F�?T<��%���"k4 �/U��a�ԅm����E��9 �������ٚW6�@��B��Rf8��Jp������Tw�|0o%�fZ��Gk4���`(��)�0yF4ߘ�x`�����h����/bK~�����[�i�$lk��,.�%U͗�\+D��M��S ����Wg V��_v�Q/���%�rp:fyJ���a����?��߇��b�~�5[ߗ��`�\g��&X��Aٞ{�Մ����E�<T�T?Xc���;��1@�v�~�V��9g>BS�rE��>ߊg���;ȧ�É*=��i���h��u*3Z|�'�++��Z1�a%TC�zk���$.���mL~��ytg��Ϥ��)�H��;�8/ʕ$ Zy��,}�E<��<8�Y�q��Y�D��Y��n�t������� �in�d���5]�LY_��v�qȊkq���h�H�x�$��!��h�qxH��W�)Z�H~�_�^�<R,aD��*�t�qN�̥�MW�����������L�T�ғ:�C��(��Y����� wʼn�$[�����d���CiE�^t���4��� ��v�TT1�2B�']�;_� ����'W�&��2�o8���yS�Ʌ�yH����T&���iG��l7��n�x���rf��O:إ�Buz/ܛW�|��u�֧������R��ky$T�]� �'PX�� �"OA� ��y��}Loo�g� � ���z�,�-���� �FW/��;,*�,��X��"2��b"��O���c��j>��V������r�n �VRn�:1���$���gb�\�F>�h:�Ԑ>�5��?7'BY��.R��+h���@K'���>y�%�����M7� ���3X̱^� �f%t����+bCb��'�j�0�o錻7��D�Z2Xp5`;u���N�T�)x4����E*����i֎��jm����.B�V|���?V�R-���M��k�}gMv�2ci��ю5��|�V��^�����6u�JD~/f�5@�r=����W�!���8N�v�x��?Y�H;�v)�:�p�� �gCfʣ��Գ���&;�d�U1���+��'�s��O� �p����V���^Q��u�X�V �� ��앬��e�G��Bn�{�4�+�g��Mxg�,���'@F:&�Ja��� ���,��Ƶ�٘������� ,�(�W=O5��L��.�lR-�0� ��l��LLx�y� �z-�� �ʈ��3��*3��ॷ%�.��Brۗ����0�4'S�w*�z���Scw�m�T`;�g�S��@�no9�Z���Y��oy��R�Ұ�۹�Q�:��u�t,@�Y�8hϬZ� GHEW���� O�QL �eX�%]EJ�k;�ܜ0I����dL�;kʏD�x����"�������U�p2��=e6�TX����bS�Lv�'F��1.V�MWVr-�p�/��},q�!�qKDwX���{�� LrT��Ͷ�����#7�}�oa��,�ղxIWH�b�����Ȇk��&����k���*B���4�r�w?���9-�8���p�ř��\P4��6&��,�J���t�@����x��p�'��6�ޡUN%켩�k��*�� @ 7���-�� =aXk&��*3���i���B�ꛦY�.!k<nz����B��z�9=A}- � �"�W ���N���w}��{���9v��&���o�O̗�Ч��F��*�mUj����6�%���涯������y��aB=��?�d̨���I�&� �D�)P'�Q_�I;�ў��+e����8f+v^Z1���vK��7�O�y����t��QU�`R�ϭG"/���BjF�עcύ�#X�2�ge�Xrѡ��[�?����+�AF�{Rm��6�8a,�����WV�`;Bҫ�'�ʊCV�O�3H LW)wP���:�"��;Jqv����+ �B- �;g.'��9ľ�r�fF&:�>��+���Pgb�����a��� ����%K$C�^%>������R��;9��-�\h��H�!��zzԒ�NVn��B�«��M����6��M�c�"�)I��v��Sav�I���H̳��xKc N���?���U����T\MvR+�Wh�U����}C_a!Ƚ��SQ����*�j��@n� �<l���>t�m����.Z=d����go�L��`\+��.;Q6�m.�Ĕ�,����Z@ٿb5=��t��Bnu�e�������|���_f;�^�[<� ����aZ(���r)�3k2�!CA�1��@��䑈]I��F������゚s<u'~B���ԩ'^^r����c?h�L���t�=����y����f�'���mY.a6!�����"R-�un��Z��s@�Y������;���U�]3!�z���|��|�a�y�����@�v�����J�Q�EX������p� ����g�=o9suk=H0�HlҜ͞H���� �}��d��Ҝ������q(#p&���ln�]�y<a���H҄�������L$�nf���L�*0�0�����mn�D�PD�:���y,��+%.`���$�M ���*l�D����3}>� >t|�� ����Ŕ$"�����"|]VX�P���i���iJ'�2�4/����0��^���?! !�KK~a�g���F(��M�i ⹁�e]��)�6 %�6��'}"��n���֒�~��X�p���b9�_;����qs���(!�6�E��a��9'״{dio`�p��p��1n���� ��r�y�t^Eg8�o���얕���!yG�e��Z���i�b�k6k����ۄ��Fm����_��,�W�+J���X���ƛʤ�j�N���cJ.�CE�d $���p8��Uӯ�MC�.�G�����<$�X��x�5cfv,��dE�J�ٛ����Mu7�g��r��[_"���E�K}�a�r �!���k)IjpL�<&�"�p��M�������i������LgB1>9�ԌT#�ᲁ%���r�u�'f��Z��+��$����1�:�|��,��v��Ҁ�DdO���!n�R��璓�C�eb96�B��䅕�T=9R����9�x8�~:~6,��@�9�=y�f͉�n��8b������?)��ٓB�����/�H��%��y4�y�N_Ύ�]� �8�U���o֣$:AfV�Z�-����>A�60+J@nYف��s ��zv�X�'��{�Ɵ�KT��<"w�Y�;�#�1�H$Us.�{{��D�;C��%������NSn�vp4���ѥCE�vSA^S����<�kP� �|���k�x�e� ����u���ަGz����A,��=��id�Kprb*���N��A��j�����P��"��;_�s���_vk7W��q������G�e��(a:��������h��v�G�mL�D�>��5��H�Qr���<'�����VҞI����q_@�%1G�D͎3$���rg���E"~�X�ҴV|ʍ�e��dA5����RO�k��x|�L���[���p=�=I�������[�c��C���d������F�B�����O���jl��r��,sn�9a#��jP�7���3�~ǀ�U��.�'�RR��b���?���A�O<Yri��f�(�y\����c�}�T{L��T6(݉=�l(���g~"h��9t���!�R�w\Xb�t
Static task
static1
Behavioral task
behavioral1
Sample
263c3bd9057ec456c6fdb88210d6736f14f0c299a5df28e8ee6384898eca5b98.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
263c3bd9057ec456c6fdb88210d6736f14f0c299a5df28e8ee6384898eca5b98.exe
Resource
win10v2004-20230703-en
General
-
Target
0f0f89d7de95cb78a2ecb84c48fa411f.bin
-
Size
3.6MB
-
MD5
752cf15ab8bb1908049e0122de2bc655
-
SHA1
7ed8c7430723651cf30aa86e280b9ecb95e7ec8f
-
SHA256
c5e265d064f9603e3ab2edf798cac3bc3db80ada85d8d7ee2854e4a1d6fa1573
-
SHA512
dfb8f3d7298960878d0ee4dffc3956f473c41c23ef6be7be1cdca19fb2e592c61c0c8d244970c0e4450bd8458c9c12e9009c3c5852f5a2651bb511870335e32b
-
SSDEEP
98304:j8fOAIHZIrw0xATrmvhhPhPzVdBQdx1eUU7:jrAwZIrw1+vik
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/263c3bd9057ec456c6fdb88210d6736f14f0c299a5df28e8ee6384898eca5b98.bin
Files
-
0f0f89d7de95cb78a2ecb84c48fa411f.bin.zip
Password: infected
-
263c3bd9057ec456c6fdb88210d6736f14f0c299a5df28e8ee6384898eca5b98.bin.exe windows x86
Password: infected
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
Size: 894KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 17KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 16KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 99KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 208KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 357KB - Virtual size: 360KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE