iPn�H�M��K��h!����b��Yj��zhU��[����ZwnK���V��.eW�R85EJ�x{vky�v���A�[�k��a��������#m'�N ���u0,^�b��G 8XW� �0'� �IF �l������D6%�ú«η�dB���;WP���K� 4^�D��N)���}g�pT�jY��N2�?!���=���c�I�&yO�7���D+7RG�-��6�X�e�lĥ}C�Ж������WH��Y�b�$���2����;���B��Z�G�A��,r���BWgO�T±�����K���G1�پLY�iձ��S�h\l���a��-�3[I��R�e� �L>U�'� ���kg=�ܑ.D�h��yɵ��4���r����+��@��[�1g�U^@$�$�Dl�5�^���y�p�2gD�1���R�"\�1��2Kt3Yʵ/F����R�����$2���hl4,Itǭ�˩4b��۾r��FBg#-z������������(� b�g���ȇ�vS�ӕ�S*ך�+�RjQGS� >����if������Y�f'��ѯM��oS�K��t�k˵JBkpk�?\vpvb\��i��6�b��r跷k�_R����D����y�ʿ���H�4�T�))�� .���q�n��wOl����-�˳���"�`�[�:�sV���V͇��N3�UF���.�ş{��L٤���9C�'FFv��9ᵐa}�{��� ��g�����U|T+Z�Aw���2H4�`��UZ�/��U�m�A\� ˍ�4�u�z�TBf��Ya%<�>,�����B�1��G 4�~��K��� n�th��5_ѝ^���3r�A0?.6���gF~q�NR��W�U�2��{���a1נ�/�5��E��OC���ۡ����>Ax��;`X�с'� �=}Uw��Pqܚ�)"�j8�܈/M�������A99�B��gÝţ�8?���P�N� ����@��2�x0:Y��8 [�N*T�7˚��nW���j=A0� � L8\�c2\*/�n�%&��@ bbp�I��u������QV���<䵭�C����f�~�_�a}N��%1ij �j��)A�z�ӱ�_p�?H��f��ϲ��/e��tء�~�A�����Q�S^��J58m!�|����HG��y����6�]�uw���M�V�tC�/�K�������HnR�y�P��`${�L�<!�q'Qf��k�GC�v���i9����%f@�����=��V�sh�B���j������t��c�1��w�igj?V��F6�(!DU����|�R=6��p�@���Z�Mƭ��ca�BLD�P8!QL�fE�����<� c���Of�&S����O��J�A]A������~V���~}6���~ ����� +��Ƙ��TE�BGJqns�q,��t��̙ҧ.�t��r��+�K�JP��ZB����I^�Z��31aB�I�r��1"��� �z�2�9jDK�m���0Я�"�Ojc�����2v��q���`�4��A�b@��������?��`�v�hE�9��oX��6���H�q�_��뙣�<�W�vU�_L/:��ɿAa���~,�r6�u,V��[���w;���]�H`[�"b�@/|�_Q�D��j#�`2���d�@�Qb���֩Lf�q��`lC��;��©筆��'�6�H�r�p{��v,�j���!SD�4���T6��S��W�8�L+�����@N��u�rԾ� P�T�������.*pG����U�ӯ+�y,��3Tۤ��:}%;OX�H�����@�.�e�*&����F�����@4��Ϛ���Cpf}:���� $���a�b��uc�"�ҍZ8 �B ��Z/�{[�<J��l�������w��+���{9<�����r���Ȟ�3F�)�}$;>o�%s�ƅ�Hb��k��q�ft���w��7�&~���.ǝv��5k���VO�Oj�/�B�>6����E�FP��H�R���t.I�hh��kd�}�+�z3��������c���X���1��Hp���""���}����I4h�jƑ�����O���r�q/L\��������on�1y�e���۵\��8i�������G)O�rv4��X��h, �ia3��j��P��`��b e��������B��Ož����jm����LBd�?.23DZn�D���!x��C���Kc�-*<*��#ˑ�^�����IQQ��.���玡5Cp6���2�Ӗ�S��R�HuQc�Y����p1h7�h٥��)h�:�qڄ����4aU���c�n�==x0����������6<F�5��w��qv2xO�8�&��f�FP��R����GX��Dc��B��`�(n��|&>�9-�籦�`v#���0��7��\W�VǮ�c���X�T82� ځ=�䣷Q���u��e�t
Static task
static1
Behavioral task
behavioral1
Sample
b137342bba33ad092a0419fa97400e9ebbbee6c219350c549bc4ad264117f3b4.exe
Resource
win7-20230220-en
General
-
Target
b137342bba33ad092a0419fa97400e9ebbbee6c219350c549bc4ad264117f3b4
-
Size
4.5MB
-
MD5
10ee7678ba824ba3c1aaeb3303556ceb
-
SHA1
36b6911cab6bf988317b91252825295f07c69368
-
SHA256
b137342bba33ad092a0419fa97400e9ebbbee6c219350c549bc4ad264117f3b4
-
SHA512
c52d0c3a1ed48b05c3a33e56e9016ef0e28f3d3d320686a3e8c7caa98c3141d2712c9b16641cafbd41ddfb3bf174e5a1530379ce55e6396e25fe3e004d44ff89
-
SSDEEP
98304:vA0rXYarsGGuBEsUxF8b68CuAzGHUxMFPHBF3+uezHCxHbLJn:ToTcgF8bwVmUxMFb+uecHbLJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b137342bba33ad092a0419fa97400e9ebbbee6c219350c549bc4ad264117f3b4
Files
-
b137342bba33ad092a0419fa97400e9ebbbee6c219350c549bc4ad264117f3b4.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 498KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 71KB - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 67KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 13.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fasen Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE