������6�|��B8�?2��g�)�X[!_l$��Pn�͙�>{ �^,��wryiO8�����o�����v��'�����%�"����=k�F��s�ޞ�u�hY�{C��m�Zs���{�����e����z�'����+�z!��su��Z2(��Ah��ܒ1RbAf1w��o��7�x�2�מđ�����8uaU�۹6��|)ht�����]����2ږ��-���*BAf�:G4뭟i�.��`<��6�6�}֨����pZ�p���ʹ���74�� ��m���?_����̡f�[ ���u�Q%B��<�N?��Ѵ:.$h�� w�[�Ǜ��G�e�O�2n�6��, Jj�ԙs�p{r~�k3�%���TX�v�E���z$��"���l�ش�)�;����gG�Q%o&�'�(r��YҐ�` ��м&���MZ��7�y���"�,��[��;���8q�S���ދ�.�&�@�}�d��mB�l;��jpK�5��#g7N���o��Ƕ�ƃ N�+?&&����o�e%�)�ɭDX���Z�P#ܢ��� ��\ʪ['5��\�g��s }���PHۯ}>I ��E�~�� _�%g�@0e��M�y�h��8m�TP����M ������*��� <M���ŎB���2k�l�n5}R��Pcb"Ѳ�/��+I���H/7�S_�L�NS. �0_���Z��l8h[{� �GW�R@���.��ݫt��9��Mc�DHO���B�X��=�U���ƤF�ię-h�S{�s����Kk�]1OKC#�C��Z�Nw��^�Š��4�� wIB�6ţ�3�P�x�}�.��L"Z�_�#�����V>,<U����V���t����F�]���%F��T{�{T�N[7P�����0B����̯M��B5À<Z��l�|](�V)��8���剴�,�c��]}ً~�ݝo1/&���wD�ӡ;�>D���F�V�#��L��m���%Ȋ�et%��|�KC�8X���g��D�1bDK�r7e����0�!X@���@�f!����pH�YsU�3�zm�z�_�8�ҽ��<�A�_����i1|�F����k����j����"T�b���b��`�K(y�$"01��%PJW�2 ��?$�,Uf'��� B��]���K���+ln�}��]߂ƒ��$ ��7�2p�,�9&�v���[�:'ƾ[^� x3���{��UOl�LU��̀���*{�g� !N�S����A�1��\oUE����g7r:�:��/ݭ�9U�&��Ꮲ }��79��ܘ��K���тb��H�߾�gF&�q>b ���T�y�>��mQ�ۡ�1�%*�� ��؈���u����F�F�`�����;i*3-�;C��^:� ()V�j��{2px�m���V��~��.�5 �з���� 1���T+�� �����q/��Be�U��\ɪ��$�Π�V���+\}��X������ <�D��j����`ς�Q��/�����,� s�- @H��c0�Wj��Pc<�����5��z� ]6(�&�f��ګ����͟KP�n2 >��F2G���ܮפ���ý[�\���G���bU����n1�,An���=���3�w'k�L-H���7�mЍ�1���Gv!Y����BN�B�<��14���4 ��Bn��T���E����{�?��O �Lf�`Yo8W3���V��j6m����d-_��Q-0�J*~�Lv{�NJܒ����������ȳ�SJ`t2-�_�-�N�8�P w�3���3�F: j���y/��$r�b]�2�c.u�|$UT� #규&C�7�1N��cA�Xd��d��w�MC��ĄXx�t�獤@.YҹW���D�����X�.���#~������r��3Jܒ�ts�Ai�_�*:�SK�B�� ������� ϙ������6I_1�a��n/��������&Hh=hgδ�(b\�Π3EBP�l������t���|�����/nW�����A�FYH�U��`����ӣ�s��+'�F'A,?Ґ�"���t�n�;��7�̽�.�h a��qw(�o]R�!i�q�Y�����a���e��M�����k�$L �ڵ���4#j*`���j�6�ˉۊ+��]ر�;o0(U�����ڕ���G����)�Ѭ� q[�xH"8���?�ح0�_�@�II��D�~ ���6]��>��?NU��˅�k!��)���D1f�����+l��7��QfjK������)q�^�08�6�0d�Xm�4&>;~- ��D���g��K h*�(�i��u�� ��xM�-�{i�fInc�4LmXJCtw�u;hs�es�ʐ%�0���=����r�>�}�E�3I��elmKƨ���h�M`�WΞNh����eCA�h�����5�{�6���Z�\Z��y���^ñ�J`�?�����[����%܃�^L{��Qx���J�S�|����?�����E&�F�N�u���ٰ�Jh�����4���6��M��ۆ�zI��aԙ@;rqgA�+���2���*� �K�����HvR��M�;�X�����^�����i�� �� b�[��L0m�����C������E�,��n��,�Y Of8�2*�ס���oޔ�H� 2EV�0��Rgy��u��~d�E�T�ĴĆ��ߏ�qsy����RWl�W�"�D{�K�i^L������/d/w�3��@��#�df��-��N��2�JS������ ���[��b��6��Ė����"\*T�Е#�s���y�O#^�d�,6KA��� ���@�k�N�������Ջ2I3{�O���%'�vu�_���|&3��?�=|�ɷG�g�Vo�>X�����y b�{n���K�m��x�F2?�����t}���. �ѱ�'�p Z._+��w[�@\hU��n��jc��"�/�[�%Lo�#�Iu������[��v� ^�����������SiЁ�Na��ء�\)�> Qj �qA,�]^�E�p�5-�ro �>� �όW��D�Ce �37�tLm�Q����l�ǰ���X>DH%�"�>���u��$�1^4��2�@�p��~�J��z���[�X��)�d퇛���%��% ��I_ wk#�r�"8�W��?�K�mb<v����.Z ���V���&�s8�:#D˾뉌ĩG�;d4+� zD�Ų�vff����{��FZT��0I:�
Static task
static1
Behavioral task
behavioral1
Sample
e651dc7b5e731060450fc622bb3bbd3a3ffcfd0107d0991711a028fdea2a4fcf.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
e651dc7b5e731060450fc622bb3bbd3a3ffcfd0107d0991711a028fdea2a4fcf.exe
Resource
win10v2004-20230831-en
General
-
Target
e651dc7b5e731060450fc622bb3bbd3a3ffcfd0107d0991711a028fdea2a4fcf
-
Size
3.4MB
-
MD5
6adeb4fdc9b2b85594bb71da841d9136
-
SHA1
1d9c9567cb2921f0ec39051b96f16bf74aa8026d
-
SHA256
e651dc7b5e731060450fc622bb3bbd3a3ffcfd0107d0991711a028fdea2a4fcf
-
SHA512
163635f788023d6d406f12ec72c3688342ed416a9859c7207838a62665bf593384e8d4a6da4fd59a493cb0ad576c5062937a0fa1ca5685b129f690daf98a2959
-
SSDEEP
98304:f8Aqg/7VbbD2+fFYNT4tiyqefuC+8M4DTfQ:0xghTYdGiybfC8lDTo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e651dc7b5e731060450fc622bb3bbd3a3ffcfd0107d0991711a028fdea2a4fcf
Files
-
e651dc7b5e731060450fc622bb3bbd3a3ffcfd0107d0991711a028fdea2a4fcf.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 582KB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 75KB - Virtual size: 296KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 18KB - Virtual size: 528KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 460KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 466KB - Virtual size: 468KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE