�O^��G`�[f�,Bt�)=�]��d7�k��R�#�doI~b�=>h���p�A|���Z���w�l��� ���[E��&Y��Džd����-~��k��3�8�"���!�����,��!Xm���gd�r���h9��%>]*Z橉�\X(,�HȐ�XH�D�Юes�_��֓���H"�"���d����R��z��[p����#a��O,��@��� (��I�Bw����e�-�v�n�=���q��g �8_ ��gMf^�GR.�r�9����W�+��Q�,6���DžR�������9���+��R��h�(\���@��^�9��Џ��Q7�ӡ��; ���Xd�3f�����@N�����S�nNS��=&��(�R���W%kDK���rK>�p��P>%��1�qU8�=�c0��U@ѳ��7t�XÒ����ڂ%���{�1��6'�WP��˼�B�_� 뢊C�L��,�W�7�.3l_+5K~�@� A�30XZ)O�1]���V�EKn����\�J;�i\b�آ��,�F}�L�6�ph2�pt�^*�T>q�E�E�������ߴ���<B�Ľ�tU�����ߔ���).�[��*M��4��m�<��~A]̚�G�%�Q8[˞"w��mgo�X�.��6x7��m�\Rъ;S$f��''zTE�B��$����g���x�~qÒ���c�eʗ�RO�+�r�c�1��Ql@�Xnz�E�]�@�9��M���`>��7�Z�dp@z�{ �i�Z;-X��&rP��^d�����~���ͽo��m���Dր���89��S砻�"���ŝ� E�U]�Wf!�������G��;^��G@t�,��5�KR�ro-��/�4�G)�-;v��8Q5�N�9NBP�kd?}���B��x�@�{-z��9�n��{WJ~����/fl�R��ߒK����}��Y���H��Qt��dg�cU�5�@ֺ��\���cQ�Ws��c��Xc�1��9E��ZW�.�� H�ZXt�"�eMZ�ؠJԎG7.��d?�(|^����e��D�� ���iF$����K��G58�3��j��;�RK�Qh�+��6ez�̕ߵ���j�;�!�gsWDZ$Hk���%���K���d��e�I�\]��UIc������'� '���u?}m:���9{Y�����!��³21SC����mnz"��,�Qy��1����;���n�M0�U��:����W�lv.��%���p��|:��&ʴRf��G6�ǿ��g��I�-��l���=.��8�X���?(���N17��i�4��mʠÝ��\�����gPEQ}e=�T���fw�Gh�_�Ζ���p�H�1�NѼ%�7N��:J�QЉ�I%�G��t�V�p"zh�g�)I��S}��M���z=�-���[��Qӷ/��mS��kT4vBz�鉫 ���`*��T���f�#�EH���)6��CF��D�C�[hj$�A[+<[��з�#V�����E,u¨K�I��Qpe9�`hn�������!� �Z�����S.�x�&%��p��i�/���(�\b�࣎���v4X����#C8sU� �X��@c�[nw�,�B�OM����[L�U+[�w��p�@�gx"��m*J������hjC[h�oGW��ڷT��e�&`i��8�!�߯xj���[r��p������-V���|�x���h�,x�F�����h���y�k[�d_��&DJ�1�,�rCa1aJ�V��*5;�h� )$Q�3� �C���^��3"}��8�������N��Z�_�D�ל?�J���V���,V��A0�˦|wK5�{ �; �rF7�A��m���j�hQ ������[�]���Tr:���̜Ԝ��R�?�����*X�G���vU[M�ԝmh����L�]�z���lb>O���$!4�J�VV m8u����sg��V��#bv����*s����vI���w.���D���(�&v�E-=/0�(��>�;m�(=��S<6Yԭb �Z�_d�[I��k��?W�1��ܮ�5Xul`Q�{�4�����Mj̸�<�&�dD��q�X�v�We���7�Ɏt�� g��nj�#{-�2*���u��лH��i� 6f����-Զ)a$�+9f��<���x�q��s��$CQ*�>����4;#2����R��O�;v�?O�]A�y{�8)��n��v�oy��CEGB�0��B���\� %�W�W=+�go6�_�����r���|ϵ��� 6���\�m�9s�15��u��uE��>s��CT����&��A�Ȃ6�?��4�e{���Kl���ou�"��TUKK�A����5�^p���If���̹YFXX�U��MO'a�9������ q �VL<V���J�]�F���d�8�t�tR�-��Y �E҉�-�H�7�� V`���2���ڏnYB�K/Cfi���]vM����%n�I3V�����b�pRI����YT%��u6L0�k����v�v>���8^j�Jj���e�Dy1͔�|���%HТ`��QST��3,d��#J�nV����5Y"o��50�.+�%��v�Е��(?xL��˲%w$���C�@Y�㐑Ҳn�`,�37�����B����0�����']�u�e%�#�L<'���1BSv��C��zK���b4�ы��Ȁi�vX�4�S �yt"|��w^G����[_U�ҊE\�%��102����p��S�x~���\@��#���Nr��<�?M�d��d�nN���%�-��7��[�EU�i��f{O�Gr�N4��h���Y{�&�ny����"���m��Tʡ [��a�����/��b�D�͐��;���5���o(�w��|&�no�u���'�� �O�'�i��X���}r���q.��j%f�Q�����}I�����Ed;J��l(���U���K��`��2�8ተP*4�*b7�>��*wx��YE#� 0:G�`Ճ�)�m�!eJ:ګd�q�W#3�z!�a��v�?a�wћ�+R���x�z!��l��+�_xL��AGC7H��L�$he��W��u���DC�1|v�Q"ǁ,vS�����k�lweX���dK�C��܄MK~8ec%cH4��14z�B�*���b3��r�l�s.�C>�H��,%���C�1X�b�tؾH�Ҕ�B/�Y���L�w�U��^��g��Y�̽f�s�5�(��U;�=Q�϶��]J� ��8_-�LLg��h8;��%���aVux��8A�{
Static task
static1
Behavioral task
behavioral1
Sample
4ad2f2464d644f28c232da48ce6f109abacbc24201d4d3dd1a0b4b7168be2423.exe
Resource
win7-20230621-en
General
-
Target
a0acc5a59eedffe5a70d9ce09ce1f7ad.bin
-
Size
5.4MB
-
MD5
0095ee849a8144684a29d720bf3aa4a6
-
SHA1
5decfb880d5b7e133f160caf3c222506da597de8
-
SHA256
8c02973b2a16ad033093c76333a5dc806d8df36515790f7753fd7f31e7dd9429
-
SHA512
8aeca99fe5dfc61e8550c8bebf0a65ec44d099ab57e69c14b00932d399eb0eee7aa1cd6765bf1f3de5b19f6856df4c67a5363bcd51d1c98cb222b339f2e500df
-
SSDEEP
98304:S8aRBTFaXgpfO+jistPta7Ofo7QCn4SMrX4Mxvhjc7SEPqfDLZMH5UyZ3CBKy:eRBMiEsoOfoZmoGJi2vq53CBKy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/4ad2f2464d644f28c232da48ce6f109abacbc24201d4d3dd1a0b4b7168be2423.exe
Files
-
a0acc5a59eedffe5a70d9ce09ce1f7ad.bin.zip
Password: infected
-
4ad2f2464d644f28c232da48ce6f109abacbc24201d4d3dd1a0b4b7168be2423.exe.exe windows x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 59KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 19.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE