������I>;�N�䓩���)J 6����p�;�����2\>��-�/7��[�`�c9�=srA�/��Oeް�J���Ou�3��3���ã�n_9J�2�!��ԡh~������8��ܨaIw�Ȏ�����6�YX���<���$����0U%�9�/��U���#֡���b��fy/V����"�HpɁXb����4���S��<"U���KĀ�����v�yQ��l leWJ�+p�FwB�9f�3RZ��q_��@k&��k�i>���C����P��$�����k���iP����f��sK^x���F@)5�Y�1g���\�.�J������Dm���KMd�:��%���U,A�%���튀"�GP�sÓ�Qr��Ѝ`��j�G��T]S���!>�Ӊ0�+�����A_4��:u�梩�� �H� |V{^Zeވ�e��%�pb�-j�����������Z�rkh� ��8��A��]jV���'&��}O�ϛr#�N������`bnNkg��Bx�04,�Y���(���t�@����1��s!v��f�T�w�h��p�Qj�UoG�P�s<��ă���)s��$��:���9��_J� c�0 (�ʍ�����=G��(01�.�O(������oʹ�Y� Z������BnyUi�]��H;�c�ѮPTv�"m�$�F�Β�Rgv�h��4/7!������>>�n�w�e%|�K���4>��CeʌXXmt/.GlQ�8�9M�uC�t1�(�Up�,W&md�~:Eo�lR&��O"����c_���(%�=�j,�=���J�0����(��)����aH&�*�Q�\�t��{j�ՙ�U�X����Dv���k>� \��t=�bID@���q9mi�y=���8r���)��� u������n�W-����zS\�`��MT<WQ�3n9�m%� �T���L��b�����Z=�$��Fh���+V�����k�g��htT~q��d��uC���h��-Y>��|-��y��V��� � 3���Ei�o���� v��(>�,���Š>��y��aXq�o2�h���g���7�#�T��{��&��y=؎m[�lZ��Ԓ�٥e]����{�w�H�f�S� �W:�+�e���v��F�.F�r.��^}���Cˉ���{M�>w/��NA/���Ƙ���R��]���UL ���&q.����6�bY��������3!�B�5����o6�>_Zu� �Ѧ&QfJ6��p���"�_V$:y�$h��J l��:� �CJ�S^�L�#q^pʠ�g_�]L=o����M���+g���=��J�?�j��P��� -����c�:Y��S�J.�<��E�ytn\'����wJ��/�=b���M���[1��G*S��_��i���������Cx��V����]�Q������� ��xN�\5ޢs`N!�����i����DT�w�X������,U��[ ��<����~Dd���,i2E���)�-�}����3�t��%�4��8���v"1V3�Ȃ����PC����HgWzk�]�E3@$M|�@���+���4�D�Q� J=���էu�((�]���=�������s�j�� �Y�\�Qoz��{�{��p���Z��j'x��{�k|�=�A�f9�r����׃��_��2e$5lE\N��t3e�7� �;o��熖4m�tL���Eї;4F�*���{?JAj�=����N�"˷i�Synyuzq�?�&U�wv?x���asn-ʭw�`Dȹw�7F[R�=I�72ke�%� Ic0o�:�ڷ#%�u��ʇP���0S����8% s�Bn��@��;��Zx*��؇h6�����(Y>[�=��T>��϶��?�3's��>�索˛�N_PP�j���YK����4�&c����>�_!�u}-`�����ڀߕΛ����9���ћ4��G��=#��f"D�g�őx9��X����I����<hQ&c<v2�㊕R{��z� #�I#>��������X�߰Sx��P���S��~,#��~�km��[y�7S/��@C��@�Kݷ����'|F���?cg���x�T9�2�Ҵu,b@^jk�`)��uӮ�kʹ��'6�gKjI�#n3�n��Q9����]�^�z�=R���T���X��PV�r@`j�V���4^,�������phRYV���)3b)���>�7ZwB����ր3 �Љh�'.�b�휀��kĞ؇Rƶ-�M�0�MYxߠ���D��T�M�|MD3� �c���>���1c:���]�� b��*J��r����Gx�`���Ǟ���0�f �0��,�!�D �����d^�^�� vWm��I";��m��|H�{)���J���7tF�u�!d�u��hB�{��E͍b��Z���j��s yƢ��[�YG�9����zꚈ�4�Kp�R��j�x v���Ɓ���w1�}����^����ؐ LW���s���� �� �(��5�§��-N��"8#�[L���/��C?M���Ÿs ���f��89((��iai �p�3� ��{5%�x����bz%9rS�Qw�2 �e��?�!5���CF4���^o߯Y�B�a�w����X��1�`k��ģb���P����$����5�$��+'I�6��}_��*��<qO�dC����F[+fŭ�瞃�R��]��)���[���ou����9�����x$�=G~U�5st`�z��{�a�< 1h(n���b�Ë�Ƨ֍��X3�i��2�?>ז��G����Ʃ�xO��y��;>э&�bjg���Y{�c����B�͎~ݒ�A]qf�76��wA�Iu���e@9�I<�!�sH_��P�u���8��m����Z��բ -��X4�s���M~��P��fV��0�0!ÕC��R�暳����We�L�۫mr���` o���䀡��Fy�](��1��X���u�����o4m�?�.|�>��9~�K�g��zC+oϕ?c�BmQ:��`k�c�g���=�id,yQ�C��� ���o#;�;p��#���{0!\V�e�������[�2DA�W�Bz�{�c�e0n���z��u�k:��w����RcT����|�o��|�W��@6&k:�ʈ������|���2ѷ�*�*�>l�������#� ���ې�jwԨ�a����Ϝ����3�b� �Wu�������Xy[�C� �j����T��N ��Aw�c�Յ��ڴ��5%���{GCr;�X����{��&MK�����9���ؖs�V���ċ��u������m���{��'�t���ɛD�{�b
Static task
static1
Behavioral task
behavioral1
Sample
4d1d13ae8c0b35436691af368ad44a26f74ab931e5ccae50e839ac19a708225c.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
4d1d13ae8c0b35436691af368ad44a26f74ab931e5ccae50e839ac19a708225c.exe
Resource
win10v2004-20230220-en
General
-
Target
4d1d13ae8c0b35436691af368ad44a26f74ab931e5ccae50e839ac19a708225c.exe
-
Size
4.0MB
-
MD5
4437ede89331b0c42c8d34e87acea7a6
-
SHA1
911cb82326d471e32a8723df440392a8ab73cef1
-
SHA256
4d1d13ae8c0b35436691af368ad44a26f74ab931e5ccae50e839ac19a708225c
-
SHA512
eb5544f2bace9370e68f3d903ec1cabdda15acf611962b05cd31ce2bd8df833986664ae3619ac384e92cf725a281d334f808b4d6ad723bfd2b05fedb0d55fc09
-
SSDEEP
98304:EoiRBSDccvT1EDzUce2ati6Wmq6O7XAyKuf7B+yBchxO:E5Ih1EMctf6oFXAydfFG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d1d13ae8c0b35436691af368ad44a26f74ab931e5ccae50e839ac19a708225c.exe
Files
-
4d1d13ae8c0b35436691af368ad44a26f74ab931e5ccae50e839ac19a708225c.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: - Virtual size: 244KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 161KB - Virtual size: 516KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 20KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 13.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Gaiden Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE