�s���s��2��3�B�s�wH�%��JKq܆��8�B>q3�}'�c�k��$�+D{�:'P�5'�?w����v�zH�B')��K��S�ɪ�E�&Z�e8@v*�dj���#^ O{@0���6j�<�W{A��T����#%8���^H&Ի�\�{g�f�$��6���X����{a�y˺��>d��ܪ_Ta�d��u�O�.��ϛ;�ڞ�}`����0Xq@�E�$��Ѵ�ǺZ|_�'j��(U�o�(i5R�1���I�?��D�s�|'b�g�:�jӁ ��� �T��;���̒}dаۡ��VӺ�z�d�&�oK�q(�TgK����L�v��вnp��7�Ɓ��0�o�����wNm��,7+�`7�x�.\ɩ�2O��7��sVW�-Y;S�µ��djg�já�С�՞$@�,�a�:T+b��PT#��yr����ʆ��HX̠2A�/I,E�A�Sw�tQu�� 8'wSƍ��E��\�o�z�'�h�9���P��qH���;e#��5��In`���=v')4�C�*N{��}���t1g����J���~�7 P茪ư�%�����\W����YZ0р7�꩗�c�����W�^��i����U�+�� ��Z|\E�x�Є!m�HO�m���-�*�J��:�����JO��� Iv�Ә��{�VB#�^y Y��1��:݅���� ��u��>�<B~����4��s-$�*��k�t*�0�LNZ�>��pR��%*�{��A!Iy��5pu��/M�C�$�C��bf�4�E���r��ej��kg9->B qo'Q�{w~R�x�tg#�5v �N�C2.-G��ܦ3Ac�d�Y��0v��ߔc���,<��;ƪ��G�s��4����7�aaӧ5�MJΞ�wl�;NC���b�����j7qD�fn�}���g�<i?�H�~������xN�U���(�Ժj"v��k&ǥ�������p���_�{K��^�d:)ި�d��#��,lXY��4�����a�ˋM��fuIyI�w����f~gսT5�J��I���U���s�a~���"�MJ����c�[�u ����Φ��W �@t��<�V��qdR;���Ő1`R\O�z����A̾V�xa;��}�LLL��Y�R��5�����*�1XD�b������.���.9 \v�s�,qH��s�R:@��0MS�\\��F�5�ե'���Y1�t|�v{��E��7����g�)���Q���};����*$�7m8GY{d�YƘ _=��g���:7����j�a-�c�ٚ}�Ѧ�@t��k��>�a��C`�CsEy;:!˻�YC�y����ocn�Ed=k��P9P&�-bG��Lr+��z�V�狥�ަ`�`�/��M�s��Wג ����Obr>�߄�l/�����$�&��И��$���B�\|s`�+}�Y�d��(m�4i�ڰ�I�P�92VַȎX���Q��9n����o��Rpݘ���ROXC�d1^������<�� ߸���35>���'����h�o�r�/��+PY�E���**��2klhzZ4�G8��}��t���rD�mS-�-k�~ڋJ���LI7�j�d�Ȇs���P���'�����T��ia���li+�U�G�"�R�~� �o �/��Y5t�����<�Ѥ�E�:��̕r�Jď���ٿky���M�� F)�ճr�������b�tL�1�������daB��>K-X��̋�r<����g�zVw�^ӭ�����S��OV�ox�e��[WP� Oj�a.�|`ڤ?E��`���e��7�����O!��իB�ͧ�uoz�}D�m;Ж���*���YBI������%XD��#_��I���k�� Pʀ)��l�셏�L�b�K��9��}�ʫ����-��泳V�U���Ʊ+ղ�.���OvVؿ��NQ8GE�ZIa�V�5#�����PH���W��r�n�[?9몡��hO���I���%����7�}�j�#O[�(.��%f-:�����@�jӈ xz[7� ˆ���s�?�W��ⱎ����%�w �} *!- �� tX$����A�u6��mnf*���Pٿ�;G�ʄ���]�P~b��3��9U�4�db��=� Ձ����ӓX�2� ?��,�XHR�� 3�j�M������� �C�be��~�[T 1���t���G��Qs7�Ur����c�e�(�#C��#��uCYFnG�5�t������^u�o-qB�Y�@>ʫ��!�C��x�,y}�|�x4�Gga�AN�������y�[�{pC�I0�9�FJ ��"����x��v���{����$5e�٦cX� �U`���Cݏ]BK���>�kU,���\��mw�S�����qLmCJ���Z�'�5P���ܟU�+��F����= #k�� 3���+�-��Vu����zO�Zbz��(,Ɔ���"݉��?��_�0L��8�r��&����0D�k�M��0�H�.���8����ً��F�ꓘn�����sN��}�؊��櫟�h;ʸ�L���4!�l��t�&�X��fz�7�kp��˦ ��������Y.�!M�6M��.�Bj����!���$G�����)��ϑ�!M��h0q�a!�����*�L���<�u)�&\7*�4�����n��9���W6����x�MD��yb��5�Q0����?�_�9ٚ�9�f�6����gs��Av=^��b6#-��Dj�oEd��t�|����`�{�Ą����<���DB(�"��oJ�h7��Y����bs��$�wlӭ��WC��ɼ�����U֧"��҆��/掳p@GJWo��*KB��������Z�B���n� )k,/2UB�<+A���� qRE��� L��T�!�����ҌǓA�{����N��������>��it@N�֡� {@�Ns<���<�S�o`�7�Om~� ����@��C�,�@P�M��f�CT/#m�~q����8u뚲 Ov<N|��Nj2MU|��&�3��}�ṛ��-�#F^H2��L४�*�g����/�`�xC���\$IY��2Ű,iz�ӳ@���ߞ����1û�C����j���b�X9����,�[��Vb�c�v��� ��f~Yؐ��Ym�)��*��KO,��1e��g��0����f��ȿ:H��뵶c�#U�f�Qi�Lv�Sp������P&R2grJ~�yJ0qZe�̷SS�7�f�Тpzr��9��/^���K�鹊cS�&HzR�)�����dC�\���� `����!��$��[��x�@CF��hhԗH� *.�.�RX�?w&���9)��m���^��ţŨ����q�a��4. ��i�^�������7&�*���o�ۓ��r.��� 3�wʧ����W�c�Y�>z��_�(h�v��m��/b.%��J���n��T�(���{]44����A�л�m���@;%H��CK��G�M#E8&̆c}Y<hGi��������R����]�����O�57M��!(1dh���I+K��E�n������q�3���>ݿ �B�L���V(_-#� $��i(x�����H���'���4f�U� ��oU���n��>jK�v@�����W�m3��-e��La2j��_W����H���=�6� �~� M�H����`q��F7��f���������U��/��+�5O2sL_�d�n�?�N&��Ӆ�8�%MǍ�C�e�r��> �
Static task
static1
Behavioral task
behavioral1
Sample
8516bdade3621c7fbf50cb3ec5101e552f81a92f112eb8315452b69e24558462.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
8516bdade3621c7fbf50cb3ec5101e552f81a92f112eb8315452b69e24558462.exe
Resource
win10v2004-20230220-en
General
-
Target
8516bdade3621c7fbf50cb3ec5101e552f81a92f112eb8315452b69e24558462
-
Size
2.3MB
-
MD5
ad4ed274e202dc4a3d9746418a3f94e7
-
SHA1
1fe02c306e3260b2701235f9070a4080955c71a7
-
SHA256
8516bdade3621c7fbf50cb3ec5101e552f81a92f112eb8315452b69e24558462
-
SHA512
782de101c5f183cb6303707ef66c694ad787624088637cc2c28fb665d4c6380d7d696fdc35269a941156ac18786dc814442446724a998858d6ac5fc831305d9d
-
SSDEEP
49152:xNZDkxe1RNUI1SRy1RDxUJYB0lp/MWZ3TrkK+04BWqpNWnQIVJffRwzcD9J:xwxe1RNt1SR4RDeJYB0l1NjrkV04BFp4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8516bdade3621c7fbf50cb3ec5101e552f81a92f112eb8315452b69e24558462
Files
-
8516bdade3621c7fbf50cb3ec5101e552f81a92f112eb8315452b69e24558462.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 61KB - Virtual size: 336KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 99KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 190KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE