<~͆ڤ�����ȜX�/�!�-K���0;��=-�Ӕ�~= ���q ��HiΌ�n�6��S&�3������g�&�i��t��("+����{�p�q�O3~��Dt��������W�x� ��ʜo_��sKw��~�V�ʛ�Zƥ��G��:� ¸���e1��vC9�X)�b��|�Jwh���2���YA~�S)�T��+,�%��RP�؋��>H3a���>G 5�W�]ؼt$Cx�����D�u?�GO8_��St{Ng��k��T�Hr���Q,Ҥf��jb�!��A�]�x���{Q�ȷ�|:��C�]s�;©� ��U���,����B_�H�iq[,�v��g���*�r2����P5}�3�������-nB�_*�z�곙���8`�����d�d�f5WO63b�������-��5����~�7��M |O�i@1A��8��پ����A��H��qIU�`W iM�8�Mm����" �4��BY�Z��ƛ����`b**�]�c��( ���䋣�{��lݬ'�p#e)�[ �J(��y��u�!G��A~�������&0��`�5���86��$���{)s�f���D.,�B��#��H5�H����������11�,#A�2\.=��S "J�&����bK��,H��(��M�ە[+�n�[�k���^Q�l�0GF�� �&���WI3AM��퀷��>B���0G�~���2����&GL���vmL�\��+$.�R�55y�[ ��W��a�!�hKy�rm�@�t���/[[�p� a�L���nW���E樵���q�RaV;n�l�:��ɉÖ��}/f��h6# y6wq5Oe?�wal�� �_���}��s���X�Wnz����=Xv�\���ca��Q@�ͳf}]qe̬u����V"�������"3.#;�C�6�"�����؈�f���s�;��ΒS��Y��ɜrl��d��V��E#!�.eמrK����$��s(_������kn5QS$S������cZL��R��K���u�r��.�&��a�|d���ɲ�H!tJދrE������gr��ѯl�e̤�{dȿ'�(�"8���+�u�z�{O�a���>?/������� ����B�TK�C�Y�d�ߥ����&S'���J�$���J��]נ���xF4�K�I3u@5{����l�4���/8ʼf����~�$�?JUPf��g{�F������v]r�� ��U#��tI��3A'�l���uH���飖�ڊ`�(�:E!깽�b;��l]���]��*�j(�2õ�X�d���N~bf�ƾ�,�L�YtV�O�H��7��D����$H;F66�+ֿ��"R�k�?�7�MFs�I����0c�㕌@l��9M-3��*�I_,� I3*�/��cTՔ%��Eڤ��\J*Z5��X�5ïN���e�X����5�����$��S��#]k�;sP��٧���$�V��yq@�*S�|�����A������W-��k\WTP���x����������U6K.v|�����"��������\v� �<]�η�8L� �wd4��0��-L_���lrpq�<�a����4F�bo+ ��jv����ԩ���_��:6Ұ��>����[y�;מ�D��u���DSܵ�0� �O��ޖl_�PF�Yڎ�>�'�$\s�'<T�0f���ÔFƾm@���>��G9����/���f���5@$ݙ����1ݺd@�W(��MP�*bi8��nr��#�������&#����]R Etx2�x,4�ҨU��b�p}�X�`$$p������m��+��$�koTÃ�8C,8Lx�^��%�����<w������V��JQ�G4��)eI��Tx���x@3�8��o������7k�k�q���rK�\F�>��9 ������k����<�m��R��b��adR7�]L�Js"���썒%>3��HH�DRv�ގ��Ջ1�F�<�i� �KҺz�d�pcⳉD_k5��0q�ˮ���K95|��t��'���X�Ae��3Y}�>ޫ6k�T�Y����t~N0��-=̍��0�r¬h�f�2�=�<rN�v�S ������6ń��'^� �/ɕ]�+���},���Xσ�Za�A�ZL }��S�&��?�Hi���cμhy�(Յ��HET,��b9ܗ��l�ZZ��ȗe�]��c�_�wN��?� �I�6�o����u��]�����,��D#�GRg�s���1��u��M[7�sl9i��Vh|��q�����\oF�ӈ���� K�X����W ����F|C�����q7�dK(k˛� �G�?����Y m�����k_ߌ��q���{5����MS���Rb������ ��,m[�cSL���\���������C�wV��A´���F��V07�6G٤�4#�?Hk �_�����gv�X�����AT�&�>+�jY��� PL�ȅ���֗��^I�ɛ���uA��;'�Q�P�qF�� X]PG�6߾5��7���w�o��e��}P�{��2ɑ!^VC�EDP�P����Z�l~-GОl�9l�(������Ωa�SQ�<FA�����Nl�������o�u��)���������[�ڪ�X|�Ml�a����.�CEy�8TlA}�%y�~�dž=��r��D�e���� m阴�E�.�g��y(��Svw�|���q�/���>9��o�o�&�<|Oh�ƍV];�:��{�h�V���r�A ,���p�u� X���q���eȐ�����9J~�у �� ]���ܬ^��"!F?s�e�M�P��hjf%|��Cvc�?�!,�S��r�cSc�3�!+�gof]O�*yD�Df�d�Ǹ�Jv(�hS�=fвc��tua��vᵱs\����y��� Dna�G�|�!2��h�� ԁ������.���l�˒X�#M��ᇷa�)��"�;�����)��!:�-��-�����I̥��i�k�<�n���\�B�&��w9���:&�}CP�
Static task
static1
Behavioral task
behavioral1
Sample
ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3.exe
Resource
win10v2004-20230915-en
General
-
Target
ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3
-
Size
5.5MB
-
MD5
1bd38e2f797e05fb807df546c65f110b
-
SHA1
d4a9cce5629581ac4a58acfa2fbe84dedd4dcf42
-
SHA256
ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3
-
SHA512
352825edbf50d576363754b4fa563b408cee6f28628c7d944761d1dc27d55aaff0a0d15fdf9d70db8657277585dc2de07287076810778da97b7e42f92b9c9c4a
-
SSDEEP
98304:1D5v8h0AtmraaT14FuxGT96TH/k8DrW7R9H1cSFrL06ZXaOCNWDdxRZTmGcy:n8RCZTiuGETfk8DrWN9HeMrGzN4pNcy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3
Files
-
ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 794KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 195KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 383KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.???0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.???1 Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 96KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.enigma1 Size: 740KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma2 Size: 284KB - Virtual size: 284KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE