ޡ 5b����0�2��X�\|x�����X�ŏ^`G��tC�6�Ru�W��*�����Os,�S+9������<g�v��:��-s!�g��{����$E{O�䍓 A�� ȏ�N������}�1f�c+ ;�B*����f��&��}����k��Z�8��Ŝ �, ��iG1�<^�a�ї�C3@i��#���(���)�=f�%��8�ˢ�,��-�� ����6�<$�_ ��b3}:s튮�O#�J�z�co\����G�@>~4G׆j�`�|�}�r���Gq�;!�Qsdt(�1�Ne��?6� �D�5�H�%�@����g�Y{�@�k���q]n��� -���HD��f���v�Ku�;��5�О���� ��j������^��t��7��qw$.�wa�ɓ�[�t�[��B�:��ä�p�w5@d�y�*�ˠ�P�d�@˖ϪsK��P�����a�6�����/�K-:V��dS���Ǫr�%�;��@P�kG��'�{w�-ʶ��?n��[�7|�@?]����='����6�Pܵ(hR��P�����~��Y����/!%�<NL�2�Od��h�oR:�O%_��b���I)<$wPs�$���$�68�4U|�|J돱��P���p��R��E����Y쬐3�����xtm��rR��i�]�Vi�'(P�L������Y�r��O�@s��4q�K̯-��� @��{��f��./"X5s��;�ci"��.Ǐ=px��DR��9..�+��ȵ^��?^�j*�ݠ�S։��9O�@����0��p�D���Կ�݊h��_Wh �1R���(�:�J�/�'�������}�\3|H�d�K�K&<P��Cڠ ���V�Dl��{d�ޖ�WnSql.N���&������Sy��K�[��3���`��|L3T��@Ƚ�G �ʝ:HJ�#�E��A��]�{���x-��w5 �eL�v@cj��l��%�Ц�U6N�T��V��y)���o�����Elg�s'`7���C,ڼ* .9Y"�B%�@���尚�Bz�{�Q�3�:� hv=���HSz�O!�[L���CG�Fq/�~�������順?�-�6y�j��>�]=э��ıh�%_��8$9S��ƾr�%/�x��t �s������FFr0n����g�ǧ�uD*oF"Iu� �����9+^�Gbsu��m��:|��PJ$eI<��@ WZ��Ǯw���� ��D���Y��߀`e����� �Ӛ6� ���7������*�n7��Q l�`��c�=k隭% $|t16�������fۺ�r��q���v��������g�VE�<b45�Ɠ��\I�Tߘaqs촯��a�2vG�J�t�����~�#a��^�W������ʂN�4���v��"�s!����@1f-�����o�x��xߨ�*�o5�OM0d<�����q,�1�sZ��"z![w��R{¹'�.+w�-�Iq K��&,t���,� ����{߇������\�}@x�O��M��,gS��:�1��E��ʑ�kV�����MGS�����M6� L����;�]�5wL�T�����3�#�H���=�5��N@"�[�ㅄ ������.������t#���:�����7���������-��H�9u��su���f%�qmX�&�;�|2bp���e�||�D�дt���8����v������*<����A�� ���Ly�C�\xv'ݦ)6��m���� �#��L�"��l�{���l�;�A�x�5I�߇� �{�N��mJ袩�%����D�`F�|�_�!�u�!.����[_u�|���������u���������Qh,�V1�d�PL���)8�#��]t��Y�]J��ꈦ���㮖5�U��Ssh���<]�MC0���jX1)�sp��2�qJ& �r.�q����C&s��]�����?�������!Ln5�������S�p����F|?z[ye�n��S~v���#S��7���4s�PW����)v��K��(G���mG�)�W�:-C5�=�,����9CD��-@S�J��p�>��vU�}/Z�������;LJ�Sl-�u�P.����ErB������1������-1�e�3}8���v��>l�֪zo���dO_�?2ճ�, lk�NvJ�L&��e�b���������5�����@~�����4�"��ǫ��� ��`���Q�ZE�NoL�-�Z�/���Z��m��Y����%��1�9n���jB�n��(Kz~!O���f"cI&[�@����c�a�{�{4�f}Mf�_��"��M�ox8�C/SX8:�t�X����R�����B,<|#P�y��7}|6�4a\����oh��8�H&x��WM�}������!�XB5�]5����3�ܷ(�&:���o�/��<�݇x�������Oyb�]W�X`��/7����vB-�wC��N��sc�CS�,AC.�6Gzj=�� �J�N�d"E�6'�[I�_]%�~��M��<��j^���;��|�OK�͇�1��(��+�nQw�B����06�)� ҝ��dKOb��8�66?�&���R���*����:8r��,|���7 J�� �j�f�n�3�kE�=Ֆ�;p���đ$�*6��>1�v����o��(�m�w �� ������O*���f�H�1��q�Xg�8`%���t���������Xv��of��������?�P�e��s���f-F�S��0�Ҕ����q%�>������˺ �ͨEE�� d ��8d����$3{(F�A:K�,!d����w��m1afƤ�a�l�!�0>��Q�se�WTU���i�ӤA����fq~��u�>_k4��;�t��<�%�� �O1��P�D��~�F �G��m��|�~e�/�'�!���X�`��T��q`�c��n�n�����n�s�ҝح���gw[M�I7���L�.�f�������Y-@H5~X����)��� ���j��x�om�����lr*�.{Zd�9y/�3�^�w� �?��N�;��EkfAL�H��v%}o1��CsL]�HA��?��8�(�=�A<�kh�⼇ѿۋ�:ף?� ƃ�g �V���lT����e]�]�5�}� C8(�R��`Tw7�{�G\�5� Dh�P�h�2Kꅏ��w V3,xA�Z��h����Lr�TW��r�n�e�������{<��~N˔�[��d������j8��*g��������M'S���֠��ч�g�E��N�ש)�4�����|�wpH���a���:�� m���F�.%�����ڗN�x*a؆����sYJ��`�Z|g�F�54�/��օ�vy?!�����u3�~�)��
Static task
static1
Behavioral task
behavioral1
Sample
3f742f01dffe092488a6f82c31d7ae886d9da39281c3ce0b5891413e2dfd69ab.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3f742f01dffe092488a6f82c31d7ae886d9da39281c3ce0b5891413e2dfd69ab.exe
Resource
win10v2004-20230220-en
General
-
Target
3f742f01dffe092488a6f82c31d7ae886d9da39281c3ce0b5891413e2dfd69ab
-
Size
3.3MB
-
MD5
225c9239c8a607c56de467ba88e63a9d
-
SHA1
711e56627911d28c991417198dea404e09d884ed
-
SHA256
3f742f01dffe092488a6f82c31d7ae886d9da39281c3ce0b5891413e2dfd69ab
-
SHA512
8887ad02ab6d910e45f3e38f0b78b5c702faba740a71bcbf7f47f82aeaacd0bd3b07af71d7785a21d312605e66b418626c44b7da900a3a5cc2bc98d1aa3492b7
-
SSDEEP
49152:L88SheLKe7H21H04bYzfFUVcn8rZvTqS7+TzD77snygPMnE6emhz3Ndx4W6Xy:48eeLKe7+YJUViqvm6Q77sn96eq3NYi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f742f01dffe092488a6f82c31d7ae886d9da39281c3ce0b5891413e2dfd69ab
Files
-
3f742f01dffe092488a6f82c31d7ae886d9da39281c3ce0b5891413e2dfd69ab.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 98KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 33KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 79KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE