7K߬a��dY�)�����JT(��Oit#7= ����ab⠝`���K���3]p�Fk1�4���N�[({�l����eX.R���C�b�{�Jo����R*��LL���A��x=HM������{�t��9ɴ"A'P�n&��b"�yd���H~)����!q'-�M)��P+���Ϳ���R���!�R�Vv���`W���oPh*�55�X�΅ҕ�3�y��3�d?ݽ���Z ��7�JV�x0���b({QgJI�]�W#�N�??�{/{hhm}b�{��%��cfN7�ȍ̪�N xF[mэ����l������?�S�t/�%�XH�#r�5+V���^���ov�=h,�l�KB���^=��j������C�bԢi�����ҥ��k�;8uHn�W"<��0�n�GVb/��^Z�{N�G4P�`�Iz����Op砢�����Y�zd�٪Z�k�8k ����� ���/k!ߌQF�"����˼,2������* %���Ȼ��8�&�^G��;��b��\�[C�&��ge�l{���[�;n�0�Q+G ����H�d�nοM��N�H�Gx��]��|5��>�Z����9\(Q��Ɍ��.3�- ǫ���Π_�Ղ��� R�LX���XE�;j���|x���"��}�� ���"�u����R�8�0�O~�T������LL��q݈�Bػ\!��S "z�y���.���x�UZ�\+_�}S���v�����'�j`�����w:�$�9'S=��5W�16�D��u��b�{���[�{uiG���Y8˂�.�� dJ�ʹf�6>i�Ŏ��k��zxX�v�gH�����@��X�J6�����Ë�Z�Q[93��8�X���dy{�w@&��`D>�@��Eᢈð�R(Oa�����)p��:&X0w�y#ͷ����4;�o�%�=�����Mw'���1�*ֺ���|��R�H�I@4{+���v��;F�JLÀ�r���H9�~��K���H�5�d7��z�����Z���vu<b��� �hh�B&�>�%~ ]m'R<7@[��5��O_��q!~ʫ����`�@�l{�*�=F�����-pxv���I�� w� U����`-��D�0�l/�I�ҲL��lvi�g�v��b�W�T����͇�넱���[�(�❘v��T=���Sx0J��j�'^ ?ܱlub�Qgۑ[�7�5˼��za��~;FG�a$�a�@�)<�V�%�f��a�9ě�@r"��0�/�d��i��&�O�$���+��W�趸�ID4t+���{qhaX?nDY!+)�n+�9R��3h�a��ϜNJ�%&7��Gn���H�ť�����Z�(��!�*�f�t_w�̛{�?�����Gw�0q�͓��Ȫ�h���#۞4���E��XuOVF������믱!Z�g�2���mr�r�����G������[���g���f���jc���C��Q �7|��zM��U�J�ϋ�V�$�6a��u�t�,��i��}8��38H�y��3j�=�а�����K�n��T�;�7�rn�<���-�t��1�|���������5$��j�.m��� ����<�j�B;�8��E��Dl���@)���-q>�hd^%�J�e����qW��}��[H�FO.���ٷSJ=���J����_`$Y��ғV@R�Ǔ�X��U���EPl*P��>����|@�k�ʊ�M���# �k�k�Tf�yדIk�6�I�<�,UXw֢��1O����� d�a�f`�q��3χ�È ����?�'�J�'hd�w�]k�%n�zM�@ B�ئ�̨�HP�=6���zO=(�v��L�/�sff�������=�?>þO�Q�������O�NT�q8��G�u�j�'c�{"P�OVi�(��O���cϥ�����@x;������T��;��ϊH(UG�Z9:����h6��ΓL�4������ �eiJv]'9�>�;�������$N�=ZF�ɪ�o��*�#��t� ����ꊘ�E�=��]@����֝I.�!V[�N�N��"�&o�?��J��ꤲU���N���� �y��]�!*G�ʷ��bH�ʆ��W]d�5d!1�����ּ�L�A��7�r��(�IJ�L1�h�D��y� N.RḔkZ$�O�_���F����V���O$�;��N� �J:���6 ��6�ϩ2qtB�����uL���I��*��D�x���[t~�q����9/���!����E�q��"¾v������8�5_{��D���|����?�e�dz��4�+�L�� Oxb�m5�oE�Vt�[\+��?�����9{ �iD�}��|�wM�)�����Y���۶o5���w�ɳ5K7Bɝ{p���������-q¨���ὸ����)�nY��� H5����B*[��2`uQ�W�z��M�̎��g��s�FO��l�ƌ����� ~^:�b�}����������&{� C��8���.���U ��3��0Dx|qx��R���@�G�UE���C]Q��w�.ܙ����H����̸�S�s6��b`������A�}xV1��Wj����2n�9� ��%v ��[/L˖��@���1��ᄌ��EqQu���1��:;4Qof���Vo����.��-��?�(���ҵ���e�h|k7�j�4���<���:���j�lʺ��]m����m�?g�����gT��f%/��y��#|��D�V�)� s�*����9�@)���4Chi�_�M���T�FWm��a�g���ϙ�h���D|.����b���?�te�������dt�!��96L2���8�4�� 5�֒7�sk�\C=��g�t���?n���� �>�$7���:oTR��:"�zD��E7����_�bxb�w� |m�7X�[��b�~�+ؒ��~#�|Bg)������@l�U�<X��ل�J��g�\��JL�ň�R�i��)^�q6Fc����vJ���ъo���X���!�Z�ď����� '{��U�gńjqG�f�Č�[���D�.Ӎ9�|�d��,�5�1S|�*V�>j�y5����V���Ť���܋oY�I�P','�U���=�H��^�����K�r51�K���K�:R������P���FO�����Ǚ5�O��m�<JޜTCS}����.$lOzѐ"o2����y�/����L� A�� ymUF<)�Xmj-��}�,�kg��"���w��6��;dI(w���#ûCll�`/���y�Qy ������re�������y�����|��O\Qz �4����� b��0A�1�=�#n�*/Z��p�X$E$x6�(J�?/���C=�W4�0�� 4�Z�5�~'��G~�"sxsx'�i/��H^�{�|&2�ȑR�#��tf��q��E��A�������YS�V��J��f�,,ay�!y����7
Static task
static1
Behavioral task
behavioral1
Sample
rs.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
rs.exe
Resource
win10v2004-20230703-en
General
-
Target
rs.exe
-
Size
3.9MB
-
MD5
1f88bde8db92eac78147e6b0ea358577
-
SHA1
bffd7ec05a3b0f962072c45d723395f44dca5bc9
-
SHA256
13d21d979a01fdf7d974f67dbabce64c67a2906fd7db5e6e4f9020bace0f0094
-
SHA512
a0d5982fb5462bc9ed163328dc88b5411b0966ae96c81e3fe8d9b923e5edd2b568f73fb932e2d8a861460250c3e07c070abdc3ef9f623b731f872d9e43164076
-
SSDEEP
98304:J2dszIfGvLWQlxs+bN7eqQS5HxsDPP12kl+iWCSZhmawmzzd:JJaQs+heKo7uZh3zx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource rs.exe
Files
-
rs.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 517KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 203KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE