���'��Ax�/ �����Q���+�I�3�n�<���L���1�S� %_�{�.M8K�@�<������0���)_�-�pY���Q�ѻ�59�̸�cY��(K�O'E\� 0�9z��04�J���(�%��\�T!3���ٶ�u7E���r�����v��i�;6ve��(�~ l��y*����B��Ċ��ބ�E�=�+ e�ƷW����KC���h.]���?b@�w�F�:����żۢ��@Z�"�%���ʭ��[=n�-�5��&�-����{x����7�V�Ȗ��eS<YvMکc���A��Ꭰ�^e�Dc~�[93r��C��G܍��@!t�P��% �K�' ���������c:�8>���w�$�����Bˢ�����0- E���<�� ��xg#�/L����pø�9��<%d�x*��<��3� �l�2HI��+Ǧxa�� �߹8��Nũώ���"͊�a���E���<���W�K_�"�@8e��B-NU+�}�� }t���%�'�WZ:+Q�*I����� �(\���,z�����gTQ��&f/���ޗ�|Y�_�h��72���e .É��A�8�3 ��ϐ�2�Zh9!Uɻf�k-.b�o� �7 �����������3rG��tm�+Z������-������w����5J�� A.��'�W�k�T㫔�76̔��9�q`MD�J�`P�ў�����:<�k�g��טNY����Y�M�ցk�~���j����7�"�&V0R0n|(A������U]���2u���SY�4 N�g��c����}4鱝�35�쐡ڸt����1r��4s�;k�[�΅7��:� ��]�ЛJ�i/���ev�ƽ�/xi8����A��9��J�#U��AN]���eߍN�Q��mZ[�k�+I�QKlTmZk�}�K'F��əc�F�6y�fH���&���Dj���n,=D7!{���n3f��P�5��<&�8�6�ҷ��G.�И�����R��ݦ#�,K��T6�����b��֏<�>)�st�� #�-mņ���[�L�r�t.ͷ�ڜ�T#��H{�B`���G4?nt�B{��K��V`��[����u�?�h�RF�6�� "<�}PO�������PeՊN�ݖ�rMu�^/���;���&�qt 6u8����\����uӣ�(.��cX0P���{�y��W��6�"?hj�Z�a`�}�,��`˼� ���[���e'L{��lKUK�\��,�px��(@!+�/q�������Z����q��Y� $���`=m������H��x��@��R��ѫ�Bg����@�c��;��3�)���Z`^�dѶ�0'�p3��[ ���Y5=���� ���?����=FS�ގ����I�#MM0��1dƶ���h�P��`��&��C�Iy� ����>-#G-]���1 )!��$�۠����m�XT k�D20��a1t���n��4�����8=�)~��:n�tV��k�8~ �{A 7���ʰS0>#m���T9y&�ȃ��^���|�/LY�U~r+�8ي�hϪ�Ro_C�茀T���a����N.ѣ˵|U4��S9�^d�>�?�c���'W��50�ɤզ���W�p_�\I�5�����Ċr��bN��~Nc�a��g����0����\e��OL��p:�"M�& 77�YU����D�V"1�/�N���Ey#]�yu�m ���f��j�0�� ����mİ}��f!�D��s��A�)�4?wv�� 0?�V�)М��u��>��.0��j�[��~�xA5Ɛ_�F��gzh�6yڴ�2���W�cM�"uM�W@��h3�Nt�9��=�D.��P?��Ǒ��Z��|���aR�N�r�-�o��'��,���?��1�����ꠘ�ɂYGT�r���Ϗ�K�&J {�Y0��x� �x��=m�d�Gl�n����NT1#2�"�M����\��sg��eet�5+���eʅ���.����S�J��H�S����6؆�N�����/ĉ��V,�8� ��~Mr��WM��q`�كY���q�.�B�U�Izk�p��UT��ț�"�EEE�f�R��A����� �ӈ���!�C~�zU:�mά�m)�_���\�7U�����E@^�j�n�5� ��T�{�f1q��u�x���Bb ��L�z�^�|�,���_Az=��?I�Ѕ�*�7la�ta�� �~t��L0�Y�-�j��ۆkB�5r�# Sڿ!��Zk��v�U�3����t�"��r�^��E�����L�6���ZެN71�J�4e��#j���JZAy}W+IH������S��lX+����Cg��ΩMY~�U(���L���CNG~,_NH�-H-�"b��%�K;��&ه� N�w+�+�¥A�0j�D�y����w�qj���ٟ_@��r��( �y���"ewE'���ʕ��`#J���U?g=�Z��G�N%�� �TЊ¤c�jqNq�v31��wg��S)^@@�0�� �0���RP ������{OIJ�v�)��_���5�;������ �*H%���b���Wg��pd��k狫����H���.$@k��G a�ƣ*�2���ެ��@�*a��P�+�����"{r�p�4"���g�a��v�Wd��A��2�ǡ'���dt�R����%���0���ȍ�@;�#B�y�+� �{BL�k��m���M��Ê`P�-a�e�^-7q #�I ��_\�V#��zx:9Ɋp.Gq������܈������f��,?�Ն����h[H�E1.am��:�m�@��4���8&ن�[*�(��6��.��Ջ�w'��"�3��y��`?(��z0>�P�J'��'��A�7���)�AႰ ���掀�y�0������]/3M��)��EE�9<�p�]��'�xi�Bwx0R��q��*�@�"�c/2�֚ %�B�(��3��t}���s�2c�iZS�����T�i�F�����>r��m�E.����O9�g�^6J�JYԧ�/P�ׁ�ft��L����3�FU\V�����O��n�گE�`�]���TD���8=Tc������%�$�k�=��j�-��v���E��#��;�,�Y&��U(g{_�9�b=_��������Z�zv[d���[˓��� �������sG�+�̖n�`M�LطXY�o I~���#m䧠�� � �TSɜ�eF+3-�[����T>2���l��R�_�n�������6P��$c{�*D0��u��Y`�S ����K�����C���q���K�yXME'|�����9$:�fΡ�l��9��76*O5����wPv���+&� ��L�����=���i�vEGs{�2���vP2��,�n��cƔ�Kw&I�i�z*��x��K��+;�����3�����W4402�3��)��U�mF�S���h>�s�AZ��vA���h��}�}/8�����J�XB��Ĝʥ��|�7�7���.�+���ʡdE��X/�����Y�����%��͉�CQk�ؚR�s^O���=`�F;�FˬtE������+-��]�����h����Ls�J��]X�����{L%�� 6���#�{��ѣU�?�_@���LD��|�����IÕm{�:pj���������Լ����Qg+�af4�ң�3����9i�����:�8�����@�p�
Static task
static1
Behavioral task
behavioral1
Sample
f00bb0d0b6ee422847631cf552c472b07d657cecc85e83dafd4ee5180d130a00.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
f00bb0d0b6ee422847631cf552c472b07d657cecc85e83dafd4ee5180d130a00.exe
Resource
win10v2004-20230703-en
General
-
Target
f00bb0d0b6ee422847631cf552c472b07d657cecc85e83dafd4ee5180d130a00
-
Size
3.8MB
-
MD5
06387d64587f5a77dd3f115207294d72
-
SHA1
ea4ed5f44a909911138c4190a439c1f4251515d0
-
SHA256
f00bb0d0b6ee422847631cf552c472b07d657cecc85e83dafd4ee5180d130a00
-
SHA512
b81bd6e0835d59f3cb03865aa2a75188bbb262601002772c448d146b46fad66a1c584ff270bf8c23ab7083640ce05a8d776535416e852de13403f175a9d0a5e0
-
SSDEEP
98304:XF7XIGPyvQvcVL1sAfD7TB5PhKO1AwIXTgPj6lbU0Kip:XpXIvvQkVpHfDh9NAfXTMj6xU05
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f00bb0d0b6ee422847631cf552c472b07d657cecc85e83dafd4ee5180d130a00
Files
-
f00bb0d0b6ee422847631cf552c472b07d657cecc85e83dafd4ee5180d130a00.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 935KB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 119KB - Virtual size: 472KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 13KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 51KB - Virtual size: 636KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 216KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 322KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 193KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE