�QIȧ�mWOs�j^ P@�;�0qGMz3����-%i�1���V�O�Ս�����5��5���k�����2AiD��$�0^�<�KR�;����P��͔��)� �^ɶ������Qi���s��YrB�.A?��y�<�?{A�vL5ȷ���C�<�\c]-�ތ�9����d��_$�8��V8���!4<�D�X�.����hd�f���$p��P=)��Ѥ���X�Z�b��z�z/$ی�hAP��OZ���� ��%S�)�\.��#��&��ӸS$���_-�ZU��D�I/�b9�&������Ҍ8��G_#�%i�ɐJL�W%2js���ʋ��; ũ��c��6���R�~�j�n��"Ƀk���=DMb�0�w�SEs���7��:A��ಎ*��� 6Ҕ�*5�|rʳ�a�}=��A��'��w���zuXK�a����J�JHHi��4����Z��W �}�_��<�$x��c� ���u*���G*#���$���9��yWFl�/D���~y��>��\��fۜ��Vi�}9��SM�\�ǝ\�MvI�c��,^�>�Ҟ��R��W.�\7�)���a�$#0��%��@P\ȣ�kDh�}>���f�������U��↰4��g�/�B�yȈj)N�����ԥc���F=tL�yM����~a���,Ę<��� ���K���O�}��Q�K�*~����t���U�K ɺ{�,�=���f��Ǚ�x���?}���a�*A$�U:�iK@�9Y�qm��s,��~���3��}m����@ʅ�S6��:��O�P_� �v�m6���aU�A-m��D�$13��G�~'�;5��lЗ6Yc8�gVC�m�̓4����Jy��[�zynIϜ��V�Z�CV-�Mܢ\��o��-9q��@�=$�Ӿy[�q�ZtM"K�#Z��� +�كV+�~���K�����|��f��?y�ƃ_�a���r��������V��3!��c8h�/��z���+9�$~qi�$a���6~Sz�WE�l��bw�.��rG'�,�4����L�Z�-�v>�^�@��Bƚ]�X�`��r�̝�i�u��6k(�C�Z�#�G��e@K ���ɞZi�ڄ�梐���e?@$&��$/��_{����F^ɟ�29:����KTAz���<@IJ�����2 ���~ ؾ��]���n��;�Հ��$�S�4R��m�0��HN܋5�d�v�����m�v^pu�Mq�S���K��|�w� ����P{p������h�"~��l��^>�u�O���P�L`d�:��#ky���w�Uj�*i��*7Cw�Ia�my3��1�y�y#�g���@�A�S����Xg����h�8)JB���e����-A�jOd�28i)^o����2�<�_��VD��f(��8TA�\}�hLL�>��!�Q`��]��Q�_%s���N�K����7M�a�W�}=K� ��}l(�t1�4QuN��A9eQwV���)I�]��y�G@��P�Y���7Mv}D_�����8o������i�/EZ �'��<�����{S�'U[��n� F��H�.�&]�����)��j#$D�X�t�C��Mf�O�C��h�����X�МoI�����Y���S��F���חN�`ꣿ��_8���<f��7��� �,�A���|�Ӏ�ӛ�a��X�=�(Ng�cI�UO���B����&|������jm 2�����5$���׀�ux�E\jD'�b�Q�e�3ַ�h�~+D�>Z${�yIe:����W)s� K��FGn�g�ɣ��x���t���P�:ʍ�4��s'?�-��/k��%x�g�e���[YC'�k01(i��\��j�FԿ�[���3h���`}����!�,&�`3� ��� ��_�D4_��mA��΄i���Yd����{���\�b�������0�AF���ϤS��e�p�`��L��R��R���xvK�p �0[�M��F�; ڋAG�.����c�RM�M��dg�� C�[���Hf��P����w�^�=��J��ϩ���@�B���n�Y���ͥ�PC��.��P��Q���W,����7o����oӇ?`i�&==�����nF2tt%�L{7�)�����8'��W ��Ay��Vi�j�RNs�!cw7��r���t����-�v���6IR�v��"4F�e������Y�-j����.3쫦$2& O��*A�±DH�f}f�շ���\��]p�r��Q�������\�W7���"�ƔJ��EE���F9�<����F.��yS�$g�[O��E)�����<��{���7q�����yژ�h����%�������.�?8���UR����^ձ:Cne�)i�~��;6�&�z��y�=Gl������ॳ9�nP����7��<G����f�wz�k��ń'������w25*.s���[JS�� �vR�)ې�b_8����ڔ$��WmʋV�bΜ%_=( �kU�ф �u��J�9��^��EE!�Q}A���h��Y��䂮��`�Y@_ݒi���H{����9�,5����-=�ߔm�Mɣ�ĵ�^Cm�Xa���Ŧ��Ss�i{��>�lb�EB�Ud;�L�R+��?�����UV����9�Cl��^��7;�Zd��;s�PN��mm�x>4������[�=���[%��b���bX&������#������B���������6�1��9���h����� ht�n��u# rEZ;��p���~�����U��M��F��ƥ2t�}���ĻD%���C ��7pSY,����K��J�t�`5/��6���Cݶ�ç�j�����A����;�|�?aK촌�E���Hr�w�4뢟+�b#�nv/$���9��+� �<���]�k���V]��Dر�G\S"h���%��sdv��W�yYYM=S]�o�7}_%2x֧YN K'7��b[�>!���8����� 6�Bn�B؍0h���S�Ыvd���C�|@���7���^o� �L�/��dؠt����-���t4�CIh�v�o�����[���E Ӿe�@����k.�5jY��9��$"�U4{ew���� {�R����`2�smʌ���;����H���Q�8���Ey�S:�e�+�6��䠚��aZ���wn��]]������� IV.�y���R7?�w'_�`Sdvv�ܸs�9�����D�:4#�k�` �yU��Bܐ�In�Lcs�T+�^S�V��mv�Ǝ�t�@����,(Bٽ�Z� �_s|�H-���>}Zd���#�ԓy�2�xkƿ{�E�!琲�j��lJT�q�����`�֠�9������e���+��Z�g>��%_b�A�x�|�34z)S�Zj
Static task
static1
Behavioral task
behavioral1
Sample
extracted_at_0x0.exe
Resource
win7-20230220-en
General
-
Target
extracted_at_0x0.exe
-
Size
2.5MB
-
MD5
359eedbf4d8e288ecea3de00ff58cb9b
-
SHA1
4e7a5179fe26c96dec37d9bf9245f8baefea2eb8
-
SHA256
500340b689a5117c86ce1ef95e8fe23d1e31f3f49854276405d726f8b934ca74
-
SHA512
324a0a9ffa5f254872abe24abf6bfda3e81e8029c37fcefe319291b6134ace7e24e63ba67cd2e7059e0674f3a547c9059d360052c62b5c655558cc983933082b
-
SSDEEP
49152:2Dxxed1iUJtSCBFbLHDG/iJkRAQnxPuE5w/fpmjJewtRHNtA5FqVme:2Dxxed1i+zBFbLHC/iiRqE5ufUjJ7RtT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource extracted_at_0x0.exe
Files
-
extracted_at_0x0.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 161KB - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 34KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 11KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 194KB - Virtual size: 7.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmkoi[' Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE