��?���aPm�;��Ѭ��?_$}����B)x���>'>�`��A�B?����ḁٯ6y�7���b�|2�j���_�H�:^�C���WY���U������,&?c��Z�:����;���~{�唾��x�(o�����֡��`g�b�v�n&YTն���W&`�c��\��s^��$���r�蝴��O�56��S��i(8���2a����f���"��3AY}�M���{��ƀ|�����2D�<��_w�w�Fb��R�eSL�R%<>)d4�3Qs��8b(��Nf[�ľ�g��~k�f,v.��0w֏Aq#ru�E�zSZ���Irk�hA#�Cfth~m���\�3낓�i��fy)��w�����؆8��믌Wl1�V�`���Ѯ�=� ;�h0J�}�l����m�u�%weT��&fuz��[����>�QF�ݫ�3��.Qf����s�2HN�����x_1� 3����a�IA11��S�ZV=\��E������k���2 ��J��� ZI�+]�_L!���� ;C*]�G�{��Y�A��R�,���9��&�u��b�0���G4p�f�f:lp/~B�*��6�JWR�����pe�uG��q��K�߹����EZU�ᙜ��=T1�ظ|� �\��}����X&wz��Lˆ�`�� T������=�c͘��~��������-�����[5�c]��1��xR���6��f�գ+i�g���M+.��y �� ��G�<�2�Ak4�W�Tr7��I |,�����Pa)�<i�"W~��&��X� )r�]W�QM;t3HnF�A���VNU^99Cd����3���u�����9�&L?�_��=Zx ��b�HOO��Y_�KK�%�J��'�D�����@>�a;�.QA�ȯ������f�M����$I���x���[�*���I.T�b:���$� �=��ńz_� -��t�,ە���,���:��')c�H�a1�_a��O�D'�{ (�.ϯ� ���v�)\� �6�c��V/y6˘���MIn�e�Z#�����o��X�j����qָ��/b v���{lEۭ���i)��͛Q&-K5�����9]꡶��������� ���b]�� C�k� ���b�9V�F3 |�$gL)f���o��8z*ZX!����Bẟ7\�NQ�5X�{�"у��5ʕ,�x��j���yQ��B���g��@�_Z��ؑG_. ��n2cs��_��=���$������*Җ V�o\�Y-J�V.8���-$N��,$ZFPL�'��h��i�����G �7�\����qq ��s` ]D�8�ou+�e��9� �c��E��֤������~�5�3��#�)2g�Ic�Qv#��O3�i��V�V����-�zX'BL�wa�mi|��ܔH�d��p�8]N:±M�Sb�B�&C4 -�i���jCN�������d���#o�5��H�ð�,�?Q�S����հ�m�R�d� �Hx��|�I��Eu�/ !Tp��A⢿ެu�tR�t�DFMT�(p�LyI|�1U| D�� �d�p�:5�5�r�U%��H;�.���&�x ��B�?��ػW�@|j��q$[�ǝ9���0���@\�@�����Oʬ`�Pg�T�'~���TF�|�D�nd{�����p�h�LY[��LO=����M�N�V/qb0���l� �� ��� ���Ԝ�q3�����A���I�����?h�^4�T��^j�� [��;��rmm�M��x:u�N�!HK.�/�6���M7*�F���-Kc��A- �1��HA �o� �����L�n�ܧ:��:,_�������^8�ԙω������<�VE��q�BVѿ��G��m�t_�@W/���?�U�e�}��ט�?��}E\Q��}��H{ʤ-Q$#��O���f��`��"���~���q�(/&���<�p�@&p@W�z� �Q��jp��<-=���E ��Éƕ����T0��0ʡ��Ev���eI�o�G���(2�5#�p୩�\�r�Ӕ@h܇���K�I?)�� ��l�AF��~HX��}���I�KW��I�:\� �:��J^t�`�t�H%�K�tyk��fQ~hF�mU�u(�b�uhBڛ�5�c�.�]�_4�#ћ`M�G�* ���>ָ��l+6�c.��j'Xb�6)گwv�!?��Hj��-���t�ʮ�\��Lc5����ތ�'��&ld�t>d���os�&c����&�''��L�i�E���b�tǯ��$��Q���m����@Is��q�9qB���Q� p�������BnR;�e�� Es#T�hF�%�X|���f0+�ᚖ]����$y4��KvO����N-A��;R�iI��`�ׂ�P�F@.C�\g���J'�~�����������/7��6L8�5j/Q����V�lMV�p�!���h_�QlX�j�D�r�8���>�^���W�8�> ���UN�g�*!N�x���dhR]�z>0(JP��y�[��� 1IR��(�����U��$i��tkAN����y���ڢ�P�r`��^9Oz�0B2l��6D/ʔ|3u���Z0�Y�H�0��Zq��D3�/�ex>Zs-<�3�C�g#��GQS��=׆A��<dt���<��mD�yT��� ��A,[H{���-�0�\��B`G���LTD� (�K�*ba�fgVa���{�^�cR��a{~+e�\��@1q�����k^Tr�����*n��%x�%�K�B��ll��4h=�ȶ��oj���gyS8�r����f�|���^f���V�}�I'%~ �>'�#dw��t�^��C���o�4p�u�BL�,%.]W~f�я��ҍ<��k�w�N����` �� �P�%�d�; � �"�ڋ�˄V�vO��.�<����d��j�gu�Ԧ>'C�l�]Wh�`�v���!���JJ���K:(Wz�G���:���p�nE�q5�%�Z�U6)j��Ot��Œ�\vJ���]��5��p�j��s���?�4m��C��Z&h��J���2�����&Ffs 壥��ڴ�?����O1����ְ������Y���y��V�\LG���!]���TK�!��� %�hЌϴ��R�6hd�Byb��v��#t}o�����ug��X-���x1���'1�fe�R).���v)@��xy��4m���늠�}��h�b�7Bl��C�sz��R�� �1\`�'��Zⱻ2栰��L?�vwaeƿ'�2�K�����%NDo}et�$��KT 7m
Static task
static1
Behavioral task
behavioral1
Sample
97795c68104a229e68b2d0167730977b6e884a3550eb1dacc49701455c32bfa6.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
97795c68104a229e68b2d0167730977b6e884a3550eb1dacc49701455c32bfa6.exe
Resource
win10v2004-20230703-en
General
-
Target
97795c68104a229e68b2d0167730977b6e884a3550eb1dacc49701455c32bfa6
-
Size
5.5MB
-
MD5
61d3d59b2100d946004fa9e602ad407f
-
SHA1
1d81b2ac332e2cf1c1f818b7c63022c5fddaa305
-
SHA256
97795c68104a229e68b2d0167730977b6e884a3550eb1dacc49701455c32bfa6
-
SHA512
67fadfad2eb3fc60926c2e2311dec194106298e11431b5e51277c619d7fd3bb88581dd49b2bae908ca584f1764779dbcc1c51b882e34872030958c4f7866813b
-
SSDEEP
98304:skmcbYRPjxOSEMXfkcFX35PkfmDp4KHK23s7NNi+EGWyS47hD6zV3OXfPtZrwJt9:sXRPjxrqcFZIkpy23sBN1Eb4O1OXdlwp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 97795c68104a229e68b2d0167730977b6e884a3550eb1dacc49701455c32bfa6
Files
-
97795c68104a229e68b2d0167730977b6e884a3550eb1dacc49701455c32bfa6.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 1.1MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 73KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.7MB - Virtual size: 11.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE