���.?����;-|z.O�bW���Zpi����9bh�/�i9����7*�Nĺn���J�y�H;���4e��_�Z��:3"�Dd���^������hF�a�u?��%�e��T�:���ڃ:�a�@�言���gT��8-�1T�\�A'�6�$�����d�@��hVnp�,�$y�Y=�]��n�pּ.�2k�H�RE���}4�[�?M�*T�ʠۯ���̂���n��֜�Z��Lc�H���o�-=x ^��Хi�&g��#f����e�R�Ș>\�rP�[*I�|��A�F�L =d�j#��xp���H~%ROԄ��"uL���t�:�ŕ:�������͛������W}4x}�,� ���~7l�;1�L��0��y�)_K�CeY��W��N�\���p����,�K\�ك'�GL����.-�ʻ Ӭxd!X{���)�sDŚ2䦣>T���hd5h ��Y�?����7�'��ĝx-�G;�_6���� ����O��s�����wc3|����y��OÁ5�XA�WI3�Z˸���P�"Pê���.P��z��Th[_���Yv��+B����)�$Er�<�d� ]f�ȉ�E�d?~�Mf� �j-��� ����<6k>��"�K��a|�Be�)��^�8;��#��0�'}���!�v%�r�&4�2e�Ɖ���J�SJ�Ӏ��P(�1 �H���P�7���Ոjz�C��:Y�.5>ɘ�xΔ �9_-�O����}pQZ���[4Ivx\ H���c�z��[Ϝ����������*�Y�T���89��t8�`B� ,�i�q�ɦ0�Ve��X��B{+ë�b&����1�4\����$F��W��T 0ُ&Q|�>M��i�m4���^a�c��l��5�@�ڼ� �у8$�1�ۮ:��Ԧ���ԈCq�"p¡����E\�D��ʡY���� ��ʑ�!ɭ"��|��?�+!qvuzĸ�Z��7Jj���-ɝ���G�{�m���b<��}C����L���}��B��$����݇}�u��r�A�I,q��hpoD.Df)��y H��[ �{�R��1%µ���S��<��|o�O~�����=�-Yä�A��ޯ���.����8 O���g�$u<�@� #�v�2�+��l��0���x]V���W4.n�*�\��v�J���?����p��;c���D�΅���-d�����i�l�32x�.7!Ud6�"T��{:�?�u`������8b�<c1��_q�C%�V�M�:�% �襎=�c2��o4��E�8`������F{ �F� �<��OWda�MGD�xFN�Î��Je�\��l�Wiu+d�����l�x#�IB�<��q�K��'f�j��� �\���0[�}M���v��L�$kn�ܬ�6E=(� B����β��ȅR����sʃs`����1R4���J?�>0���XA�,�Y�����0�j�8I�A�WE ��l�����$&����F������q��KZ�̤#�H�" +��R����\��������ȫ�Zx���\%+*�D]'1y},z����-P�f��q�ѓ�"���<qs�A����ܷ�G��HER�!���R۸���P�`Ԧ�ҁz��UY�g|3x}/���~�� ��U��CxP١ly�9�a��@���ߗ(G�R{�h��?u7�ˎ����Y��K� Dgn�4���do �4�Ԩn1��e(sky���������\zf0�R�,x7��B��b��� �k=�T&X�4�ph��>��y���K��.�WŖ������r ٣N=M{nF��3������.5H�bn���j����\�p�z1���wpګ�D"H"N{5iGJ�V��Nv�U�/zm~-(/<`�] c��I�՟�L�Jc� Dd"76��%���#��aF��!��ե\�����7�ܫ��]�Y���4�ķ�C�*��y�ZV_E�������N.iSQ��M`�)[L�s�_�����#[�����YOi��a �BL���K�(�3��� ua��ne ��l��w�4������Q���H֯�Msï*(�BJ}ye����_���1AדG甌�L�� yS��Kg�*�.�%�����7c� �C'̜����7�n{0�R/~�o:Ah�\�j���9�����W|2EՔ�3�@oڞ}���|-U��+���`��L��E�b�/UF͓T���,\���;� ��HȖ~q���'�;�2���{�>�6K�*L.!@��Pu�����FN�zPi@=C')�X�(+h|�9A���_�0#��n� y|̎X��Ab탱�*0/5���m��/�ު7L�$�C��Ҋޗe-|�+�Z��j'j'|�+��:3��`��g�W��<�$cs�R���X]�"���L�`�\��JU��đ���᫇A^EC�נ���k���������8P����M7d�67�2�cţ}���_W���n�ېt?�Ka�Dpr� �eF�ay�c���{IM�Ɏ�y��ƺJ��S�����2Nе����ry�=�������aF;#̻c����Z s�j��)�y�*�R����G�?�j�T��2T��4[��@�j���zNYon��ʂ-�-�P��N��5�(1亜�n&a܄A����٭^e���vDX-e&�s��ζ�˄��b�����l~�.��t�ӥbC�ӡ%;.�,W�$E^����-�78[d��^3� �P�!�������u���4ݬR����_���2\�/����z}���Ȃ|ˑs�\g�~�����?�QgWK��au����}�#��şP����V ��)f����O�@Z1:����&a'�}��:�B����~�t�w�'�'*��||8��۟<%�975.��5 �Nҝ�9�0�r�vߺ���ݔ7U�H����/�EA�N%��(��w �@o��������)��=P���o`Wc��w�>E�j\1b�:�ǀ�1� ����e�פpW��4��p<�<pl��� � "�7����N3/��m:���D'��|/���p61j���f�>%� �{T'~P-Re�/��^I��^�Q~��?�>�aղ��@��{D RJ�o�����HX�}t�!����)x�\���%>��C�τ�P'�(/���s��3H{�����a� 'd�'L��{:��WRwG�P�O'i�
Static task
static1
Behavioral task
behavioral1
Sample
46291fbefc2463465c351c23f1938f09cf8e9f002ae2785232aa9be9c33e43a2.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
46291fbefc2463465c351c23f1938f09cf8e9f002ae2785232aa9be9c33e43a2.exe
Resource
win10v2004-20230220-en
General
-
Target
46291fbefc2463465c351c23f1938f09cf8e9f002ae2785232aa9be9c33e43a2
-
Size
5.0MB
-
MD5
bc93954b7265b823cc143d84901d1b97
-
SHA1
60957db9d3969975ed2cbe3e91974c5f04a57fa5
-
SHA256
46291fbefc2463465c351c23f1938f09cf8e9f002ae2785232aa9be9c33e43a2
-
SHA512
e612e8b261877e876da0ed86a16e7a4e971074b4810b84660d0cc645e43f6214e93976451adfd4b564d8a215960cc2d004d2e17b7f15bfa52456e4ad12079cb6
-
SSDEEP
98304:1jIAnpU2C3m2ghBM64Q8+wxzlREdkt7TrRmGgbhfudSeBDU2u/j8DaO37EvaCVy5:jpq3m2gfb8Id8rpGWEIBC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 46291fbefc2463465c351c23f1938f09cf8e9f002ae2785232aa9be9c33e43a2
Files
-
46291fbefc2463465c351c23f1938f09cf8e9f002ae2785232aa9be9c33e43a2.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 787KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 99KB - Virtual size: 368KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 108KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 73KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 91KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 13.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CanSiu Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE