�~Y^?e!t��k�ʑ>���W� ;X�k<2� �Ü��o+��O�:]����Rk1RA�Q� ��i�L�\�ur7"��]];c��0&&�4f/K�V��C\��J�l��A��o���\$�;��> 8I&�5j�9A�����]!" ��{Iʕ��6>�x�;,T�p��0c$^�laV��KH��q�P/L���hU@��?��X����g�����s�~k���ey�S����a�����t�z_�]�A�ĂH�b�n�����g�0M���D��pq��v1a{]����.�<^��lH��c*��RoQӁ(�G&efH�P��O�A����2ֳ��� �RpΡ��P�b��:�A Xx�I�=���4��a��C0j�r���1����5}c��=�#e��=�-���W_L�JHN*M�V$�%�Ue��/����K��g�:$wr�P�l5�8��D��N�a=!��=Ƈ��w��ft�漢���ꎉ�2��As�Mz����;���2�M\�2���Z���"�G��#9�v*�"&_�^�&�Ѕ|#�3����:s���e����_M�+Z*sqJ���m�/��`�Ҙ�(8M2������NgY�wq�&y�X�>@Hֈ�b��j>:���Sq\Y�/��X��`u��./Q�P��sK��9zݎ�b�7��$Ӗ�-L��ď�"����'Mh5�r0X���o&<��PO�Q�w U�.s�V��_2�uҢ�Z#+{0"�e�t��r���q��)��+pd�ŰBV��q����q�/ ni��hEO�W;B5�x������)��&�ES�җ�;DY�D��kE�$:ׄ۫]�J�0_��ļ �Z5��`#����8+5�|Ў��j�HiSw|�������Lt�BP���R�vo��d�%\ck�����?爔w.��Ś(. 9�M����7�Y"�0'���[���h�Ì+~��b�����RF/��/��%�s���ó:e,�6��z!c���Ȼ��x��U��.��jv,C.b�Y:�G$��ї���9k:��N\�iy��F��()�M��0={8����*�lq\��+`�n��͐���!K��rc�_��A�C��|�xq�[��Y��J�I@���1Vu�`v�i��� �'մ8��:�\"��n ��-��q364�^o }��Fq,5�y8�+�Ք�,0�O ��)�9��w�+�|��&�bWxe��#� I�z%�ć{����7��3RiB�ē52&���l�5+$Yꅁ+�n�m��Ě���J&g=�Q�-��S ̑͋WU.^�r�b�A�<n��rC>MA��=��F�p:�ߎ3��3�j7�;���# �8�5�*�,W�! =R�L8��j3�fւ?��(˲x�e!|��B>���GP+��VnG����*�6���� C������s(~ʼ�.�PM�9�d5��}J7��R�*�դDp(<�����h���ث���Uî���.[s`W^v��Mg�m}������YĨ��$E8 o�ٝ�ep�z��"R��f*�xi�NJSf���H�z��³�v�2`D�Ǽ �������l�����W���g�ܸӍ�P��S�0b����˾ls����'H/AbT��/'Ǵ�L���c���Y��gL+�����a�ڳ�1C;��]����i�n#�Yt����t�+���.��O��.���IΣ�(�?�t��a�ל�5 W����E�c���<6.�EW��h��uw���(�)�u<��}����um]�),��7Ka����H:���Mz������.�ި�m����$�S?~�������G����|� ��Fl�OE�F�q����<XH�Vܔ�\�.F75�b���j3DQ��� �?Ra8- NlD��Q�1L��^���?L��L�����_����A�Ȃ�*�����������J����4�l��'j7�1�U�|��aؙ`P�C��o���*'��4@��x���� ���R�rf�X�(��Q�2b�8�|n,.��~��ѱr?8������Ա�P'�P�c�ClH�$X����?j�ڈ�,�x��y祿�锒`*�w�Êb�l��:���zP�X��P�;�(����oh+7��i����=^��|�s�Vvn!gV�1��}%�G�B�l������M�ms��PZ��3!�ㆼsiZ�4�N)����x�U�i5̵ց���o���>D����f̬0e�3������l+���GO!��EK�G���j0�����K쬥Bdvǽ+�j� ���zD�'b����r��縋�2�C6y}�W�,6���� o���RM�T�ڤ�o���;ɦ��l�"�ۮuSF �@<`S}�P�}���6�"��2_hƲ�ɄP%LN�dž�;��Რ���5���q�_�)�����$��-՛ƃL�;�����X,�f2��ዋF%�����V�b1��"�^��Ly��ht\�' ;�|�u�f/����V��D���(:/7SFQ̔�\۳�ӣ���os�x��j�[�������KY�F�x���HJ*�%gAv!['T&� R]�3�p~�I����#Xi9<fA���:��@��s����_��qab�'��#e �it-I�u��7s�+��9�w��&~PN-ZG�!���I6J ��9oLb�R������>��7 ������}w� ���;�o�J��Ua*�y��%�>��R���S��Bk����UR����.�*��B3�%MLA)�D�8{/�MTp��v@e�)�β}���Cq3-ib��q� Cx�K��/k�S��"�����[��\2;��n � �c�!����.���e�4!���2^{v�^��WG�NGcݬ�7��G���"ON����X�,Zҵk��I8�����s��ؐu�g�sV �.�e]ϙ�mse��Y���N�G z�痵�4_������f�@1;�h[�1�����O�2?xN{�=f�!�b8�����[0/�Ѻ/�u��1�RZ�[��3cҷ�F���Y����ܡ��L�@K��n.��u��*�=y�/mt���i*�W1�7�@���WA6[��5k��?~T��3��������N)���5Vկ�QE��I6�����i��5��z��~3��K��n�}��qE����x��DN������G�E��gX���d}�Y����.������N >��ߚ����A�2�$y���-�8���4�<!���3����!��0|9xf�Nv,��pM�t�n�����_wY�Iğj��T0�O�K{0�'�}m��E%g�r@V�l�ͮ^N�ƾ���n��:+K������F��= ���xhw���1�^��T�^X'��G����&���`/K�fV`v�0Mc����ߕ�[R h����T�[��`�\��z��b$�G`��L1���v�%����2_o8n����9�
Static task
static1
Behavioral task
behavioral1
Sample
0d6f3244017ae2c8a94e4b89f99376a084e4830a39bc09a1f6bd71e1e6186e20.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
0d6f3244017ae2c8a94e4b89f99376a084e4830a39bc09a1f6bd71e1e6186e20.exe
Resource
win10v2004-20230703-en
General
-
Target
0d6f3244017ae2c8a94e4b89f99376a084e4830a39bc09a1f6bd71e1e6186e20
-
Size
3.3MB
-
MD5
1c01b53791879cda28604acaab06afa6
-
SHA1
3799aaf8d9c1432fa0b28d2eb5fa25a893e35b0d
-
SHA256
0d6f3244017ae2c8a94e4b89f99376a084e4830a39bc09a1f6bd71e1e6186e20
-
SHA512
275ff09625fbf757e86a7b92494bae5b90feb3d8f5cf028e66e39ea27ba7893bd1dcea4da046533de0ba685befe93ed2093a0dd4e6887a38da97bd9f712da88d
-
SSDEEP
49152:6EstFV0uZKmf4BZ51pCS46YjTh3GCKzWoxordZVRZjxfk5SXr4wxL5fNq1L:6E80uZ3fWZU3GCoWAYDR+GlL5VqR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d6f3244017ae2c8a94e4b89f99376a084e4830a39bc09a1f6bd71e1e6186e20
Files
-
0d6f3244017ae2c8a94e4b89f99376a084e4830a39bc09a1f6bd71e1e6186e20.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 10KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 95KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 38KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 273KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE