�j`�@���E�wZ�ʙ�ÆG�y'��ڗ3�p)���� ^�ᘃ (6�|�z�^���+V�� �;|��9B�L�!��1s��ָ�M��dM� �fq��:/LŲ�̻�>M#��*��q~<^'f��K����WdLҚ!�x�����N�����G�y��1*r�ざ7�mP%B5��`h��&��2;[k\��1������p��M�ػ9� �g����+�=�T�� ����Ƙ۾�*���lP��-_�y,���j�+�����T���848y�|)W�,�(J�g��+��"�6F���I�Z��b$;���8*��^G��( Tt����s�����Ҝ����F���UA��p,-�K�al�Beƭ��l�3����GTY�<>��l��o�chH�#�=�s`�r`�O+��4}+���1�0.���R3�0�{A�&�o�a�1����Zb�Fn1K�4.-�5�>�#H����+�e�lH�:dVށ�#_���F֘" tC��ǖ��?gd>��fʠ��)DHJI44N�H��C�@�d8,g����?똣c&��)+����e�S/���������,,�c��a�ϳ�D-��'<���}�dY:x�]�Ҍy�����rut�������V}$\k�e��<';$]�`)�1�t'�cR��#�"���0F/������HDa�����z���e�s�&�e��`u#I��4��h���2��AY�cӋ�p�nT�Av�D��njl�2�H���Kt]`|��S$��3�m]& +\��;�7M3`��y���� ���H���l���1�o�)2�j��g�u�ۭ�@�Z�Ǧ�p㻶~�\�.G"܆E�2�j��/!ф�9���(�F2��@�,r��(�۹��u�5�����xW^2{PON�ˋ��hg�n{�8�C��!�����uH��VM��W������"]�\��V(?{�$�|Puj����?pz��N��#B��Ń����x�2 ���^Ϯ�:\ l����F�[�!�hm]N�p����K��')a���T�n�Z��8 �ޣ��,���� 6N���j"�Ӹ�m�5/�ܖA�����ux�MH˵�j �G��HP�����1�zŐg�'�qV�{�`�亩���u��mM��RC��a��J��z���{�3o���W0�����7,��.���$� ��`+�e��P�2{�~'Ē�a�CW; ����sѴ�����o�]��*�J˳i�˺�bl�����N_"�eڧ��qmcwm�ˤ)\ i,+�TWA8+��s��J[P���o+Dj!-Zo R0�jk}"n��͈BŢ�_�*���{C(�+j��>Bk2O; x\��P�E͕:�6��l�ا�$�� tn9�bl�ql���y�r\b^�t�ȽP{ɟx�I��ct��o���x��?�?_a���֒� ������]jޠ��;�e�\{����b>/'�1�*-h�&7rÚ����gc��f���(��d�uqwR��G��L��CpH�%W�v6�pK�>sb�A��[`��>������$��7�����QE�d��Z ��l����ht��h?�qs#k�^��(��d�H�`��f������$�W��~���ʙZF�u�xpg�~�z-IDX`9��f�u` �7�R�K���� �I����&?hB��d9���͐ `��5��e:��(���˼���a.&�', T�>yMݼfR�%�a���lؒ��<v�������e��Cݧ!�`���yD$s^]�k^�vF�9c�ek1;$ۈ��~$.���&�ʘa��+���1�f���5$2�u>��K��}냁f�%a�x���D�݂D �鏠!h��Ps��TY���)9�j�Q,�+�!��F��9܄2,�H5�%�2��z*�����)����e�b+S��T�?O��1������Q ]UB%���4�3��qҼ2Ο�羄b��.!�H�2��]�#//7f{�ڐ�PmD:f��k��~��L�_�H2��GTbv --��pU�������y'��v�=�����g���5dSy�9�]�{�k)+P!��O,� &��];�d�����8j1�#�!3���^��y�Hc?���8彞&O��씭Gs��Q�l��c������L]��)}>fY}`u� ���,�a丹�E��(�՚r��*�@�ל&�%���hU�(GŸ������,jy��lE�9Z++mgK ظ �����M/����/ ����n7��G��8"/#�?�ݲm���_L�2�^i���9e� �@�������0|g(CJ�| g�˳�=��sx���5ŕ>D��;��C����� �E8��iMj�1�A/U� ��`��/ty���]�[!GY�)��R>��`���SJ'��@RȧcsZe v�,7���2 x��㓹"�)T謩 �F*�W��hd�_H�p�H� ����h���8����Rl �Nm��t�U�|7B�k���~-)[�����*�������`����:HC`�M�#��#S��l 7���#%���$n_|�%���?0�ǩE��^�ޒ�)hrC�* WJ�k��Dr�8���=vXfz<o.� �4,��% -x��w@��k�y��t �{Nqe�Ŀ�G �@���y�Fl�$�8�j-z�{1����Q`$NB��`_��=�xm蚎 c�`������#=��� S�B��"���i�֪�0�l��+�*�>��=�]���Z~���Q�,j�{����;晊�8��~S��l��QM+��7Tm�aUa���<�L�&���-�I��[��5�xo*-G���k�AV;���{��^�~�*����ܶ����x4B9[+KX �o[��I�f��p�WU�{�珴G'2R���PЙ��o�`�?�V�.Єsx��z�s$�� {����u��ہ�6.��� �n8����f���d��oYT��$[W�)�*>��� [u��5;iwi�+k��� ��m�� ״R��W�1 ������PW^f�C?�)+dۢ]ٝ�YUH��2WT�D�2����J���l��*𠱜v�~��2|�.�t�f�C��OF����d�e�1�g֊eY"��H�?|����#(��'�!�Fh1z�C�k��RKG�����J�g�nV>�FaS��Z�93���Ο�}b/'�u���K�+�R�X6/�}�v�>�����NchJ�fF�<�]���.���8J����4*��f~7�%c!E�����
Static task
static1
Behavioral task
behavioral1
Sample
ef3132d3e04f6450f0d2381edee39bcd8db0727a347534fff410b7cf2851db43.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ef3132d3e04f6450f0d2381edee39bcd8db0727a347534fff410b7cf2851db43.exe
Resource
win10v2004-20230220-en
General
-
Target
ef3132d3e04f6450f0d2381edee39bcd8db0727a347534fff410b7cf2851db43
-
Size
3.1MB
-
MD5
433ffd1876ea1cf9266c5fcf0c9c204f
-
SHA1
ab899d15a1ea9ba0128f8c1e2a86722cdeaea4bb
-
SHA256
ef3132d3e04f6450f0d2381edee39bcd8db0727a347534fff410b7cf2851db43
-
SHA512
59df3a9d1df54c63ae3b5a2b64e81347aff07a8ab7573a0e908723792c0079c2dca4432ef01ef4a0c3938f6dae19761eda0b9878263022dca41d2224b944c887
-
SSDEEP
98304:BLVto+IQjauv6kry+bLDrU7HfrPbZ7TbvtpgOVMoE:BRto3WauvPrvDKrPbZzngI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef3132d3e04f6450f0d2381edee39bcd8db0727a347534fff410b7cf2851db43
Files
-
ef3132d3e04f6450f0d2381edee39bcd8db0727a347534fff410b7cf2851db43.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 63KB - Virtual size: 276KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 43KB - Virtual size: 412KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 281KB - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE