��HC�.5�gռՠ����>�ʀ$��l[�VD8=�T�gڕ�$T��:Ծ��K��fр��~(�<C/s�� �ks[Y�<��`R��dGW�'WuԘ�a�1�D�6f�'��#&��� ��B��%�� ��H��!�XltK�Eo����f%�ECe&�rZ��W��Ͼ6�7#�>�����R��K��nnwe��������.J������[�C<t]8@�g��4�V�D��N�0��d�.w�n�����_��������@<��X�;����m��� ꣿ���y55Z������ �6(1N\����wYN���&��e��U"�I���)-i���Kc��r����/:#v\F>1hq-\��:4�J~�m�S�o/��b��ZE3�c�Qa���j�C Qp5�t=V� u� ָ��,�eK!������o��K\<�\o�V�eac��U�<�?�����m/0�fx|(%�sL�z����ʖ�vg��i�>6�Pt%�Գ��(H`�.=�53�/��g�"m�;&2�e~�|��ΙbH�e��0 ��<��D�SZM b9�sMj�dJ ��vd�'{�u�_��K�z2E�����SJ*bh�aV.HA݈��� �Evr%���|Pd��H��-�pi$�Y V��ƞv ���vx�"l_��p�P�i�.�B�}���D(�!/�ѣ�*�����н��0A�������g�����W�<�Q�ʿc� �[�8���Y���'�����&Y�9���I�}����Y>�R����[�����0�.#�bX�o$oT!��H�;x���L8�@hE�و��;mv��3BG�����=�����q�`� Μj�%����K_�">s#�_�O��!m��e6�[����8S'����'S�u�Ծ 2.�����wQ���ƫ���� ���!�2��# H4�iA��"+��$�z:y��8`�h���L���o�j��10����/aH�2��j�c�7'�ɐ����p;$f�D�1�A�9}��[i�A;U �hxx���Y�P�Ϩ�����s�4?�=�4nVe�K��*,P�r������#���3��zw+v��x ���4�Y��*��d�<٬W)�CTn��B����+�����\J�" 0������-��v�G��z�.���ӄ@TZ{������wW$dyb7�]A�h�R}x8TP� �P�����C�n[C�$# ��r.)5d�}�Y���v�~�w���,��P��������՞��zL��@+����T�vM[���e_����}�5&$�xazrSlx��Z]%���u��֧���刺��b��<�A��R�-������]�� �jEi���l���ˀ��a:�ۦ��A��Ǥ����r��q]����e=��,�#3��a>Rm��e��Ca�t�~����1F.����"��Eٚ��79Q�A�� ��D�RD���Y*�w>}�|�6"�'(��q�x�`k�,#�@��J��p 7����_������QS�Kġ�7w�}�"TE� b��b��Mb� �L�o�+Y)H�o����Y��Q\O�o�K�����V�l=N�/�*�\%����S�Na�FX��){qZ�^��6p��6g7����n|X�r��?i9��K��r�"hl�_�£h ��Ȧ�����&��n��i�;��}�o�M�}E��$����H�!�FųD�k���ߒc?wof�'K`כq^� �S�̨4�gI� �����w��2���������TD16�e�( /�2�I�\m�0���)X�3<�#���)�[D���S��Q/����� n Q��"���6�H��YkM%�5���S��nu�= �T ���J{�mAP� �˷a�O��(�>����������oG̪��c�����+�z"���J�������Ј&�H��=���}A��N� �m�fq�ur妍���d)t�:�vM�7�6��w�G���?����Hz��nz��I��m"�r���kX�`,5ב��#ԛ�]/����Q������:?�n���Z��!a:�}:��+ն9�q�����G�q����|>�L���{��8�X꧱�P��.����1[g�P�<ьv`�ξ���F@`�^XuN�t�.��������/Hh�P"�䩎���Xr��M���"EE&�Vzd�|w3��sjZ�$���@Uu|�)�h#����?�_���>}u������mk8mG�����l�S�M���oVL�i�v���A��´O�����Z;�(�i-��W��]�?9��\�07�+���10tB�����P�G黓j||�"XN�K��9rj���3D�0�'LM[/a{� �_�-dT���tʩ����� n��w���;��5� �Yq�9���A��W˽O�`9��uk�/ К�.BJ�t������M�g *#�Se�P����������|�gaψ�@zU����� ��V�ٯʠ�����X�#�)��@k��<�W�}8�Һ�s60�}�.�o����8�RזksqS�|����h��;剞��B���%�@��\��0c��M@�Z_��m��d;D���-��e�0�M�\f� Kҭi���m�iѫ�"��#= G�{�XVl���k7+��n�$���]��~�#�=v�=a1Prcq��V2�ލߏ_���$�� �[u�c����`�����~��*��]C�Ic�(;�5&���&"����8=�D]A�1/Ek7�.ψ/q�w�!6��Q������$���<CY!� �ZQ���R�rZ"��̱zݻ%�@������Fjt僌L?zaTA�Bm�,<Չ��S��Qǚ���7��3o�#��ґ��hv�0y�{�������M��G,�}Ѧ�v��Zi�v��h@�I��R����m��/�d�5rNO�D �g�*�)��~�bbnu� Ȇw>�R.o�Ni��v���ڑ/���p\lw%�%�F���}DM��D!J�L�8��H8e��=?e~b��-���k��<4�J�����l��<�����j��h�F��7�As7�?��&���`$Ur�\��y�-6XM@}���g�m��9�-�� �.����A��ۭ�ox���S Y'�-飥3Y�=�O�Y��+μ��Q?�|d�,��BO�E�G�WN�*�u���L���k�=�Ƨ��wj��(�k!ř8�P艮��F�1�P�J�ˮ04P���-o|�Grް��L��l��~�ܫ������3�ݜWfkqobQcpaYm?����N�o��1� Q(V�\��CM#�L���[;O��{�\��!.!����B�K��ClM�����'��tZ�Z_' "�����SdG�-�Ñr��M����u�НB�e�m�R���ʠ{�X�AQ�7������wo������N��|�ʃ���A��|@���^(l������=����6�ae���N&��f�5� /ىJcؔfU �%��H��la��]�x�7�h���A]��|������F����<v`��an�hij�:�}�V;��7_3P~� ��n�Z�VE����Q���������؟�<j�=�K<���r��$����t�W��Hj���G�r��
Static task
static1
Behavioral task
behavioral1
Sample
928464536aa94b2d0107f88b8cdd19e112580a23878f8f5f8e0a9195545e1475.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
928464536aa94b2d0107f88b8cdd19e112580a23878f8f5f8e0a9195545e1475.exe
Resource
win10v2004-20230220-en
General
-
Target
928464536aa94b2d0107f88b8cdd19e112580a23878f8f5f8e0a9195545e1475
-
Size
4.5MB
-
MD5
654f33599cb832b35778552c51082989
-
SHA1
45c3f354f4c4057f8fcb8e5b199b9affc255d7ab
-
SHA256
928464536aa94b2d0107f88b8cdd19e112580a23878f8f5f8e0a9195545e1475
-
SHA512
53a5d6d3a524d8595d6df163818157107492b75105acfa4aa1f7c9ac9d08b38d67cd73554f4b438601f9463c7c865bf8e47413385f22f5ce4178ea69b8c9b222
-
SSDEEP
98304:Ham5uS4LTPS2ZgZkVkXJuoBE54l7majokRVzgbg9a:z5uSx2C++JumE54oajfRVE88
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 928464536aa94b2d0107f88b8cdd19e112580a23878f8f5f8e0a9195545e1475
Files
-
928464536aa94b2d0107f88b8cdd19e112580a23878f8f5f8e0a9195545e1475.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.6MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 187KB - Virtual size: 772KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 13KB - Virtual size: 67.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 22KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 217KB - Virtual size: 496KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 194KB - Virtual size: 7.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE