�S��ϻO�����[�pJ�����٠ ��8r��g�����`&x�@����+�x��<1����:~Zj(j='��'uط��Q�3���W].��q#��w�J>A�����T&��u�G� �(r5C� ��M(�}�5q����E��<Tu���.s��\��-���s���d��v<��72��woM�δ���ɭ��|4����E��H���>ڸ��\����׆���"��F1=��J�� �Q�G��(a����X�w�����>UR��a��gcѣ^�a1=�d�{^�5A�0G|�}l�jE��%_J̝{nݹ��������RU���R�c�-����I���H�8���S�b�����Z�ɱ� �D��/�|G6?�ޗ����GZ�0�k�9{k瞗9�L�Qrgi�p`�:Z��jJ��\@3ojf��[�m^�ר����A�nz#J��C�l-��%���PV��P�yջ�+Oۆ솂�xrT���dc�]�����dAE_� �TM�NZ[�û�uP���v �e#dW�`:*&��w���(�NOImf��غ�ܻ��֏MޮzH���M��^�- �sٰ4d��|l_�R-�<�/��EM��6f��-[�*��%|�P��L_��3>�,8�����Q��C�Zm�q��>�7��+���� ����j���/`°w�*2�.k^����P���q��=�+·� ㌈�g�������(u�R�]rR��+b�B_�L��j��c�K��X2P��s����9�����%�}�j���Uh[�qݾ�( grYTj~���*&�aL:�>�E�F}�C�.li��wo���lF]ž+�Ըݖ���@�Kt����"ɞRFc)u-�Y��M����5�eܾ��%���Ðg��S��s%M5��|[FN��˒?̦�1r�/p�I À����\xd����%[ ��yQ�76����L<�����Dx:��B�"�J<kO��� `��F�ͧ�Q��>~C���i�[��v^8�Y?L��*�yeI�'��U���y����`���zJ{<Vq�G�&d���.��"�^=,B�����2˭?�b��3��o�ՒE���W��dm6��tR=�r�����ĝ �,$�L�^+A����QЫf������4��^��1�l�w�=���ђ{C�%���~B���:�]���}�E'=��q$��M���XP����ń�S���[@A���1�o�����?����h��J0n�a <�X�J��ֶ�En��E]���vb��U�<<�9w��,����MQ���6"-si�(ݏ�H`��pV��g;�� )�9<���g��4���g"R2��� 6�_)�#�[��C�Kc)�&�W_�ˍRQa>O/�c��oF��t��e� �.$��9��'6 ��0Hji�|����� m���>�G�lPg� =��j IϿ�3�Β�^:&��ꩁk*�|J�~i�ڐn ,�:�9b��]��R��B��0*�/�����d,;�~�<���r~H�Uo�T���HЬ��n>��P3�k�3HN-/ sܳ�}jZv �� Ah�jq�]�C �����8�P�u�`�}4����)�H9�C�&�ʫT�Dj8Gڡij���?����g����'�3�ԇ"b������c|nf��k�*�gv >IS�a�Ct�MF��=��>�U�+����[o-��4�t�a�'�0�rN��J���Α����r�-|Y�{�E���L����u�n�֏�~S5�}<P��pv����$�p�<���8h��B�j�0������Ԕw&/>BԘ���b��z;�K��(o{*��м�| �9�VӸ�Y��vr�aᕮ/�$��NRX��i��e��N�Te���뗓+�|Epҍ�VK��0��p㚫��X�'<��g�C;Om'�� ��ܾ?i�d�Ts"�����Z���!��2MG6��Ca-�́�%�K�$�r)���>�6���o���B�O.�\in�<� �ce�LI�۳���q�4z��6��&T����v{2_�:�}��Y��F���Ĥ�w�|���j��mȿ>C6C��y��@&I �k8�]�E�$2;�b�w=���{ OdP;Q,G� �l��6f�5�v��V�U�F�8@��=�AxgWxJl���ջ�&ˬ �8�Q)4|었d��3P4Q̷�m��Ӥ+�r'6Ջ�ʢŨ_8�`�h��u���[f:��e�U�i�z7��h�#+�u]}{��#D�a���*վ&����t����nA�Ҵ��j̤�دw0�SK�^�^ډ���q��d���Ko����Q�#q?ў7� ;�@�r���y~'vn}�˪hu��(��sY���2��Tu�Y�#p�������&�o�@Yz]ѹ��j����;fw�Y������:���q�F��hBX����9-X{O��v@e�I0F?�ޖ ����ٵQ�� "��6�RQ��\7�OW9��®�f�`�-VI�����/���ʛVb=�ʯ`�� {mnў ������8���&�6��C@���Q����x� o��q� c�.�,&���mҖ� �X#���8���d� ҫ7x���7��Q��+�y�4�ߴ5�"�:�z:*~��ɚr���:@We!��"m�&�WB��t��X@C��\�����4��/l����8�yAw`��hv*Xb�7 ��>���|�$�T�]]3��� ��e�)�T��=�Gܭ���:����6�I����kY���Q����k�e�h�_�4,=�!�.��Rd��c�G�G���`.��r��M�Z�:�ܴR����������ē�yyj��C�����M��ȅ���-Ԁ�6蓑��m\^8�0��m�t6��tZ�M�C:z^H\A����שB�M�"���a&��$}m�FڗP�f�>�H���J�gI��C�[�1�q�<���٤��W�zT�㟄���2-�M�n�.�\��+� ��J�xOn�Q���ܢ��t�0�Yyb1Ӭ#��Ų�~�K[� ���ә����mq�i Tᝫ�^�S?5�8��R8M��i�4j��P�m+�)h� ��\�ׯ�Hjz��J�=�����/���ƀ�Ge�gƬ�/�K\w�Sjw���(��3 �}�#�B���ͮ����OD�|gǐT1?>,�)��T���F`��b9U~o��ㅃ_hZg��K ݶ��H2U�Ș���DP ��87�*�R�PT"��B�G�#:�P㑃pR�QEe����d��(���+9>�C�m�
Static task
static1
Behavioral task
behavioral1
Sample
dce791185dfe0ec4304b1e01ca457b7c5c2cd19b68eaa7c5ce058c07f09ca979.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
dce791185dfe0ec4304b1e01ca457b7c5c2cd19b68eaa7c5ce058c07f09ca979.exe
Resource
win10v2004-20230220-en
General
-
Target
dce791185dfe0ec4304b1e01ca457b7c5c2cd19b68eaa7c5ce058c07f09ca979
-
Size
2.8MB
-
MD5
7a50175fc655f28360531dc00c14699c
-
SHA1
2b8ae4b884ee12d6c08c187e597e39997ccb4030
-
SHA256
dce791185dfe0ec4304b1e01ca457b7c5c2cd19b68eaa7c5ce058c07f09ca979
-
SHA512
87316d52e8568887ece2b4e5866897083dfad6bb16b27ba1273e40c0008dc178be2ef11e6532b19578dfc62b1d9f86cfae19e757a582e45c72b3c123d884e5a7
-
SSDEEP
49152:E1EPIuFppt+qYdd2ZaHQcSpnNyOylhmn:E1BCp4jdsZaHBIZylh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dce791185dfe0ec4304b1e01ca457b7c5c2cd19b68eaa7c5ce058c07f09ca979
Files
-
dce791185dfe0ec4304b1e01ca457b7c5c2cd19b68eaa7c5ce058c07f09ca979.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 360KB - Virtual size: 768KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 40KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 40KB - Virtual size: 436KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 12KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE