���4O����^�҇���A>wnd\;p'㻫��IJG�{�(f���{��5S�=�Ly&���C�L�Z���-��T�������ɜn�Iyn��N�=�S��Z��2�,��`�{G�|A_#�D�0�h>��/�l���+N#*Gb��@v����o������i�x����D��mo<�31��0�:���_S �NF<g��[����$*�֘���Ŋ�����APSY����6ցHVt��w>u�-��9�������}Z�q�ںb#B������x�n�Z$�u��^�I<��0i,�5�˷4�J'������STn�).�aDy^=-j� u�������� {=U'~�+o��Y2Y����w�n��:ՑW�M�й� �1�Oy�;�����������,�`Oj�'F��6Ƅ~��Pȫ�gWP��E� ����y�� ��1K��(���֓/�L���~�p.�:��B�Ho��1}L������Zѣq\o�#�����a&��F���]���X�Ax�?yZ�h�p�u;� �=�r�7��VU����?Ys���GĴ�l�\c�,8�$�{���m����|�|A�Wv���~���=�p��w'�` �������E��aٕ������qJHgp�,�+�57I|~�Ɇ�i��~��y��H�n���B|�z��N��:b�V),���X�����Vڮ\E��kv�I��mVkh�9�����^`��"|�HE`����!p�#=�\�87p��O�r X1�2]HP`�"ѽYXF�WR� ����K-�ūH�q�V� �&A?P�n�$1����0��]dq+��I �߄�׳ J&gb�_8�~���D��Qi4�81tbҥh��ΓH��V�EH�݈�Y��֓���^QAA����]K�vʄ4��i��y�|�Z)oqV�"�o�9����,P+x{a�<i��U��՚�ā�@p=|�(:���^g�h4o���������;S�w`���QH��e~��܋����s~!�����>$�PW�� ��� ����~�ȴ�3�gxP(��[y��.9z*�.��7�왵�}�t��?�2��F�$�#�{���tm1Ye��{}�S���h<tR�0�����A��P"A��~�MW�S��F筻�a�����g#h�jS�R��sMa`Q�������k��p��l��AAlʓP�hUXjR�Z;w� �DD�6y$���&�_�O�/!��+I�:��T- �)��}�?�k����yB�$D��`WY镄��>.�ó{�-������E3���*�Ј�ڜ�~�*�I����)��~�ώ,<Z��i'�Əzֲ`����3��hD��@J��2Mvu+��Đ/�L���V�U ��Er��5��4�L���3�� 8�jy�8���k�B����h�J&�~:��2���O�o�`]��xڒ��)��&븭���9~��Œ��}�p��j������EAv��e���9t��N G�����<H!'i����Ij�l�۵-oUyQ|�i�:�L���*�s\zZJ���l2�ڛ�Nonbf"�H��� �xcv�ѕn���f��-�E�zL��� :l�/�� ��Iqyh�T��˩e��OΗ�'%>�-:Kk%���&9�E b����? \DW�j�F=T���[��=�[<�w��[İ�9�O�m� �ʿ���8��;�q�B��!��%�� ~����� �M�͊B��((�"tp�F��TY���w;mѝ&Cr��$��xظ�>=gRz|)�QZ��-����e{��� ��Ud�&Y��=%Ԁ����N �/�ӽ��Y�MSh I�GIן!��R��h)1�G~}�r�h`f� d�A���! w��.k∌��T�JR|O��c�JCab�$��˜����h��{9����FF��.��ş%uK���';,� �#���m��4�ku��|��Nq6C����R`1�y(u��� F�um����pGJ��"a_�h��)�P�B�M5,�U�"ltg�v�w�j��+rSӶ�e㏽���`}]�w&�@��mD=�H��"��G�*��]���m�����֊�ip��m1!p{��w����SA|�T��yY��qcǍ����Г���"��8���`>ʉ� C�]?N{R#���.�|�GX�����V^zz|e��<:"D�������s����iD�,�l��q5��Qi��ZyS[J}��etyCFI�*S�����1m��%��Z��w�*E>^�c�Qxd�6����&�E]��Ov%�x�l�^�i^^���#�)Y���"h��)� L��^d+E�Z6�"�c���Ai�̞c��]�g��@0^Ym!\�h�uG_��,�l��i��8w����bj���b"%�N���}�-����I�Xv��4�aٌ��%8�d�!���� btE$w['��k�T်�����TZR���� ��y��J�e�p��<�yGַ~7fȵ����d�/���}lo�2;ˍ���5\lg�5�%��I1<����\Q\4{5Q�|D����>b�;nI#�͍x�����^�~X��!K~d~N�C�~+����`E��s�5�+�{���ѭ����^�W�S p�Cq��� ���d���)�{%6_�%�Pg���� ��>�6��P��eul���|������X���ACdY�a�Fź_�����\��G�tH�B��sc���ɠg(Pn����E++����pE���<7Š н�%38Vt!�|\b���CV �>N���A^�,�\�G�d��� ꉾ������<*�r�R��X�{������Z$�t�3Hѣ��\�1sy��0�\e�Ӫ��q��*�z��tj� űfy�}��Q%�Dyqs��XK!�$�_ �3Ƕ��+]�r���B'�5���ƭ�뻬�-*��ѷU�a'��Ƕ�iV'�P��b� ��Rt�����2�z�a�����R:ޓA*k �p<j���M��f�vE!��L��:Lvr�q��XD=�s��R��i/�Щ�X�jP��|n��u�n�6�%V7�^�~Pmfk�R�Q�xBB�-��`�f��}E��f^qw�1D��A��l�j E������1��+�Kb3��oo�oN��D~� ���Zd�O����}at�0���}�ں�]OiyH��Ԭ7/��";ͭN@ru_����f��b}=-)0��w�?��òRB���7C�X`� ѣc�e$#��a`�tR�k RL��������91�9��(�!��.��<-�րv�76��Ŕj�]��<��@ݳ��!��[V�b��!���b�@o�i�"W/�&R�b��9C�ON2n�9���w�(n�*?��4�g�L�Y@����2��[Bd�ȁ]��/>��<E<ס�����Ht�P/w`���}���L
Static task
static1
Behavioral task
behavioral1
Sample
15a2b5b240f1a95efb93348926c7a22588c5b959ed2a547a961a1d37c8048785.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
15a2b5b240f1a95efb93348926c7a22588c5b959ed2a547a961a1d37c8048785.exe
Resource
win10v2004-20230915-en
General
-
Target
15a2b5b240f1a95efb93348926c7a22588c5b959ed2a547a961a1d37c8048785
-
Size
7.4MB
-
MD5
1e83fb629ec775271e4f78895ed56b11
-
SHA1
49a30a80d2ad9f247d5b6d67c603e4bd8d964fb3
-
SHA256
15a2b5b240f1a95efb93348926c7a22588c5b959ed2a547a961a1d37c8048785
-
SHA512
11a4e3999b4f92cebe53e09568a8bf5a15b26e2974cb3550725ba623935753ab410c91ef0a89583a56f160baa378f3c7a3e295e31fc1bcf82371b61cefedd658
-
SSDEEP
196608:8N3PuVYUabl1jM6cd3Q3yiC19zsQ2D8aGNj3YIw20McBB:u32Wbl1jM6cu3yP9YQ2DKVVv03B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 15a2b5b240f1a95efb93348926c7a22588c5b959ed2a547a961a1d37c8048785
Files
-
15a2b5b240f1a95efb93348926c7a22588c5b959ed2a547a961a1d37c8048785.exe windows:6 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 1.1MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.3MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 35KB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 368KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 368KB - Virtual size: 368KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 297KB - Virtual size: 12.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE