�eI���;h� f����T�C�Z��f�)�X䢧A_9m��O�j�]�f#�^$��ã�Ϻz�O���>��~#<���E��7=��Տ�÷���3�*�oܛ��]�̤�a� �d���^�Q�%�S��o���2���L��J� ����%�.18� ��%-������F�KΤ��1/Pֻx�Rɫ�Ѹ��z2#���P-�[��� �-E9�.}�j^����(�xw~��b��s��T Mwv�X�_cp�!�Q( �&��T:%�9��De �����]�(���3�s��#�h#���K*�o��m���qv��P���#�ٿ���*c� #��U2'����%F05�r�P[�kzYۺ��!�0�Jdӛ�$��H�U~-(6ΪϾ��àhD/�,?�nM<�Lʂmť��|N;T��PwAL"Y�$C������xYNZwm���>Fbh�� V@�q���.�EEʥg�+k��EY�O8bP� �~���)���o�%���{I�e�ۿn�/|oE���0 �T�������{� ��ܦ`��j��{�����Џ ��_}�1T�x�?$!�،�;��Zt����% ���)y��8� ��4�=�]��� ���@�':����y���N3��ӂ��=�f+�SB�4���a}��H|�B��(S�C�M����<Yp�����;J��=TrHav���}}�)�qsF��o� ��R�XWм���F�99�4��7�ħ���x�wk%���w/tI^͓�^o��tz� lq� '��d� d��� �(�|�vk�������Qa�.rw�8W�.J"����|d3�w.��q�+�f{)��:��Y4�g�9�nͼ��/.���l�ߕf��[�� �Ć�5^���|���/�w��8#�0��M�@�Y�Cݮ^/]���/�!5�%�;_�3���n��2}����!M�������1�9AK����J�~�{�Lx���!;_b��� �H���g�Փ�=�#}��G�}n��_�b���C�~�X��U���X^f/�%��EļF.������[����*��a�������nV��G���g���7�Ƞ7�:���u��ټ�d�e-�vĔ0A>9�WA��� ��/�!ENj1L�L��7���ޓV!�����F�ɼ<:#���������*o֞1R��pQJ19%�Z�mi����8��g*9��-ƹ���0Hs�E���_r�� )��0�c"o`L�6�2�'q�O�0�lIJ�;w�grp��n���Y� uVT�RL'����?nޱ̧���]�K��-�Ik.jj_��~�+5���4f�@���Z��s�Axt >8� -�H�i{I�����`~Ǽd;�H��g֙Y�kQv��:6/(2J�V��Zq�����������9�M9ͅ1T�f�,jP/�(X�(�����Ĺ`4 �%��p��뢂ci��}(�������YL����A�#�������hHF�;�P=�f�1Q��,u�p+�}���n�"%d��?J~�5�3Xĭ��S��XR���R�\[g�J_�U��� �Z� ��_����;�A� 1��'���l��*pV"�*3hQV�Q����;���I/�;+Ϧ�Wk9�Ozdckm����4#�u5�QR���W�P�%[0��ȬM��y��7y��^3`$a3ܼ/�zS67SP�+x���ͅ���}4�S>�]DK��1�h�,�/�(%N�1�-oc0�u���62���LW"�;�A��?>�i������E]��r;�J~�{�~z���2\�q���!�d]�l���2X����\-f��]Q\ϥ>�$?�H���CՃ3���� I�K��T����i�o"(��kq��������,叁�rl��=���,e��>����Y����*��0�֫{��!���w �)�l�=�qP�F_��Ù���(M����3O{ҭꖜu� -���h������nd�屿��»j��XA0עN=�G����zj��?���eءW�Q��\��Ȃ���:�*�.��FB�s�6��YEn�h~�<CC�[�E�tD�e��T�$����ڤ�jU���t! h㒑n�㽈~��+�Y[�������Y�F>��_/ҫk�����o�����A>i��O<ׁ����L�k��k�j�^z��J\[�������I�� �On*�a�t#܊o��-��G��BkQ��p���?��1����t}�]Y���v[���t{������D������5�ꂮ$�#R4�S�,������C*<j�,���!�+���]�D�f9�ʕ��c�s��-�m��\�\�@0���D�r��WN����?�ëu4����F�oشS��.N�Cрݍx;z6O+ކGl�MJ��H�.�����ʤi�k��<��c(�xU-ehfF�\C.A�,|>מP�K=zFt&Z���W��N��o%ٗ�8��q\�.>�7�����ͅ"Nz����r�,�N�+�{�ME^�ڎ��~�k�8pB���U����z�u��_F�om;E��]ю~v%�]y���������a�{Q���ύ�g�E�@�#����²s:�Z �wPv2�c�Ō4��,o���2�/���u7��O�+z�F4�JGsZnpT�B��>ޗH�3Ck�7G��)���3O"q�o-A7��wǀz�f~�,�z��r��l��k�A�N4����%��=�|�M�)��l(S��04 tS�65��"��$>�<༊���NO�a�t^���s`���V��]p���;�u��ȭu�^�Z�� �OpԦ���t�`�_���M-�c��f*V�<�]�J���#��w�o���b��P����6��i�tJ���w���;��a��W��R� �G&�v�����l���7���]a����� 1�"�E�ݲͷeUw� ���u��]�,�,?�]Э��&�|\И����~0���V-�wȗ������?,pg��Ǎ��&��@���ʷ������,ØMr����S���'.��^�L���͒��P9����C9�aB��n�O�#�G�y�<9�v�h�9��������A�a���6b!c��t"7��! �h��Jś�-�d'�jCȾ�p��5"��(Pec���U��F��V� �:�B]��/�<%;�?��謹3l�>��68Q{��Jz�M�l�r��\b�_j�mL�1c��3zf��فV_oH����(P����� ���@<O!�F��v } RH�����12��Wޱ�qy���Y�H�Eห�3�l�`0C��E`��^qpW|���w5[��l����o�&HUd�P�KZ�Z�'t4��4�����7�b����2?���\`�J�� �C�Xn����>B�*�{��c$N������^��9��-�1��c�o~Q�z20��W :3nG:B�M��i�]�����#s@wO_`D=��ሇ�?�n!&P]W�40h%�� 3��h�����i�C����r&��q�Uc��.�y��T�*k ��U�/������[�0<�`9�vz�t��ڼo��e@cV n7��=�~�D�]��o��I^η��Ե��P��RmA���I춱����|2�� 8�ov��`Hr���;����G���M�۾���]�Tg�ܛ��=o>�4&(�䰪y��$0���ʔ��1�����K��M뒀h×]���'@������ױ�Ѭy�
Static task
static1
Behavioral task
behavioral1
Sample
d6150a3d4eac05bb048756e16fd711d9eed4b15c8808c4d04c0832339dc70fae.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
d6150a3d4eac05bb048756e16fd711d9eed4b15c8808c4d04c0832339dc70fae.exe
Resource
win10v2004-20230703-en
General
-
Target
d6150a3d4eac05bb048756e16fd711d9eed4b15c8808c4d04c0832339dc70fae
-
Size
8.4MB
-
MD5
3f67e21e8b24d097dc494b466b34f990
-
SHA1
2356c968bb50e281dfa8c62ea994fd2a073ae1c9
-
SHA256
d6150a3d4eac05bb048756e16fd711d9eed4b15c8808c4d04c0832339dc70fae
-
SHA512
3246c4198e6a2f4f4bdc8318f73c5bc8d71c96b6c2eae649609bfc542bb7d5b5ea5f686b3f31733050341cfa2c8e5bd924754cad57e32ea8ed5b0b8d1b4e4cb1
-
SSDEEP
196608:2THq1dwcfC+3T8I1sgoBFvJCONb/M8+N2Miy6hg8bxsi73+Riny06:2rWtCsTl1sFBFvt9MiuA77Ry3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d6150a3d4eac05bb048756e16fd711d9eed4b15c8808c4d04c0832339dc70fae
Files
-
d6150a3d4eac05bb048756e16fd711d9eed4b15c8808c4d04c0832339dc70fae.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 3.4MB - Virtual size: 9.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 854KB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 297KB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 624KB - Virtual size: 25.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 714KB - Virtual size: 716KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 6.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE