7$Ո� }mƦ�Uګ���>�h\�&zxI�i8�'/V�~�W�CЊ�LW#��T��NzCO��W���&0{a���W0��o�#���K��.X��}��h�3��<_�l@��5 ^�l)kVW� IY�b�uS�!�l<f������B��r���<�T�DQm0��#�{�F�'�9 ���\i�!@��[�����V�Rr*&,�d���5���Fd��|ۦ�H8tD����HI����/�}m�����x��ᓩ��"cV��f��t�Ri��%�Mo���^PZ�Ђ�����k�Úv(�����{*#я����QP��6<=�\i�4�/�� �>�t_�~�X։3AʶKy/�O~}Xk��ڄ�۫u��� I7�Ygx��lf�RB��rę!0^�8�BL3����'q�lbX���60v�L�����۔�+hzjuԝ nۋi����a�0Zˉ��N�|�� �Ιj�n������oJ����q�s��Q���W�G�G\VvQa鈧J��A�ك�.�jcfĴ��<]������o�y���U�M��0� ������m/���V�D��6#��P~8�= U&�یJ�� � ް/e<� �4°38�.d�;�C��t��l�_;��e:d>o @a��X'���)��bb�wH�� py���KT��}B�rB�b)�Ƙ�ª f�]�Qa!8d0w(!��6�J��|���3�!�wec���R"= ;E��Q}ß�Ze3���i��`�|��At���T j���g���l%��t����_�|�Q�����4`**��6���#h�0f��������WV�m}��83=B�:xm�9��z����z ����P�Ib����t��w�^�H,��֨�y\����BzܜA����f��c�u���.�(Eq�^��j>���ȕY3����Pb�0*�����5pS�AB̲�|�d�^ف̻��33�0Ք����{&�3oхm;(*��Gz�����d����s��f1|�ne<2����"��UV.��*�N���2%�"F��ۼ �������r T���.^�Fz��в�P�r�&6<(���X�*s5��pŞ矤�o�=il3i�'�-�ɒ��t͇�� �~,Zt�ii� �1��j�k�_� ����e;�r���`��0�V��:�c 1eb�w]�>Vh��ѻQ�F�~����,���q.ɒ��=�Wl=�%ɷ;��Z�5䮿*��z�r����������iH*X��w�ΓpF���%���xc������ ����h����Dk36�[�������Zù閕��f�WC�58F�ƟT��4O��Pң�۽�����i'7�зD�SIա�l��� ��TY���͑s��i�^H�KюVryz�>�kЧ�RI��O�c������+�� <��_�j��s�)��_�u��H=�I�h��Y�f�SA5M��}�]Q���?O~�s��<vb�Ϡy��A�yA�z�� ���RQ|�ԡ�3�7�w�[��] �*����(�������ْܸ7k`z��*���&%[����ڝ$��d��o�%:Ik��=���W#�ugRЯ�Qx�7J4�#Ѐ-�W�c��|�Q�nS�2�z��b�u�6)��-+�C�t�"����I|R�;J��vlV�W\w.{�����]��!5�K�T��\�@� H�F��(G��N�%h��>O���i��v wֲˮ��Wx��PX/+�_�by7' #+�Q�.�r!��~x���s)R=/cQ��x!TL�(A��Ԫ~441�`|2)�W��*:�8�a潈�B^=��if;���Ւ�Z�A\��|����^��PkLK���"��ܤ~���G�Ws��pW�+���n�� � �R��J5ӒtV�)̖p�أ���˪�1h� ��RQA��;���+�7I��ʴw��RR�v�^�aYZ!��{�z�';?�'0`|E�L�j6,}�Tə��QLVg��@*�ӉՉ�n>��u�jo}4%��m�A����$��@ �S��_R�r�'M@��M��]r�~1ڕs��ϸ c��~�1��k��P,�.5���_|�Qo�uS� ���� $?�߀B^�����}VSF������L#�,�C� ]�n��]�H���H���Ѳ����EVZ1(���A���ŞjͼM˼O���U��^W�H=uP����b�)�˾�yV"Ĭ����F!5��6�HI���$�W����f+\�z�X�m��ˊ� ]���� �����s���i�Kh�E�Q����5��{XЙA,"������j"���|� $]�:�D {���Y����Rj��d��p���k���*],-0!��~�!�>O�z��➘|�{��)�T���4Fs��R��Abq1T�Vo~�3���MP� �^�w����N�c����q�Z�U(����zӭ}�H��1A�5Ĝ�ӭАx��nq���<.�e�rJ��MϐӬ����sJxC�i�i�ׁ-vM�����bٸa�ˋ�����w�H�8M�M����!�ō+�T<f�|��ߣ��2�b<�.�U��Wb�_�B�hd,�_3�09s��AD�7�,��_'}W9f���� Q���,}uk?�i�Q�2���a�j���γ��V0gAv�C����H�iH��D�֮M坨f����T&��=yf�}�S�'�7}�f�1�4jv�5ܣ�@�%���Ax�gl�\|�'��8�H�<����n��y��&���Qb�}U�0i[���`�!p�c�k�Wv���M�rN��x��c���q��|����XJ˯l��D��;Y:wL`�7�S;T���:b��ܐ�0�k��!�;Tz2O3�h;�g�|+�!�]� 9K�+���9cVú9+�˫���da(����r��gJ��T�@kvK���?�"��d稊�8��-�)�Wl"��B��'�S���3s� n��GT��w���B�)�� Y�5n�(�h/�_\]��4_�B='F/�?�C)��l��{�Sh����A'�vQ��$��!O���BN~��c,�i���]痫ߓ�դ{�۞����J7kcP�V�>��5 Bh�ݫ���fK��!�m~�<�PD}��ph�����di=V��������LVvo�h-[\1�[�����9 �\����h�����;sAKx�*��g�*4$��v�6�h�����SV2�4a� �j/�5��nLV��U�?P��Q�ˑ#� F�(�?Q����W��n9�x���,��r]S��
Static task
static1
Behavioral task
behavioral1
Sample
469D47D135F435DCA02A5068ED2B71F5.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
469D47D135F435DCA02A5068ED2B71F5.exe
Resource
win10v2004-20230703-en
General
-
Target
469D47D135F435DCA02A5068ED2B71F5.exe
-
Size
27.8MB
-
MD5
469d47d135f435dca02a5068ed2b71f5
-
SHA1
56295a4fcff5ab42dddb4eea5ab67750227cf1c3
-
SHA256
302daf19d84d09ebf4fb25880fd7d1dc291e7a222cda80ba47094fbe9d65fe8d
-
SHA512
10d530b33ea6ae16f8ec103cf1da137e3407bdc8ddda6475c4c7a2b23716e99e3641d088356610f2ab4b1abb72d7b18900751e6f0dec68db310cc7e87999f734
-
SSDEEP
786432:93xpVmxMXbo+IJxIUMLPqreCD47wvQ6s/a6pxd:9hrmxWpIPIr3YvQba6pn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 469D47D135F435DCA02A5068ED2B71F5.exe
Files
-
469D47D135F435DCA02A5068ED2B71F5.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 21.6MB - Virtual size: 56.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4.2MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE