����nƐ�\�"��&X%�)]Z�:���ab(H�/��9�Z_��w���m�$�� D��)����-��e���t�1�Or=�9���Vd������_���L����f�i�c�M�μ%<(�`��N_�$7J��p�˭��[VX���� ��)�J�!��E������`On��V�<�-���M�-�Ȓ�S������gAj��H���ܔ"!M���qUk\�`LV��n��I��U����ϼ<�� ��]Sv��em<f,��u5�����4������U��%B��(�y�Y@��]R{h�F[dc$Υ��9���t7��)e���FdQ�0��Dgj`r�u��NR�Y1l���~���t*��}���f� ލŷ�dz�],��l����}�z�8�~d�����2�vFR�����0/Im��/ ��x�����9Kf|yϾ���-�����=4�Ş�'i�-�D����L6L��e��,;�����C�h���ΎE���Sn-���;�^84;b��X6<�)"�o�XF��A�'l~�Ӕ�*�TH� �8�Pʗ����aN�ٶ_$U���$��k������ր�k)-&�_�G���C�� *�(s;�*�|��b^U���,R?V�#;��eR�� �l����9e��cr0�j8����~���,Z�����fs�aj�ȅ��67���a�^o��Dhh�����n���j�m�h`l�}�H~^����5�?i�Q�]��a�t``��7R"�Z��FrM�[��y�J���V����h�������[pn̐T�5^�6v����˃�,���Uԅ�@��[2��d����ڐ<v}���v����3�p4����V�/��\�Ѫ���*��� $m�>���f�S��~s�j$xK��虶���=�D7[v�����ꔉ�rsoc�2]�Hd�9�Ӹe�cI_�7H~W��^��*���*S�t>�����&2��ܵ�¡�q���x��Ɋ"�����|c�1��[��̤�/u�"��눑;H���gP����� ���_������xؕ&���v��K��"�A��D,7!1���*vG�/ �"�F��,?������R-#"����c��l��I������� Q�v]v��F�@ ~�DMO�!�t"�+��W�([Rer��W��F���|s��>��R�Z��-�t��%M�+g����ʑ�~y�)H4�V�v+�0L�gW��_�C�l��W�߳㪇��^�<q�����q��f��ݡvxʪd@Xª�c,Q�4�E��2�1�^�̠U����d�������M�x�����{��<�l ���"9�@�iX��?�:�P��c:�Y����2���Bۮt2�9�9���5�S��la ��$V ��k�|<���@~�3\�P�RU8�d<{����X:�=���}N�P k���ə���ݹ�R��㫇>>H�Y�*��Y77�;������"��e�,��$.�4f�N ��rn_k}��� q�R�ᰊ} �`;�ƻ�c�I�[.��ۚ|�6)�g���;��lJ}�8b[<��ZK꭪�bkvn'�������IlK�0����I1��h����w��~ݜ����*�٠�Hj��^ /wEV�\���ΝEͺ���|Ն��E7lE�I���T�څzk���'f�a�� �1%"i��Q�;���ұ2�=��ȇ��0e����f4�R�$���G��u��s�V�Y�o�;A~"9w����ؘ���N�+�G;�X��yeK�Q������G?��.�8F� ,zC�滲O��ʧs6Iۀ���|�,�JԸj����.��lQ���< ���IvywzeM�f�x������?H̬�z��5h-��u���¦WF5�%����S@)}�'�?���L�.�e<'�-��JD��c�)t�˻Ō����̎�u� �E��ΰ���N�6��!;1 y��~ڜ����I�r8ٝ]���F(�v_�p�'��6@����|�� ���:��_>�Zu���%��N�J.7�֗������g��n�w<�e�ݮv�L?�9��r.��_3�� ���m#_���Q���D:W�In ˣm-6,�<�R{3�tB����Q1<��q!���2D4�̉^Z!��ܣ�� %؆���8�X��&*Џ�;n]����vDM�6 �Z��_ ��,�kD��Ptϗ�Ոa˱J6��t��k�������3��%��u@��G�"u����g#c�v ��vܕ!0]���$e�Ꮹ�?ZYo�b*�͐v�c�/��g��7j��P�4��~�/�1�Vg>hZ�\-��@�������.o�6 �� ,�#X��{���.z�ǒgG6�Ȩ�Ʊ��V���kAј�R��5:���Y�<��"`�U�.��^����QS7;�[��<S�vj�"��uք߷:�u������w!-{o춇�H���P��)$�4T���j���Ǜn�����k�T���j�H���, O3�������Yi�>�o�R(��d�,�6k��g�BO���݉%�'��N�����9��rCv��Q�H�F��+�\H'�c�o~�5���� /����J��"���V��j3i��aD�2@cRD�=AX�I$֢-#���O�}6�15���/�D|rl�2�B��ض6�Y��rW`|5Q!�d�������s�}��4C$ƻ���3���� ��Hu�z�t�$�����R��c@`�����C�}SJT�1�I��'uj{���H~���Z���㬳@�*�o�r0@��h�x�eZ��6������;���cA�+9pw�����G�(���:��p63)�x=��Y?��Y]�� �tt���n��v<o]��D�G��|�����8%�R���˽:��Ja�=l�D�3,��8�ıЯR��`�6H6k��*Ց���K�q��l���WS5 ��d�}�.l'P��nx�!l�!�������o�b*)-�����{B,��и��K�=;]��>o�Ul� ����,�V���K9-���i��oĞ\ �4[{b�\��sALm�h?��{1v��i:5>91���U�6h���~�/�o�� ��>����ڕV�ҏ�Ϟ� tM�҆A���4�Yw���7���97�>�*9~��[f��.kD���FW�B�(����WڝV�_�b��'�}�̕�]ش���Xw��u}6�(��#w�_�F��%�.W��ut[۩�����@}G����"$������aR��!!�S����h�c�=!���D?�ViAE�=ii�;|��B���VKe��e�Fg��TO�m� B9��co�z�� ��.���>��3 �s�w��&�X���u'hN �� *��t~�Aap&��lT%K7����'�o)�*e�n�ep�jڗ�a�3�y���1F�<l(��t���݉�7I �D�VS�j5��㾃��%�>oGs�!���)W%Y-�Ü�7�L���Rچ���.��� ��e��sr����>���B��Er8\}����Z��.���ۂ̒<�4GrmRWO�EV��*� ��.������Үl�%38`Et23�� �5�z�45��I����WAλ�GC�Ff�����V#�A��}pQK�m�R�F'$ئj{�,f`��,���s=���n��LI <�%҃�/VcQX^x��7̈́�@��_��mC��+�_q���ОO�u%����.�/T����i�sjo_v}8�7�7 3�U82��!�;+I��AGɐ�qc��[XQ �jD���5}��||rT��n.�؍G�ecݬ(��Y����������/r�Vܭ
Static task
static1
Behavioral task
behavioral1
Sample
499c06943404eb006462392e4789538a9a96389d41dff3cd5148f5e0cc9c6691.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
499c06943404eb006462392e4789538a9a96389d41dff3cd5148f5e0cc9c6691.exe
Resource
win10v2004-20230220-en
General
-
Target
499c06943404eb006462392e4789538a9a96389d41dff3cd5148f5e0cc9c6691
-
Size
4.5MB
-
MD5
0c9f536b8f5269f3c153cc756f02db80
-
SHA1
8637d8a55331e3db83e0b355c7c211ad43910091
-
SHA256
499c06943404eb006462392e4789538a9a96389d41dff3cd5148f5e0cc9c6691
-
SHA512
870c0fce65e3348f6afd515b874d351bae67bbed6ca2adde8b10ee8d138df7609f292fe3746643c285c60555e074eeb883e1dd5fe8ae14f645641e791b4b2501
-
SSDEEP
98304:h97wJJXJIKknXTsuSd0uGmuXpXamVq6WHLBTAkZEmFLsHSR:L72JXWjXIpzGmWpKmVq6eLBTFsyR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 499c06943404eb006462392e4789538a9a96389d41dff3cd5148f5e0cc9c6691
Files
-
499c06943404eb006462392e4789538a9a96389d41dff3cd5148f5e0cc9c6691.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.6MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 186KB - Virtual size: 772KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 13KB - Virtual size: 67.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 22KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 217KB - Virtual size: 496KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 194KB - Virtual size: 7.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE