V����r�"?{������F��?m�v���.���U%@5:a�ʄ�D��I�+�4u�X}������s���b����l��.��ApO,�l=\�ʵ�8`��kU�λ�e��h��1��^������v�X� E�ں�."$�j��ݕ�����U��Pr�S��Rv M�'���/�%�G��;�������o�J��S��LES.�:�_�YU�p�g֔}ZJ1��%� J��Qڡ�陂Ѳ�(I�������n��e!��� cLbH�D�<�~4���b�0��.2����j?J�;��HBX�!J٪-�Q�q�6 w��ǟjץ�Q.�,T�3�Š@E��� ,�q���6���kBc���Bd*� ��'�/`u��~�w�?�< [�>��q��'A��[�hb�ƣ�G2�]�rj�Z5�Ԗ'�(�u����&gr @�_|/7τ�y���9��ae`(�4���o���>��Eg��@����E#0���F�&�<�q�k �q�ƞ�h|Pa �L?��w^�-����$��x�OW`��'�'�: V�ӃP���.Ň�O�o�.�w�����0��rL�^�4�7i�Z��K}O�1l�pt��Uސ���ev�U��o�"���v�K�@e�){Q�2�tʄ�I !�����e��9����xP������ܑ4Q^k���\��;�� � ����Fh��`g^j(i��δ��\q��ߡ�Nف�/�fc�o���֜��R�"�S �����Uɰ� Ua���9Mh���ߋ<vs�W`9TV�u�Z.���u��������t- ���#SH���N���7=����<�Gߡ��Ue�L�}bq��촶�&�U�o��������--��61Bښ��jO<Ĕ0�Hr�/~����3%����/����`^��?o���y�����5���j���2�ג�"(�I�K3� ��'mE3��j�0S��" `)�����)Z��|2(k�����PgMf�U2�T���nt���{b��0��� W��#����7u���*\�|3�ർ��� �����H���+�T�Ì�s��5ן��2�o|��Ya� k�6���k#�+�K�E؛�9A����%��5��N-TFܣw��F����8�~K��b�b�je]Z��������i����82y�Q��1��Gz���-�Py ���`Q{/���i $�P�^���>c>����&A{���±T}|U;�������wU0|�%A����_ ;@*�1I�|�&�o��7���U|Vn��T�XZ8pX]�����[n�/���.n���m[�F��FbP��t�yտ�N ���nƣ�m��+]��{O�t6$��9�T�kE^�*3��G#<6J�T[E��<��vH������z�P7�=k]q�뷧[bY-�d�C�1أp�� �'w͚�a��< ���rP�����Ӥ`�LH�\)�v�J�/�����M�����k�Aǰ��c�W��/���믰x���J���9v/<&U^/9%|$`��I3N2kK��ɞ����L�N�Į1p�{(9{֎F��%EC1�u+]N���v�;4zӡH��~30�i 3-�z��誋�D�¦���Y�z=�?�|����鼖���Q�%��n���o��b5���r���2�`�����q�&�u�C��"B��.��O���Y�7|5���}�"$���<����2�8�)id,lt�j�À6q-#��Y7��(�ݭ��,��pKݬ��B���k@���-��#�CH�~�E'��/�S����Y����r��z���MR(�-���"ͬ�)����5��.�ԧ��R��W= s%��t Ax�e�f�OL��@������tqeh��8�4%_����Э�������9-�|��֒0k��A��rB�Q^�?]`�3v�u5܋����w`����<��������W}��B�X��*���3���qAi{������R>��µ�1"\. E��~WS�q#�'P��w%���O��ݏ�'��"hdR4���{B}���aq�s����He��i�A��c�@T ��vj��-�婖%8���Ŋ>G����$S��P�_�U���UU�P3r`���ʴk Ae�h���G!�2��g3�xJY�|t<3U���-NP�I�S8�B�u� 9�� �*�obՠ���ڶuF;Wԁl����$��Jw�vY�N��y܉�{A2����|�u�Q�e������)��: �5�?�ͻ��(I(�7��YQ/QK�vT2FGK� �y�c~�Mg��}g[+�KHA���4l�p���Ya+�a�Ψ�@�������k��p��i���W��,eRKC������}�����x�2�`�w��~���۹O#��ȹ-���FW�k����f��e���("��412�E��v�R�ɓ�f��RI�L`�Lu�%2F`b%{)��E�W��;f8�V��$��"g�b��Ѩ�`�=��&��=ޏ��BM�ӦR�����Z|^�B�)�`���.6����y�lx�'.QxR�.�ʖ ���*�D��bA�dD��} �cZ�ജ�������V6��Iۅ(^� /u?A�Y2F�`�����u�R����4�3$桺6����������$��>��6b�_�글 �S7�k�v��DEփ�Ts�����@�z".dQ@\���?c7�|l�z�����q�3eq�O�(O�˟���G>���2wy�^o~ՠ����F Z|k�����i���@���P.�.� ��E�����P�� T�Oud����� c�D(3�`a�V���ɹ���N�ҚN1�Z?��ZD=����z3�D�8�j�8H��d�U��m ����ca�y܁�sU���c�.$�������'���klAf;���R�q.x�r[��hj�����'yk��� �����c��h��$�Z��?��c��u����E\�3ƨ�����S��4!k��i�-~�F���M)�.���B]������Y�j�S�L�*�)H��
Static task
static1
Behavioral task
behavioral1
Sample
173876bf5846b439efcab16f6255bdfca1b47eeb7024fa2bcae973f5efcc01de.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
173876bf5846b439efcab16f6255bdfca1b47eeb7024fa2bcae973f5efcc01de.exe
Resource
win10v2004-20230915-en
General
-
Target
173876bf5846b439efcab16f6255bdfca1b47eeb7024fa2bcae973f5efcc01de
-
Size
9.8MB
-
MD5
43a69fb19a195a9d5d62e5f5297fd4ad
-
SHA1
5b8d90d214b6ef9541d6aa59b236fa044185fbd2
-
SHA256
173876bf5846b439efcab16f6255bdfca1b47eeb7024fa2bcae973f5efcc01de
-
SHA512
590e3a22e950b55cda9ece005100501be1ba86dbd2c1276fad5445efac5f44846248390524966f3da75683d3df2f28bcba98342dff03d6c38541c76574002e5f
-
SSDEEP
196608:MJrMdbNyGxAV3WhpV/eV76zOFrJCb2bxbcmVPfE:AO53hpV/eV7iOFrwiNBVPf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 173876bf5846b439efcab16f6255bdfca1b47eeb7024fa2bcae973f5efcc01de
Files
-
173876bf5846b439efcab16f6255bdfca1b47eeb7024fa2bcae973f5efcc01de.exe windows:5 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 856KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 10.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.}t| Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.SCY Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.AB/ Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.9sd Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.+[$ Size: 9.1MB - Virtual size: 9.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 755KB - Virtual size: 755KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.newimp Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE