�Q�LM�]���g&�lI :��TюaT�ͭ� �.����M��������ܢ���wD�&ڂ26��W�f�(�Y=x>hV"�&t�V����ZMs��rΒZ�T��wp�(ò7��mt-ʜE�\J�>4��FS<���R�ٺ��Y@bn�u�J\�g~�;��%��{��@6n�0 ǐ^A�ɏ����>� ������MJ�뗞�^�@z���0-��$G�!N�ߙC�=z�qi���=��j����9hT��\�{��%����P�ҮM�Nj�T����]�A+>eoWw��+���V���+!3?�Q'JA�&*���(C��4��k�<f+��s\'٢&�iJ<F@���=n�U�d��s�"��P����;={�&p�U�E3T��͈d]�b�a r��h*}cU%�j�XN��J�!��"LD�ɛF#����L��Y���Un za����`���5r�xO"Ѻ������Wƌ;�n]e�6wH��p��I�1"�"J�q��d�W�"�<w6���w2{�7W��l�hӁ/�����Ю�Y� s�M8;�I#T�^ݼt��G��g5����AD�����/(���S�M-E�'�xI������,y�16|�N�o9i? ����6!�E��˫�G�c���@��J�jٍ�)���OV�urW=����@�6�p��Zz��g���#C������+z!&6dI9�������N�d��%P��q��ul������4t�c�a*���?w1vwQ ��4�Y_��J�{�T���l�����/X6vM����P�NF�?x��6�/��wc(�0�ʗ�)V�2���b�g>\i����>:U�˱�2�3]Պ�TF���ݨ}�[[� �kc�������-^x;��7m�Vt�� m,�.��+�g�S�K���e^P�^���\(<�}��9��ؒL�kob�O���&���!�g(�;l���� Q�觧�Rw�w\��m�S�,��uY-7��;dQ�ޕ[�F�{JC~=1���ɩ҂�֍t~bZD��"^�j�H3�m�w˰U ���5wcl0�)L�71z� {�y��g���G\2�u�h,�����/t��u��� ϟ��h��(h�jT�q��ikN%�5`�FE��Ȭꟊ��n����̫���I:��½j7%�W�1�n���r�j��S���#��cF:��^̈́"٤ҁ��I�>ّ̢��[�"�ӿ\�\.�L()1���<W�1�@������z�@�iy�M�o8�L�:\o��j������ ~xg��p֪a7�'����5:Y�^z��jN&�`�����KH����;s��Cd��(�k��nk�sD� :)�C��]�nN3"y�*m����`�\=��~�g�)m���)�6��:����j$7st�Ƿf�Sand'�ofO ��@�������VC!�l�@��Z_ɌL�"Ū�KtJY*���dA�,���X�,pϙwʩ�z���/E����5V2&F��Fjk�7̜o3 ڸ"����&V��e=����(��5��]}Cp3g�8�T4]��M�ր]ɰ���hx���d���7m��/B][`�%��_<������I��N3C�ֵ/�V&��T6*�~���D��ϗ%��k'F�[�iG戼l����� Hz�-�{�:[e�d.�w�8�� <'��8zk�s� �,)�������!|B��T���"q���qt�F��?�����2��<A��xW�Ғ��~���<����'RA9�.���xGdF�����KI�����צ��2xP�O=�B��5�m�j-%5��O���($,���C�8��bK�=,��3�ΝY���~L\�s7LH K�Pp�^:��:8�!��W�/��]d� o�/����UF� ,7k�!�ҋ���6����;�X�5�=]_)�y���4l@��B� �j��Y��q���=��PD��(�9�GF�V���tj�������T��`�*ş��Ů�ML�)h��X�jd��X�*�9`���p����@--ԛ!Iv��h��'˵��&{�n�L9<�Î7}���02H��i� ,�TjOׯ��E��$���XRV��A�v�aR'� Y��BEF!J���T��W�S��6�Zrnu�$�9�$W d� ������.�6�o�$���-��vu�f{���AW>���W��o�B�7�<��@,�_�5�(���>0:����0V�o�Ar���/��!� ���l]�兛C)\Y���mV�ٰ���&W�d��v�}H*; �!#��#��^rY��� 2�uьi3�zrP���Ԗ�����1��J�PK)y��F-L�<U�[��+��n@a�?Rg3�"j�EXC��-fX��KS.I�J��S��$~TO�Y����AB`P�<�Z�&d>�"f��G|0`����~1���-hp��o����u k3���m�YdU��1��1�&��|M�5@�?�5�n�9b�Hֻh�������Y��$���<�& |"�NHl��F����o��h��������Dtr/P�����<��Eۦ����v-{L�����U�'Q\�R�K�J���)f����\0�^�-�&ܼ�v�3� �F�}O��j�jz����j ��� � �&���Q�;Nt�A�?%RG��-*��h��^����n^W�N3�:_��}��7�B�c����*�S��w#���н���a?S/#p!�jnc�F(��|7U������c7�g����|Xݪ���I����큦y��B;�#H�� U���?Wl�o@���~;#A*� /��+k�0X�>��}ƹ��V��ϗ�����)[�N������_F����N;��Z�t����6��ϫ�%g���Њˍ-��� ��g:�t�k����9��)��! CECΧ��u��zh�K��ĕ'���Ha�A�U��\b%I$��K�jK�^��3ڡ��;� A�Q�e��5S���mPJ��6�}��0ʞ����f�[���C}"�Y���lt� �dy���e����`��~,��unx�O�5�L`�����+$��1F�,�<m���
Static task
static1
Behavioral task
behavioral1
Sample
1ed85cce02c28c943233f736467e97f5.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1ed85cce02c28c943233f736467e97f5.exe
Resource
win10v2004-20230220-en
General
-
Target
1ed85cce02c28c943233f736467e97f5.exe
-
Size
5.8MB
-
MD5
1ed85cce02c28c943233f736467e97f5
-
SHA1
1fc10f69afc504377499e83789c4cebe95603127
-
SHA256
4f415202a917f8935c1fb8eea6631a999c6d56c835d26e42a1ba4f3c6da22656
-
SHA512
7e716bc9121a31f3857ae207dddd45ddfbd04cdaca59b1daeb7f1f2c92374d0c90b5f721288d4a59a359b29d7d0b5c61e80d80e6bfe6e87cff455684887ef127
-
SSDEEP
98304:f/7xCcIQSdeEbi3OmqCkLPSquAAbujaog+aVZ9t+IcegD5nxf4vwyddcoVxKIsxo:EcEvSdqCgPSqcbujfmf+IMDRCdVe2Pf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1ed85cce02c28c943233f736467e97f5.exe
Files
-
1ed85cce02c28c943233f736467e97f5.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 44KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 176KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 19.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE