$�l��bn`��L[M,\�<�#���Tz37���P�]�_ � �T]]�K�v*���t�r�T������+`���:>I<ܗcYkC���p��g�vt(�@��E�.��v~�`BP�'e*���[���()*���p�J�e;^�������Ɛ�zJ�+?Y��&{��(� y�vb Mjm��x�&� Bn݂���%v/q����xi�s�9�^��I(� w��u���N�L�R��Dp��s�S�*���2�,���{Gg�}u�եc^[=ja"MGێ��"�J!\�'�uD���p�C^E��#P��<�i�\�y�Tp.c�"#Zc�-@�|J���� ;��Cd5��n�C H5�R��ͭ؝�|9�R/�߫��X�':�O�4 &��n�f�@�ⴻC���f��tz»^�I&����?��<(G� �6+�d���|<J[�|k�X@����G�%\�����������Uc��Ԫ�I,p��g'ե���1PÒS���6� �|qz��4���n�g��8��}��|��ZΓ�9�2{��Q�g���"5���H4�YXZjxq�����=B�����tm@��V��_�R����lX�C�_�6/��|N��Dal�f���O05�$j�n;���<bH���6W��S��#����&���4�z���O�ٔ����62OO� �c�� ���:�n]KX��r�]��WKj\\u0�����iz��!���y��� ���/L��N�� ��I7�%�1������C6�� �.�vC�<!Ȥ\����0�����48�"�*F�~tb�)��������%�f�2TiF���Jʾ���G���Y����Ó�n���^�^wAh���08:2H�n�L�7�s��d�s��b�;e�q+��C�c7��)�����a���c��E����>>��l[Y8'�|u�9�?�ߎ�<����Q!�ʫ�:�������5���H/>/�=>���}5!�l�f =��;�O[���#���E��#�Ct�%˯l��C��Xh��E�|th��[j�;LP�滬ޯ6x%���9�p|+�� �W>��1��z�K�3z �tO�ߗ0AY��ƭ��/?�LH�4�}��%�O MI@id��ݡ�.%M�~�9�� �e���\/��i�;#*Hu(�A�����4�ˍ�'˕�����9x�/���Z=�����Ds������?���f��"v��z�������B�̝W�Z|ȖCH�p�r^����qF7����0�u�X�Q,ǯk��b�Z�M���P�&��L�{��(�� �yV.��]���,}�rP�_q�_�L�-7��+�M�~�+��O����[�o�.�l��hM� >��@�y�N��;��H�,�")7��JG='���:+��.�����c2��*<Ǝ���*,�W�z�?/�j���h�p��y;��^��)t��#!UU|v��A��>�,zM��d���L<��:�����+aqN�L���n��t*-Xש�����o��h�헌�ı�i'�KKIפ�͙�]��3_)"��������u�� -w�?߬ϩa���3s����Hh���H�Q�T����#�">�HKSl{�u��O}��E�h����T�:���3F� 52z-�R�0:8�����n�kG��iTq�+�����aB�_�'���� Uͫ�sϘ�Zјu�}[�3�(/����S>��sܑ5}`�ˁU�F��i\�?�����y��!��'ر[O��eL<�A<�F,�o�]�Yxaw/�;mOx��=��i�S$��$���t�R�J��A#�3%�U��C���G�`�*L����7 ��;s,�v�%XI�M���h�D��ܶ}�=ǡ������pq�4��SD%�i��r@�9/\���!�S�H�S����N��ǹ|��7ˌ�1++��Hո�\��XE��ٷv�r�źI��B@F����l(��sj�!_l�Y���`����Ӳ�=��J���;�^I�t� [��7�WƍTK�)�O�d&܇IX�gn�"!WȞ����7 ��_�E,/Ч<�'�X�L���Pҵhm["�mD�s��DWs�G2��BGL�X3�u��s�F�KzF�o��R3�;�Tz��|��HЇ,U������_ՄĿįK�r�m����nH�;���π[r fG3�Wl�w8�-��ZNwLb5��?�܂ͮrl{|����B�@H��+�y�TKNcr1� ���SZ�#c8��>���E]� ���]P��l��C]DU�TXv7~ha��{��Ç���V��~"i$86c�� ��]�B�r����ېC�����c�V�T4'�w�|Y�$�q�hg���j�b��d�j�v�J�1P~�wZX�������7&�4����x�r'}� X���/�_%����vp���NPy.j�a��ۊKV� �s���-���mn�A��:�p5�b�_�6e��0Q>�V1�m��f2�_c]���������Y�`����VA�;��`N-��� ?"�O��u�:��'U%M����#yc(E���Ă9��DiT���fM]lQ��=h��sノޛjA*w����<1u���0��e|(xߨ�-�>�ŝ��3�>�����bәRې6���Rd�k�%�������s�\[v���JyF���p#=�~���-~�_��T��*eߓ�-wM��=B��8�����-��j�ม)�@I%{��Ohc@��A�(��|?^��9���f�/��l��E/|�S���[ekȁ�d�§GN�ojP��ߊ�7�#UHNZ��j�z���P���PY�p�<�zT�^AÉ:E�x.���[��;|�A��'Y�J��e¿���5kڭ�����\�B]�Gdێ'�wC��������(J J�K��=�I�4bk�v��\��8N>�ןb����� ����TW�Q��-��_�G� <biU-B�i�,�R��� ��L�_�=.K%.a�xG�-{uTG�������K��p1���as���X0/?đ2&�?�U�(�|��f�^h���m���v5>@k�2�.��|����ҴM1��ռ��@v J g�K��ɭMq�>��&��::у{� pS��آV�� q�����K<zR-�=.m���8�t���K���]��F��ß���&�gF%������� ��@��#������2��Q���I%�M��bR�|~�8�w�e���*��֞T9l�~@��D��Y=���ϞZ�p>�r2@���B.7t϶������]��[Sc5��%�D�� zFV����LA����q�Qډ,Z�L-!T�I���"Ug������4��U����9�Cn�;���R��8�5�E����&]���ϳ�V�۶����p���X�ƺ�8~���d8�s� �?R]D�P�Aط���o��"[ZǛ�b+R'�i�h �Ͽ��2���eE�?ז(��¦ADǁh$x��X&
Static task
static1
Behavioral task
behavioral1
Sample
ae94230de7f29bdb517415420bc829cc9c7522328b7b7dd3887c294b00a830db.exe
Resource
win7-20230220-en
General
-
Target
ae94230de7f29bdb517415420bc829cc9c7522328b7b7dd3887c294b00a830db
-
Size
5.6MB
-
MD5
86fbf9ba15d426ea2b97442f1146dfdd
-
SHA1
e94f9903f4eb1a65edc2cc0356eb745ad1f4c4cb
-
SHA256
ae94230de7f29bdb517415420bc829cc9c7522328b7b7dd3887c294b00a830db
-
SHA512
940ff76fbe2ca86ef2b3d58516fc4986c0c52ac5780736d18d4fc7e3a0d19fb31a8987ce6013a34010e7399c9d8b1310f335a9798bd41bb3d46bc30b3111f3ed
-
SSDEEP
98304:/oFP8VmB+VL13eSBSAywhrKkELfHLYRqc2zuxjE2nbB++VajFBS/ufc8:SP8Z13bBBUkEYX2sjLnbB+RS/ufc8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ae94230de7f29bdb517415420bc829cc9c7522328b7b7dd3887c294b00a830db
Files
-
ae94230de7f29bdb517415420bc829cc9c7522328b7b7dd3887c294b00a830db.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.2MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 133KB - Virtual size: 492KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 225KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 13.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.doens Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE