C����wuޛ����Orʈ)��x.�t"�*�T�QԨ�sy�/�q3,"��W����'M��N��0�FSv�G��AL������S��L�1��N0S��� �W�-9��=�))��$���W}��M��K� Z���1̤��%˴ g^����u������� ��9U&b,��.*�y�G좁�����4^۬���7��,X��;Rt'���ȇw�=���b*E��%s�{�'�a��<�����a�O��hrQ8�����ģ9R�Um�o�t'��0�ZD��h����b�,�=�.w�V���'j�(���)^>��<� ��.��x"w�ڒ����`��dQmf��B������� q \+�1º��+�vJz�t\+6VV���[6�5p�T�k~l�Y�F-^ �>�ඐ� ���貊�I ��21��y�o�����^O�cQ.� ��"K#�?ߙ_�Ue��g��Yܩr�����$ٽe��F�&��,������4�>��;F�Iq�*-��d���x��E���5�i��-�_�dP*L}.pQ�d�Ϋ���?����m����L�v�N�4*��D�q~^��7�e����Ӳ�����1)�����Fگ�I �y�8�����`����!ULrt�+Us�o��<\����I�2��)Z]�>D+�4��S.UWݯv��}�Qt��R���)��H4�W�`ˉ��Yh���د!3�����ߠa�>9���Ä:=�Ov�5��Iɬ�� �|��~99|���:���-�<�aX�Xs XO�@��MYm�f���dO)=x�p,� �_��M/ކJ�<�n�Kj���OCl��$�R����c�C7J�-��7������1��/b�l�X�� Z`�5O\�ds����r��[]�F�E�h��u��<�9�f[�l���[\v���\�Px�%�9�#j�5�����P��+�@j3��1��G�2�(�F�v\��A� ���AVzd PN��:͝�o�U�w�����3�"T�{ e�(J.۫!@b�����y�g��'?��L,�֙�̰.J��x�b�\�SE�5�V��, ��S���mu����Mo�yp�P�y���Go������E�C�)�D���%(�P�<�N�Tr�=�V���|�=�Q-6�Z�W�#��g���ne'������E�c|�����G��4d ����F�s�V��1q��9�riVg�s����6��9��O]�M�((����G�&7�;��w��]U�g��"�hA;�7�I@(Z�4=L��.+)[U�߂:�ΰD"<~I��.g��]�0[�����̖�y�|�^��z$�$Tӳf�n�(���KRu>A�7�=��t"v�>�����Yw���1W�W��\��(�A�Z8���0Y+�خ8 X��%]�w����W���^#�����J�*IK�;K�Yr�M�����.h/h턷�o�sE��4R�#�Y��7Ex8��yY�4 ��r�Rm����Ep�xN�h�9��x|�l��� ���k���+V"�#-� �L��HB0��1r���!\S�eG�%&�pP�}��� Oe:!�b�qB�k����l��'��'q��Թ�l��E/O<��|l�z��f����_z�)�c�8N��-����E��6iV�����ݪ��+ ��� ���c����o�mv�}&W�O�O�$A�B��W2]� i��܄������a�g�Ȧ��\��Z�NOy;/^�O{0dS*�ԏZ�r��c�ɵ����;4עa��W�6���"\%c��?�T��ө��9�'ۧ����;k��!�e���Օ�V�͖Yɥ���9aHY���������G�o~�a��DcP&OR�;E�{��v��+l�y�ÐS���Y�S�cn�-}>�g ��~�<���zPר��`����f�kj1U!�CƲq��j����r���b�a�l��/�yk,�)��\��G����3�4Z���CTj�6���RO�]�o��(��D�q:;Kg9#�l1C[�{�Y��nQ�uh շԯ6�B+A~�*P�|@�&T��y�֨~�01rG!���)���8�"�����dv�q}�U��ʹ /?�·jA�`��7��h��gMȎ��.��"�b�&̖���j�X�yk@d�I�w9pZ����Ѿ��d���7�%$���{~�����lh��&��f`�����"�K����~��b��^Z��g4�NO�&|}��������s����c�I�}�2&�N�PC�f%N�=����9Ѽ��˗��$�o-3�e��#�'�eh�J��)@���r�ee�϶�+�F^�����ˢ�S�(O�u뾄\5�\��<��]U������C�{���*_���AB�]*��쬎`�d��1��[[4��t*�_���և��sE��T%�ӆ';�P�[���PaDڳ�h�,��~�[nS)tj�Q>+X��X��_��s�A��N7 X0M�A6��vk�B��!� �l�6we��⁏�����Q O%���x?d�'��?�N(���?�;���$.�P��=Sq�g���vD�Hh����$V��nk�����*5�"}���O+b�X��؋����X9��m�8Gm}w��QX�G�s͏8>أ�QD��" )4=�N�������RO�}�� ��N�h�V�qq�{�,`o1i��� ���/���es�M*De�]�:��o7�pq*��]�](��'X{绮+<���Vxb�8�8��/Iv�'�YvP�̭<��2^gV�~�:<bM�}��0�m��xh���W;Sk Kx��ωR�[���5�����?����8��うd�Qz�<|���[6����}���dg=}���|kz��>ngU� f}YZa4���å 5�ŋ�t!��t��p����:���B�^�t���&���Rb�ߡ�t��)ws"�QE��{N1[�3M�WƘ*T��IKb�u��A:� ��U��\>�`_�6�5V4%p�U�<,���ݖ�Ѐ2�f+�bWn�AN˖�M�� (/���g0�eXng�?U*<��t|do�;7y��Dȳ�4��L��ެ�ad�w8��8G?1�}F<�?5���)����O=��t�h��8����'&��L�΄��5��� T2�aAw��2Ư >=���H��m�� ���(}�C �9�<�X�5���| v����W��M��ޟZ2�f9�S���@�d�^�-����^Q���)�j'R3ٌ���%��˭C��M��ⰅS�ߢx�''�ڇ�5���W_���/pq�֗���Z������c����UX �s�����7�ؔ�UNE;����V��ڛ�O�N��b-���/����5;t�����"��7� nKJ<辶Z�� �@U&8 ;�"�� \ӱ��-O��R�@x%�<��� ������_�ڮ���[Z���l�Ov5���3���i)Ry�3# g��?�ٱ+D����(~&V)��ۑ]�&��Hg~�b��Dx.�4�@č$m��Cln˃��P���&WH��:�p�o}4�E�����[V������A���էv[��?oD�*m����Y}�J�[���'�6�O*`���̴!�'ğE����
Static task
static1
Behavioral task
behavioral1
Sample
c2285a456255d1dc1e1b6b323cc79746cd7655d1fd722c85caa24f0a5a156c46.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
c2285a456255d1dc1e1b6b323cc79746cd7655d1fd722c85caa24f0a5a156c46.exe
Resource
win10v2004-20230824-en
General
-
Target
c2285a456255d1dc1e1b6b323cc79746cd7655d1fd722c85caa24f0a5a156c46
-
Size
4.3MB
-
MD5
e7a82e3bd921e8357f76f43b646ae502
-
SHA1
c89c7027c8b9ec91c88f5a227da37b393f672e60
-
SHA256
c2285a456255d1dc1e1b6b323cc79746cd7655d1fd722c85caa24f0a5a156c46
-
SHA512
9515809ab0b1af47ff7c570fa64efbcbdb739bce6bf3bf3080a64c3fee7148ce7b19c8d42cc15db16c5aadb689293fd24da6a59919c311c12ca5c7ebba96c1ec
-
SSDEEP
98304:FgL0vYq4ua4La4IZIru4j5g99pzz2NFIXol2mddewLEOV1J:FgNUdLaoi4N0HfR44w7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c2285a456255d1dc1e1b6b323cc79746cd7655d1fd722c85caa24f0a5a156c46
Files
-
c2285a456255d1dc1e1b6b323cc79746cd7655d1fd722c85caa24f0a5a156c46.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 400KB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 9KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 60KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.3MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 419KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE