fg��Ixz���������w�7��6%\Wֲ'�N^ڞ���$H�B�a�6F�y���u�� ˒�C�|�$wPW��@%JG$g,BR+~��ty8��ڝ�u���r��lB\&,�\{|%��<����a�z�K���C��<I��+�g��i���W1�m�Zs!��_��:�Uf��f<�ε@�a#���|ݨ�����+�d �?�Wn��\����K&zsS?�����"�tvE��w����J��Ed�I&Tf2�=�� o�^�T�8���B�-���Ũm�G~���Z���Y���ǩ��z��$- �bPy�gDLR91c��vf�1��E:.h�՝t���yW��/�/������X�)R�r}�߉�4"�����:�� ��\�����:+!��������J�Q-1F���'������]�V���V���;����X�$8�o���E�Q x4�y��W��NoZ��k�K#Ul�r��x��Icj(���^1r�!�BFF�N��;���N���-n $�\TJ�v?��!�KsI����ei�@q����4B�<FFf�����Xم�F�<qt���#��� T��o&i�FWZ��+���\���1���]K�������Hʆƽ��x<�p��s2X$�>�sԚ;���R�Jr¹�p��V(n��p$O.#3>t}���A�W�|�b;� ����Zt ��d��~'�L�#���:���'�5O$��ʴ��xX݉n�;<��_����Q��CM�����Xm�i�'x��M� ?������/�rˌ��6#�Y��ˑ(�o`�b,��s�L{#R|$�� 7���:J�8[��a�Qcd�����J;lK6��� �5����Y_˴!]��6���T�n>H�5��+��A���'��G�����Y�]L�Ė��~}ކ�x�Si%1z-'��Fd�7�p@L�X=w�5�x6��z�02M��F��C�+k-]��m������`kP7)+5���o;z�7gI�Q�;Ӿ>`u1��I����b������PO4���l�7�@=#;���p��G��xf�ј9I0�j��tp�H���v��ȑ�-| �A�#3�-�8h49�4X\��L@�RZIf�L�#���ϴ�tx%�����]j6$<��Y�MPŵ��遒-��D&�ӊT'Ym�w��X߲�/RF���z��J�z��$S/��zyD�F"�~��TeZQۖ}|J6cW��#�#�I�cǔ'�[a�m�����n6~�ѫ>4s��'��cʬ�KՓH1��KE浑[}b1Ik3x�#`�;! �Rwak�W��mI�=��#��� r�W i�4-�F���%���À罔)~QK�2)���r�.E|�� < ��X]�����[O���������'��8b���%Y����[8,t<�.B}KU��<E�W���5Iw����ɄC��6����a�3��h�2ث��k�T�ޒ��|� ŸU_����=oHHgt���͉�fo��q��ú�t;�����1+o�Fߺ�U)}ԫ:d���NO1��+L��Z\2l'��mIM���e��#S������v��*�$N���y��E�3�K=U(����,�2�|,�J��6���i�Sd!�|%��?iFG0�fQ��L����~�=��ٳ��]G-�6' �k�r�V�x/^XQ�f�5 �R�q�268�A�K?�Q��-��^U$�Z�IE�b.lDs)�4�b����M��i��b����V��]�u�n�Y ��P���iɶ 8n�a�!�rb �l;"���d��,�]��M�_3�U�������q|(������+�����+�4��/��T�@c�ށ[�#)H�S\*�v�A6穟W9�*H^٘J�����7�|��M���Ku�' [� ��F�*��P��AT!�N�P�>C���aE5��;�!��iZn��5�ћPe��ֳPh>2��W[�+l'�z�I��Ҵ���IX�0[eh��_,y���\�����%ã����/��*f]a��|p�\>�C�ёf�^2֊�4.��*���T@ �9-U��X�46�0��p3YbͿٞ}�`��*��S�H1�c�v�~����4�S[�g�%��AN���8m�FR��G�5X$1J��+�9+!�X�����n�-����^E ;�^Uj��Ҩ��> �L!գ�,FR�W��I4��3"'��d�v����t0�j�-�zn���~�Mů�Pcgu9푖��ڪ����L�wZ�3��t���<<��?D��+ Sb��T�9Lc��žܰ*P�%�[�/R�ҋx7J���J$wȺKl�F.7&H�ߟlg]X�@y�2�=��+����-�j.KumPjև`mT���y+������ձ8ݖK�sF��§4W,I�����q��۶��,�g�-T��Ӊ~���7h�D7*�~��34',B�}�5v�CP�"܍)/7L�V"�%�gUa��Ro�W,��!�BuM� �$�AVຜ�J�_6L������(Ѝp���Vh )=R�A�2֚PO��-��?u�(�$W�=%�1���ڟ�(���G��Z`z�����0%<��ѐ���c�\9H"Xl�br2�Y+R0)'�n�WME|�8��IԎ�RKж��StJ��`ț�1p�V릎@�(i�@�裦'A����hgu�qr,I�[Gxі�\�g����@㺚� w��[�/����,B�a �<4�E�\��5"p���C|������O��H�R;x����-� +"z�����?ڥ5�,:�i�����%�����FY�٨�� ������C91��E)�b�bCG��lKEʳ8��17>a���l�I�4DӶ��bxM� q_] ,�uX����F�����Ȓr�;��:�9�)d`!ܥ�%$Q�uz��e�Ѩ���c��p�-�I��%��\�a�~K�����Σ����*���j|�W�>��ϑ�pq�L����>h��k�S��)�v%� Gd�.�)t~Q[�^V:�� _�xo��<s���2NO�<Ǽ䑶c�KGza:;�4���q�M�w�x_�t�/��aPW �vߘ��ol�4�3���T_�9�5�6��Y_�e��|v�tK�<��ŋw9t8S���%Ej���+q�w�T�njN��ʷN+ӭ1�D1Gq��D&�f��AѶ�j�D��q`1�sܦc�R��ՠ�0��6���Jd�����8K����߿� 8�w����zDeVhNxt���j��E#8㥦>�5�i�sr�6tϮh��R*}�G�|9�'X��L�_<J:B�� �A�Y>�7��9 ��ġ�=E@8vi�Ѷ�j��(R��3J� a���\� �����ɔ#)��A]��;[�[<�-'?�t�3}!&I�����kr��^���"/��AJ*�&nU���h�Px��] ����k5������{����z����#n�Lgw ���sI�*���ra���ͧvEA��Um]�*Q6�.�.V���o�_� ;!�~;�0¦^�D�e}�T^!UR7[j ���]+��\?�M�E��p�����Yf����$Y4��=]3B�]��W������� 7���r�������<�V�]݀�J����|$ְ�#2��&����v�Ӹ���ʉ�Ih)Z��~��:�t?�w`!�<'�MQ��GAYf5��x���o$=|��-Yu�;0�bܷ�k<�������/-�m}��*H�Zf��#ơ�TCk�W3p�'��Kaj����:VT����8�Qn5FKg��b^�'T��'��!��A)Lh0����
Static task
static1
Behavioral task
behavioral1
Sample
d905d476ae751ff6597c9cb65cec9b3f7f4afaa406236e15264ffbfc69fb2ea8.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
d905d476ae751ff6597c9cb65cec9b3f7f4afaa406236e15264ffbfc69fb2ea8.exe
Resource
win10v2004-20230703-en
General
-
Target
d905d476ae751ff6597c9cb65cec9b3f7f4afaa406236e15264ffbfc69fb2ea8
-
Size
6.5MB
-
MD5
6079f656d10a1ff045d82318e287b10f
-
SHA1
2e85e2264106523cce99bf73c745c56f3796d4df
-
SHA256
d905d476ae751ff6597c9cb65cec9b3f7f4afaa406236e15264ffbfc69fb2ea8
-
SHA512
dea642baa8a6cece56cbc94954fa5ce0572a83b7c4d2bfe248fd573c8cbd9f7277ec82dd9af02524a3991247d103bfc28b8254c90df153bdcbe3c91404ab2c2b
-
SSDEEP
98304:XhCX3lwsvod/ZkHzfSQHXhnnxbDd4FEza2sKdOjMIFXaexno4oKyZM9PKTlHuhS:oHl3od/gfDnJzMwIHheMtKTlQe2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d905d476ae751ff6597c9cb65cec9b3f7f4afaa406236e15264ffbfc69fb2ea8
Files
-
d905d476ae751ff6597c9cb65cec9b3f7f4afaa406236e15264ffbfc69fb2ea8.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 92KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 34KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 979KB - Virtual size: 988KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 225KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 21.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE