k�!��p�? ���]�ט��yiĎ�IJrk;�ON��l�j�c^-��\S�pU�>/��o���B��5���[�Q̯�`���L<�4M� �����49���9T�~ۖo#��X�$C���9}���a�����:~!��Xmً�4#���s~oI�q�#JH��$���09���1�����$�������d����a�Q��/vr���y�\�T^� ƿ�J�6�ڲV���N"�:�h�GU������Ś�s�=^k N#㠅���<5���/�0���L��L�$6�@m�g볕���E���#Z{5'|��1�P1���K�A�25������L�]n���,B_}�- )���ZdvI@h����5/8�K׃TvJ��?ϊL&*\'���)�>�(�6Ws�E���������,��;������d���3�n�8�w͇|��3$�b��>ɋ&�M�"��#���Q2B�v���͊�+眖,����j�sV��϶��"yȗe������1<���M�k}q��p�v;}������/~V��\�Gɽ���-�ki���z��Q��[�����Gh%��:&*q3�@+��V��p�<�r��],��,ڦRMe%f'(!X����?H#g����7�[E)K([X�,��2��j�� �����XSz�_�Tn�#�Kk�&����C�a�>�Хl<!��i��mݑ�%0")/�U������=k��QI��6�p$��W ��䃉���^bN�ӂ6e�1��]r��DՏ#���R< [�V���g��0���g�ҟ8��J-���e1kǺ� 3�̎��/K=g��Ǵ�>���<����yzfxM�dQpe��7�sM]�9|B��1TA!��P�o�DBČ��@V.n����T�h�� �{>Q�"� X,N�0-$��2� &I��A��a�s6�̷� �`� ΰz��2�j��A��j�2}��t��n�b�\����9c|�x"��E� ��o�zwSE.{�:�RG�2ۄ Y�'O@[Ye�h+�]���}���*���^�v�Z_� ��3���1Lԡ��XW�G�V�g&8���@���D�d�mk!��ί�Ȅ��7`dg�,}\*\���P�śLԶ-��ܼ-��]5L�x��N�o��I�Q8�ՙ����y��=�9�4F�T%�6ȽQt���6�E\ߡ�S!�S�r����<j���<6��Ib���|����N�Ӡ�;)�����?����2���D�qk���)s�k�C� b��49���B��bpڨ!�J���+k^��������j��a���da�Zk�W��u�`������s`n�R)RAOv{��m� �%���lUpK�����҄`�!��'�+�I_Oo�������m�7�����3Z�zJƌu���9��A���k��f��|:�]��2�J3��d8�'��9DB8Һ�g<�$�#���)L\jˆ R+n݈���q�zX��bt�� h�����YpI�+Rl���o�m��r���L8-(n*a��ĤX����٪��� V��V�xs��/��[��}��gUZ����ne��$�p�i��V�w1��Fi���2RHG�|�.|�ɖ�S���f5+�z�$���l���t�+q���.=���"�unD�֍�}t��� A��'e��A��9 ��`��1��g�A�)w`�����(�/�#M�Z��w�q��+`�W~�������k��jLJ�"�T�&�u�O p�>�l0��L ��(��O�rq�&f!���ؗ��+�L���d�<��|���6�Kyh��X���v��1}3j�j3tTb=&�Vm�Hl*�H������T�3�z�l��~=p���!Y�d�R^I��(��-)�wٷ{�̅��Db�@H��q�}��ޚ�X�����R���ȷ��ס��0�Z��M[N"E��D~�8��{8���q�Rp%i^�&�)�~h���"L>B^]`��y��E��}���Nw�.�x��z`;�z>���,��i�zd�C��}r_������C��ۧ��r4���� �?�U@������V�Ϯ"���X�T�S�e ��mB����!k���Ş�^�F `i�7�0^S�Prd`Ԩ��o(}��Q��ME�q-�\��2�C�(����k��oբuM\'m�)+���������2�j��\*k��> �I��&*ؤ�e�=s����ET�<��B�S���B������ ��� ᴙȨ��K2.u!��MtL}VF\DRѴ·�n���������S:��Hŏ�~-B7Z��(�b�8\�R�Ѩ~�������X���ɧL��$�U��Y�l���B��OO�إ�I���w)�yz=]�b��j�I�7j�;���2�+%�o0�'3��1�� x�Y�!h�J��U��3o(@��7�`(�1 E��H+9 �=<���f2b�Hϧ�l߭�U�D���>bF�AT�����٣�����>�g;_$4 ��@���3MU@��C3J��4?���-(�(���#"rIOV^�Kd��~S�fg�2�d1Y�t�42���3d[�ޟ�����U���ɉ��RV�e�פ�Q:,%�N0�*����ڢ�(��;L����]<R"�'���m��$SUF�ۅ!�?ME$T��X �&� X�Q���umr�z �['L�hn�?��D.,�6��q���8��婔w�K�h��f Ә����W���v.�"Q��_1*�� �������t# Aw�٪� _��#|�A�FHʳm�y�@e����-�%���p�l�ޫ���L�����w��X�3uĻi3�C(_bqcP�ɻip}��*A*���ՠ��5faM�J�nT���R@��ƃ/���8�SЕ�=���b)Bo��!��Ϟ��ˠIN� ��/�R�����愷D��c��X-��v �!\h��H��j/w��O���ly�����-��{�n�k��[�7b'�<Z��&V!d�_S뛇Q���+*���y�x<ߋ�l_�sJj���h��$�����<��z�� ٫�~�u��(�IF�M�%aޮm/�2��8<乷��0���#��;z[V��ô��5�|l�v;k�I}��?�4S`+�}�l�Phg���c2��en��MuJ!��#{�Wi�EQn�����)7� �E�k��9�����l5E�5ջ��<5\�Ft|
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230703-en
General
-
Target
file
-
Size
4.3MB
-
MD5
347f9b184c174b954f2730f8f5ee321f
-
SHA1
daa871a66c07d84cda7711b9a8d992821904d92c
-
SHA256
591791723591e2412e4804dd636ea3fbc11890bcf60b984bd5b74624f951c179
-
SHA512
c2ff2999b7a52aeb9b43ea86f1bd32637584e0da32cf76be72e83789137f845e79113b06da0d6e4cd3dc6b02847ee07a8fb119c1c1164ef3ee1b131f2cf8a2c5
-
SSDEEP
98304:E1GU5l3Eo31e86Fltg64YTYzYGzqZgkdrJrmaAdEouTNcc:EHz3Eo3I86F34PzNzqZ5d9rmD+O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file
Files
-
file.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 517KB - Virtual size: 940KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 13.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE