�j�(m@�];j�ڊ��'��J� W�I�Q_S#P��B��]PM#����]�6U�x�R����l���S�EU�,�s�?z�z��vu������>���D��1N�����z�"Uv,�������"�kc,�ˬQ������̆�o�ߝ��"1�Ep6"�jۻ�Q��Ȍ�guȢ��,B;�Ȓ�D��>�(�wJi幊�Z�M���WWP*���y�y�k�tQ�}�rݫȪ�|v� ,��=<�P�Ux�I�o�cvl�b%�^��Uz����th�-��t�y>�79'���Kb���GW��k�qY92�A��doǎ8ͷ��z^�}ǭƹ5T�on�����9���?���.�����t �唅~�+�W�*������8x����Ҍ����3�>YӀ��v `��"��A�W^]��&S,|#I*��ġH���m�~b�^���o��ֲoō�rHMw�t#�}��mT�i���Y�{7��������0�N�l�O՝��t�q��� ���gFѽ�rb��'`~���� �ȼ�\�r�a7�U�,���_�l�ou+�U6"u6���U��K>��}�kѱ�AWz�b�q��?Ep:j���J��^�E���.�����~�>�/�W2���f�;�:R���!�^Rdt�!�U���JN�]t��u(���� ��^�B�&�m�V;m�tnRe�ͪ�����̜w�P��T��ɤ��d�Lp&]����("i���w� }9o�?����ART+!�b����m@OƜ�˶w�v~'�7���0��kY���a� <�4k���~?�Zv��?�n*̔ nj����:X���x����;�a�kdO���K��u�~�L��A"�k$1%.�㗨�VWtp$�MvJ������P�f��@`e]i���n������gBJ���L���E�~��!�C��-�B��i�NJ]��yI�T&����U��8��{;��[ц��-w�ъ�&����*tTʴ�O�m2~��@��]u�N�v弧RD`�� �e�3c�����N��H��`<����[���i u+��mv_����c�mt|�N���f�m�N�J���#�eܸ.;��F�p�d�:O�� _�g����#+��Ji�:}.o���;�R�H�@����o�O%c8�gD�2tg�����1PSv ze���MR�[�֏�w1���D+����'X/n���8=Gɼ~d��}/K;S�Y� ��8���л�w�f{�K��#Uu���PDd$_��̚���-)� �0�M��z c����Ğnap�W���,d# ��ƿ�|A����HS���dzt�96w��'������� � 2͛`�'��F��C@���.��zWb��;��`�)R>k)b�m˭s�~;fg�������Ә���_��?���Y\�Em�.}�*阎G6�~�~@k��Bt�/�'������� ���Y��Nc�6�+@s|�=�4e�Ґ���8Q�����>K�%�Mj"�B�fq��Z�{Hu��7_�M�a�q�V������ECZ�I��_�9�����R{��Ü2������CR�#�[�}?���]�0'��%��#����nm��8��C���� 1.`p�� .����4p����/:H�Y�O&����L�}�a��#��;��2�x�1�G��'C��Tó]��y��_l� 60�a���I���ȥ/��Y�,�*��5m�'rlA���W����@��y��c3�\�����Z��#2��D�X�l�����ۗS�["Y֑�Q��3�.��9"[�wC���\���uV��5w^:07 ]ދ�eC0@�c��,˟ l"����}^�+�!A&ʔ��6M���>Dt��Kv�a���[�I܁K%����}r�=�| ��,W�����Ԣ��u鼏p�=����r��0�Z� ֱ�?u��Bףm�����ȝ��7���i���Q4q���T�~��OO�AB� cH�A��H�("l� JzYsؗ��&�ˤ��+�����.j{ �:N������� � *U[q+~��<D.+ ".1�u���.�'�-�#������]�M�g#���3�����Y���^�4�@_2���*�JD�r��;+��Kj�L�2j���$^ �[�z���;��Kdev ��H�I�|@a���$�\FN`��] �t� ]���ӌ�)�b=4:�?���u G]9���No�>$�Z+-v6�� }G�)�M������B�N���1���h��E�k��վ�hi-4�M�~����`�J{���_��B�P�"����?:���sʇ��;4-@-d���;avq;h�̴J�'^И�H/�H����KB�e�eQ�6HO���.vWH���W(e��B�u�fm��Vv��i#W���uv:t=��,��G_��x�_�>]q@���k4 ���+�t*(H����w+UE����@˂�+��L�%Ӧ�:5��7G��[��'�u�N��Y��ve�ؿ�<������}�6K&nMW��|\�J.����ܪ�P`ܾ!�ݗ������<r���NR�/��;��Vm��f��d{7t�0!�������k�77ZxnW�4̮��g�X�,�������^K�4�����V�S�2��[]pM����f�tbGfr�ћ`��J��^WmP(��k���5)��ׯGN��t;Q0�������,>@%v��@}�͇Q�`�q��&~(o��$������ F/�U��7��(�E}�1���И�:�6��j�c��� ~I���ʱ�yڷ�+ ��zp,^V��.3��.��_@9l�I3�pe\���R+�����M��&�D*p�I\"�J���,V��Iv䞗�`U�D�����}2l���e�a����l+<�٬�����=�Y%�3�T�?$���F�G�Sѳ���yy����~x��L}�%��}��EW��XH�n �-��)����! �߇�Z�6+jX--S�=�ZX�״E��|�7 �"����q�/yɬ���V�m�Y\`_����Q����Cl>��C��/Mȇ�!��oL�%��>��E����
Behavioral task
behavioral1
Sample
17aa656158f55b4fce155f53dbb3cc3469d97824f5ab7ee8a9ffb7070076c3bc.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
17aa656158f55b4fce155f53dbb3cc3469d97824f5ab7ee8a9ffb7070076c3bc.exe
Resource
win10v2004-20230915-en
General
-
Target
17aa656158f55b4fce155f53dbb3cc3469d97824f5ab7ee8a9ffb7070076c3bc
-
Size
3.6MB
-
MD5
bf9c1028795dbd7a0fe7226eeb1a8395
-
SHA1
624286ad11cce5442ccf39edb2154a887948396d
-
SHA256
17aa656158f55b4fce155f53dbb3cc3469d97824f5ab7ee8a9ffb7070076c3bc
-
SHA512
4df480082bcc9a6de6efc01ad05cb2bdd12679c74fc2a1ebc2a0f28dc1444922e7a99812077ec8d0191105648ef8ea6797c2602c25b3b3dac6cf27f00e977944
-
SSDEEP
98304:BIETOr09UQj26bWMKLK2fXQHEM1OceTMzzRMaw2oj:yETOrJQ66bWMSgkM1JCMRMX7j
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 17aa656158f55b4fce155f53dbb3cc3469d97824f5ab7ee8a9ffb7070076c3bc unpack001/out.upx
Files
-
17aa656158f55b4fce155f53dbb3cc3469d97824f5ab7ee8a9ffb7070076c3bc.exe windows:6 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 5.5MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 126KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:6 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 62KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.moe0 Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.moe1 Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 158KB - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ