V͝m�O��FL�Օ�*�r�Al���wʤ�{OT$��9(�#�H�� �#��a��e��(���n����N��J�,��b��o}% ]�"�u�̤,Т�!���2Xo���mU5��!�%n������������UF^��lV��s��U�p��%0l[{��Ø*t����*vt�����"3ϵ1���xӔz/TW��"�4ƀ���\)�B�' �XV�V��{����6 +��E�Հ�݆l$�������\��h��B�w}�1P�6���*�J)��9%;�Mm�h�Pn)�D�M��/�����ӛ�6J)OA�E�4z��&/| �b�f�� ����I��2j�x|xi�����S;o{O��'t5Q��&�U�5��x�^��2B�/�u�Ⱥr�����U��JˉA�q=��G�1�I���UC'� �X�{������)��]z�� �C ��� ��o&!$iY���&�㜧Da��8�0#�]�Q����b�L�(g�����K_iEh0�&���tR6���X"�`�����I^<37�� �Q��@&wtYg �J���<����'�u�p�����+�wa�no<w%R���"�q��]�m'�R�շ�2>�L�����L���X�n|�C�w=C�w�N�֝�I�yZ棤P����J��o�Eߣ��NF^b����H���-��b��6�f��7r�U+���6{��wW��8��0��R�Ê&nc����5_����0�5�(R_h���:�߄��(<zp�\����)�a�f���*������r���[��/a�SX����5p~�=z���I�1�0����r:���1�@O������1�=��DB�gsN���I�N�����Ny�ۻԣq��<�Q�6�*����c�}���I��2���UPҌ���FO�a���C-f^�Ƭ����Y#�,��!�ť��j���@�#�����[}&D���� �f��^�8ar0���v;u�`&Ծ eO�qXa�x�b7SG�� <��F�3�F���p|Q M'N�{1�05��;B>�X2����� ;3�Xh��T���Gqm/\�JK�����i��z#�ݖ��y��f9�e��Kʅ�\�z��������=����qR��S"��S���7 ���N �/7�cvj���|���ؾ�[�P-�~}K��l1~��MmX � �&%2f��h+갸�����7����DVP| �fdPY1��Vˠy�{�C�ԣC�BՔ��M�{)��6����Q4bovC��p�"e#�h�~����&��������H8��F��Ҭ��P\t���O[�|�����O��3u+��8&+jJ�\����7%��܃���Ww���9�j�6�����([тq�E�!T|Urä�S^���qzki�{�2���N�Ė���p-X/�1��#}ơk p��ov5��A�lm��?�D[�]%�n���N ac�.�5�(.�&M�c$���Y�������Y���G7osH���p6��T^[?�����e�U.��|G6W�L�j��i�FcY�^��.4M ���a4�#�E+u� t��dQ��+�X�i����������'<'�����63]�>���jڐG~&�YNB� ���I�JvG2ln�������,�4��(!����Ř*��h�o�dy1k7�?�P��Qk�yx�{���{K��ۖc/^]�s��0�a%AٞZW�`N۲�0#� )!y��#U�08�]�3_��sw�xQ��>1�G��(�o)3��x����[�eĬ%�[�_��5��'�_6�ǃ?���'Dz���,�j;���7���¹��x ?�-e���+7"쭘����3Oܿ�a?�nVk�$�kP�D�����x���-U�K���n~x���1Z]�VP���n�K9e��J-������}�V����=��FG�oj�;����i[4n� z�X������^����t堔e�h��@�]Ķ&/�9:�,o�\^�D�#O�tP'��º���\"�"�3�}�1F|�@���j��^E�o�����䅜��^���NB�j#R=t�Tz� �s`>�� ��:��v�B34�Ĥ1(��M=wmpU�w����]�pjpZm����%~G���r�fg����I"��1I�}n$�0 8D "������2L�¾_ Z�K�:�������C,�K�c`ry�a�>x��Z�Ṇހq�"�iO@f�p��V���WƳ8I90kvΡ�#�0��u�|�;���:�(��@�7UdaW�����ݙ�&:���w� ,9������|�R��i$���e�.[pDb�F�Dn� \�|�����\�q����v�}�Y�0¤?�Ъ�&aŨ�Њ@$��&p�RK������L�[�v2�_ �F<sIz�h� 81��Ka����V��_w�2�E���8�q�z�܄ƺ�lJ�^��"s���a���@6�_g=�o�ǝU�WV+����G�P�6{�o$��=Л�1���JjB>`c��0�ew.b<��8�z����F�2`'��k:�u�>�`�"�IbZ1*l(�#g��=�<&.�X�IN�ۅ������K]#q���D��.#�:�<�r`�� Թ�7�n�x���Z��G����N��&Ez�'�}��9������7>~�f�+ ����������I��*�n���9d����y=\ɘ#�i-�q� /'/ŀ(^�M�=}ٞ��g��x��^��J�[�I��chb%m+�����sI�^X5�@�X|훝/n�����3�ݥi.�%6�]vP������~%B�+2!B}�Ze�__"���l�c�"v��N���2�$����J������K��� C���W�E�U�2���x��(8�+�n���|�JE,��$�2[L���_Z��剀_ũ�ʫ�1���̿��\J���Ι "���ɧYh�ѱ+�.RG��-©^�������{DR?�c�ʺ�y���m��l+=�l%\�8�ܜ��"@/ˑ���cfՇ.y�G�8��xo)�:3d���N���~�r�Zi\a����>�</��1^9(s�:�lҔ�8r��sh�x39o=��T��}r��>N�� �+ŝ��Y�� ����X�0�^�ʽ�8�3:�W��`d꧉>k��;���,�-����%{�t����lG�H� ��M��)_'���.��1K�� (�[�a�k��6����0�w�O�� 3I����;[4M[�1*D$Tӎ�����j�@��E���w]����p������ްǽB@�DǾ��f��륛�Z�̥ ��ԿoƣCO��]b�8��`��e)PA���Ř��9��dOx)��J�\A ,y�� �Fb��L��Ƭ웺���5��@���Q�A��2<FG��J��,&�V��E��.��h�¶�1�����#��aN�!oio��#��ү�뾤#/k��~������.�����u�ΐl�+���;������� ������;���;���tH���B�?)F�Ȓ��城(+>�y]��)�6�"j�
Static task
static1
Behavioral task
behavioral1
Sample
48913cc9e04702480d98c9134e314be9bab4c80ce68567e6737fbdd75d00863c.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
48913cc9e04702480d98c9134e314be9bab4c80ce68567e6737fbdd75d00863c.exe
Resource
win10v2004-20230915-en
General
-
Target
48913cc9e04702480d98c9134e314be9bab4c80ce68567e6737fbdd75d00863c
-
Size
5.5MB
-
MD5
0fc71e0a45e547c0bca63403aecfd2c9
-
SHA1
f4c50ae9776321a52a0ab187a3a3405821f339db
-
SHA256
48913cc9e04702480d98c9134e314be9bab4c80ce68567e6737fbdd75d00863c
-
SHA512
97773784b17a1546654c239007f11eb6fcdb60a8dfbc7dd59168186cda2b9d642fbca064f5bd65419e4cb86214b3f6d3bca9761945b2fccdd6d0a3df3daf69a2
-
SSDEEP
98304:+CwcFSnSAsrR1c3FK2eEnRmPXTuKbzkkqv0lh73WVKGKm5OVTt9VxEFvc5Cx6y:+CwcnAsNxEngPTuKniqh7IKvZQFvc5Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 48913cc9e04702480d98c9134e314be9bab4c80ce68567e6737fbdd75d00863c
Files
-
48913cc9e04702480d98c9134e314be9bab4c80ce68567e6737fbdd75d00863c.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 380KB - Virtual size: 824KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 988KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 32KB - Virtual size: 444KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.3MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma1 Size: 308KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma2 Size: 264KB - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE