(�����ߌ��@�oYQr��\Y�KV �ZL��-�� �Cֳ�Y�����U�����P8Ň/eH�_ ��Bz ��ī�ѧ�JP�':3�9o�Ƅ�U�Ay�ڃ�qډ���Տ��Q��W��J��[�+=� ('�y���< ��sh"���]���l�e�7V9*��I�Y��8qy�A�_���#�B����X�^�W�>�̛��6�,�s 8y�k�uq���;��lx܊tC�i�#�좄��$J��ρ����u�q��*�@!�3����T̬��:x��Yޯa��P���,7�Z��[ �ҕ:���E������5yi��9���t��E�Q�>��$�r-4�>-s�}U�@��w3�}�R[yכ洰���(���9�P�mw�'�]���H�$e��� ��v�� ��Ʋ��Xùc�Ly��6�50�'Ũ4v>O�c#[m@��Ϯ��\o��L�C�T�����ℕ_�v�ð��UIo�~l����Ō/%^a�r> ��a�y��|^�[���V���.����)w��Eʠs�;�� Q�Uan��3��b_�3�,*�CyU͜�.�h�%ڨL�>�Fގ����k�[�����%֚�Ĕ������">J�ex=��\pn��B_זJ*�E��������Xr�כOw��-DdJK��[3��T�=Dw@͈$�$O����[wK� l��z�V�G��{�������˦�K���f�ۑ�A�2�Q�.Xq����l�)"��h�If]`Q,�`�QMU�� �A�⿲��2��[�3T�¸tXC�� �w|[o��ihz���VG�����2[A%�RŕA���Ҧ{�!=�ҭЃ��J�k~=:;Մ$�|%}�Ϥ�[j9T�[)'���S9�RYu �v7�YcB�?�x�����<�����4:�7�������l��'ˈe�L��X�Mr�5rkS�;%�����Dq�������:}��YTR�P��� �,D�5�o+��Ar�I=�@��c��M����-�����M��];�K(�C�ut����'��3T�o�W+��l�~�:Įo�C�KD~zf�KT�i �We*(�]�G��L��A�=X�Ɣ���G��5�=��H��p#~'���H �*gQ`Գ!o�8�)'�J�����G�4� ��Q�R�u6�5{�[Ꟑ��P��~�8��Қ0�^���B�V�����h* �u��Mv<Y������qoNq|*J��w=hzj,�;�gS0܂�cI����������!-��9�A=�\�ݿ��Sv"�K�R?��R����u� +�UE�By��!/k�A�;��i�+j��{ȈF���i2� ��;����͎�����{����2g684i�9�,�,b�y�|���@���́-�n�BCj�v ���3�@p��%�JV���E���Iđ����o&˧o����ʗ�����A�TҒ+s\�����j��Gs��}�Q����mQ����p�K���Ou�[7t ���r^��p��M�o�@��b?S�8��[:`j���âV�M��^zJ9�g(bw��L� �@-�Ư��e�O�c��O��L��I?�E�i�/�b.��B������A<�U:�`�� ���3���+5�l�0Bܲ��I������u�H�s�L���~Y$k���jh�\���le�/����y%5�.��j� p�i?����a WP�Z���/�*uѿ/|��V��6��INɁW%"�> !~� ��6.>GNb;}(��wW�m��t��Ysk��爣�C$Bm�����E���<�;�i2*H�#�m˒% (���#�3�+�O�;��&����+4��ݓ�:ߗVŌ�3���Ѐ:�1�kz$|s��pD"2���ϼ��`��a�d*���� ��0:�頞GJݗ6�_�� �!�C0w ����3�OҋgйM@��� D��)"��Y�f ����+M.(m��LxTz}���Dx�c'��r�o�����A��zE(4&���~���S�b�"ȧ�9��A�NtSg�~_%��z}�ߺe1D9��I���md\/;Zd�֛e,mF�]�����K�&ԟU�c�t\9�QY[����hR=B����"�ſ���Y��c���������Z���ف��'?)7Pf��ߟ#K.Հ#��Xw�$����$D�1t?�fȤ)�k��04Z����_^h�Sn���F��-I�tg���C��C>��܀�K�P|~)�&�qNJ�ؐ� <��T[������C['�1E�� .-���y��##�R�,X̢h��}wɒ�p,�?_�ܢp`� ��B?�T$w^��-��.G����# D�p�R����c�hA�WPʼn1; �=��K�n���ku���f��0��T�gh�BĿM;����K����{��V�T/-BJ�4N">U~8���f��p�h=%i�����B�ݮQ��?.���;/�#�C����/��\\��~X���cA��Fz��B��6v�h�n��ћ* ���R�����o(�O������c� i�����e `C�t�|�C��X�w] �Q?��74H%wy\�#���8̸�w��� �A�/@�~`b�YD�o6N��^�XKV��dg����fd�-��oZ�h����* 6���?����d8��b�_g�]�>W�<L�U�Z�x�v�ˌ����El1jޏ�՝$��$���B���T� �|h�d�3J������j��k�Hb���61�o�E<�j@�1�,ph�z�K�=��k[�EZ�1����$>�ʜY�*�\H�����r�'0ڗ�"v�}������7�⨯�`N~��5�hX �Q���9��A�:��+�L���7���|�6���<��e�������T9���� 4�,�����AMe~aCɨ\���hQ*�P�hy�R臁ڈm 3��1�Im�+%y_*z�*��8��J�6S�!@eғ~I٧ M (\�x}f��_4��#�_?^����Q�`�{�;��H�bq��q�PO�t�w���M��#;��0�fkuIL�(jٵ!� ֆ���0y,a0�$���� +��y��S����WDd<l�dU�ś'�Ggtۖ +5�|�5���x��͢�8¦�JS�sxc{º��$������t���o��6�ul=K���.����l��
Static task
static1
Behavioral task
behavioral1
Sample
a6be57b391af2f9b3e986891ae118e8593ab3e6485424c5f8a050b388b780ed9.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
a6be57b391af2f9b3e986891ae118e8593ab3e6485424c5f8a050b388b780ed9.exe
Resource
win10v2004-20230915-en
General
-
Target
a6be57b391af2f9b3e986891ae118e8593ab3e6485424c5f8a050b388b780ed9
-
Size
5.6MB
-
MD5
726be7f60dcb38fe7d7dcf7356f35dcf
-
SHA1
8808ea2d5315248a9869705920616d8649d3faa6
-
SHA256
a6be57b391af2f9b3e986891ae118e8593ab3e6485424c5f8a050b388b780ed9
-
SHA512
99678cb09079298739c7300fffe0c7626bd247bafb5d1916b281db6363bde58a3ccf54c0266c54bf24821ba01964cb183086d6f3a057d9c5f37c2d0936bd667f
-
SSDEEP
98304:Hz5VQKxkiws6mmovpdsc+rmC3lsNYQlBoprTPHBBg9aYy+LGMC2:HlVQKCigov4c+rhVs9oRPBcaD+LGI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a6be57b391af2f9b3e986891ae118e8593ab3e6485424c5f8a050b388b780ed9
Files
-
a6be57b391af2f9b3e986891ae118e8593ab3e6485424c5f8a050b388b780ed9.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 380KB - Virtual size: 828KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 988KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 32KB - Virtual size: 444KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma1 Size: 308KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma2 Size: 264KB - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE