����o��b�.{轋��&�g�wZ�Ԑ܄������+vϴ���4A{� �����e��n�����K� z`�2��;㹴+�G�uil��W��Ef�ҽ@��䆌pmzj�+h�gG��#D���3���7ﺠ5�/����M�w��R��&��u�P^k�K�^�f����"kC�� 2M��ܗL6x4��)ȵS^�/&��yh"E��P���`�>�;��"g�O��p�}7G��Z��w\�KI�W�. ��z�V�s^u�wt;��X+���~d{�����*ҹ��i�"j�gE���O�؟k���c���ڢb��\� �M|��WLa�!YBթi�6`h''�C���&ޱJ9�d�ڦ �v/([�c�wa�3c^�|_~�An|/���fB}�:��M�B�&���Lq7�5PB�od6ke��<��Ms���������<|�7�����y<3?j�8�����-;=���7>�� ->���B�XߒG���Ñ�Z���@�m�hp]��,!�5��O�a��/l�"u�T��s]�l�J)�j�v� ]�a�9r8���d�I�����YQn�^U8"5�m��6��m��j\�qs��d�~��g7��R��v_h�����u]��z_�}�|��:x��R����oih��� ������i��`2w����:�c�����!���Ԙ�� L�IP�����Ǜ�������j�Q��k·��DVHK����)$!VgK������qN���D�:Ъ\����k����k�bl�(�^�c��B�V��K��J�����aL��y��� ��BD��E���p�����l0a��&��5�\}l�C�����P�RXH�������>�d(��ص4Ʃ��9�����[�5�y{v�L͔vt�!�;�r�Q����ܶuަY���������ZՊa����do3j>j�ӸX�Ђ(��~�蝬�3�����#��DU�DZ!$:��1�� ��[����i)���D_E}2 ����c�)�M���mzI�����(�q�Ǟti�HÆ�������{�yj����b���" %W�����=��u��N[`��(�a� ;��_�6_����}�ۊ���������k����/�������N��B��C� ��o՜�ԍK��UI �gQJ����b��6�G�����)WF��Oc���%K&�sѣ�'�Y�a�����R:��|��B�8%�</Ȍ��|8wȸ.�ZՍӱ��[��Gb��<��|f�(���T6ܧ�$��/�D<�(_��Z�2LІ�s�]��M�����i�7yF�I��EU�)�����I;Wע� ��L\� ��\{3;��ѽ�*?9��O�ɋ�j0��D�rצ��E�2�b*�1-1n$�;�a6zo+Yb<a���;oW�][ā����ϕ�=Y\4Kh.�tk,ʖ��ީ9,!��� pcN�/�jؠ� |<�P����� ���cǺ��e�"�;�]��UT7�md���ʰ�ũ>��'4@�M�R�+��L�9\����^í�hDsj�������\ �8�}�f�}?�� {9ndM³�*�>�M��3Zt�Dž���:�4R�L䙌�|�RuG M�d���"[`C,�����d��y�/_��*��R<e�ir����§)k��#�� � �Km��D��""u]Q�h�9��{L��'���%v���f�CA&�E�I�����'�����(��>d�|�-���M��|����������Z���4�"�\v�0��צI���1�,����;-w���Xr�0��Ĩ�)�����8��T6����%�t/[��}���2��<��wH?�w�pdu�R����ET,X%$ 67����q�/��V��$�?��E����6G�}�|�Dˤ$��ymY��-�Yj0=��Av��9��HȎAaZ��^D38 �3DZ /��X�a%C�5���I����ǣ�8嶱���F}���^5�rY/�Fᶬꐉ�Ӟ;"N��z*��Uݝ�Vtw���ځ�@ڨF�hf��fu�YK�Vk��� G���z_.|��8� q�{�������BPҀ�*u�!_^���l.徘��o�'Gn�k���^^ұy����]-�-�A\�xU|M�W�U�Ql����dU�?����Z?!�e��?���a��-�&hҐ�F���ct倅��9�*7ĸ��m㎞�u�yR� /ѻ��3*�����ޓ�fW�@wT��R`���l��>���yX���C��e�v]*�7p������o��ӧ0^��ʔ?7�g�j<����'�g���a!Y1�a�|�M��U����D��ԟN �l�?��R���E����f�[2e�s��ߍ�H�kw�<��ھ�����a��A��F?��s�@wVYAa`h�@&i���h ����|��'F���}Q>�#\L�`U�W;�SPu;��w*V����a���ע�J�RW�\�vf��|�I���yQ]�B�x8�2��.O�3���S�^��7������MF�Qm�3Y_YIVe]���Α�n^��.��c Rǔi��Q5�h��4Y�H�06|H�y^c��jrm�9s�S����v��F����Rѽ�r��S�Z��L����s�[ۼ��8��X(s��{Xt2���M��=�(���ٱ��Xa����L.�:�=_� �(�a8+'�J�<��1RS�!>5��Iҳ@x��`�i����-���2!h�Y�"l^�,��fo���Uԑ�с[BǞP�eȊ c��'.pJLesVD��Y�8 ��Tv�_�2�*�K[������l����V #�3.6���1��~`�8�3���!�Xe���;.Z:��0!?�B8�nc��ؓh�k g���۶j�m�j�x��2&j��4{6aC��bﺎ�Q�h%�,l?��鿼��as��o�x;��guD?� 1������� ��R&�G�q-��*e���^UE��I ����]B�_D�� ��-�>]�H^f�7kLTD�QW�o[��������}E1F�Dț��R�"}ٍ��/��b��s�Ì������f��W�����7�7�sy}��q(gu<�PsN$�_lM�^��Ӥ���H�IR�mj��_ɉ��2[�nl&�w��82,D&��։�]�1F3��b5�w����c�rQ�����Pb�S��y��^�ϥ��س���W5��*`��Rۏ5Wrl p��� ��#�>�$�9�����Ԯ���Q$�O�6DŽ,t��З r�UlU�}��&�ǟ�VO����I�~u��������um��F���@��YX%O��Y$�z}��[��ꯒ���J���7Y��<�����c��12��N�������c�e�F(�w�Zr�S��� A��MkA��q�?��low>��9�!5$��@g�N�6���㿃]�L�U�Є�!'�N����]k��I�]i��f)�� ����[����8�|+������WD�4z^b��!4�N�y�`�x��տ�݆ zғ�a�������s�fn��K��"B6:��R��[Q�\?
Static task
static1
Behavioral task
behavioral1
Sample
854b417e9b0a593e15fa7d61dfba9a61f4bf36ecf1ce3684d98a947a131e8563.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
854b417e9b0a593e15fa7d61dfba9a61f4bf36ecf1ce3684d98a947a131e8563.exe
Resource
win10v2004-20230915-en
General
-
Target
854b417e9b0a593e15fa7d61dfba9a61f4bf36ecf1ce3684d98a947a131e8563
-
Size
2.7MB
-
MD5
27c15fd1a41021b51d32caa2dce8d38c
-
SHA1
3e4ce2d9c21f76794e0ccac1ae4d156140f77801
-
SHA256
854b417e9b0a593e15fa7d61dfba9a61f4bf36ecf1ce3684d98a947a131e8563
-
SHA512
017cfbf933a0606fa124eb55f599e963add29ccf7efd81cdbd719d9e32020e98ef5fbf4a8d07a56780b1b2692a8e8206b7c586e2eb88fe68b6d6236377f68aa9
-
SSDEEP
49152:jEw3Kj0tZZC9F0eGAEkAzI74u7LVqtjJJws01G/G:APEs9F5AzIMu7LVqtJCVc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 854b417e9b0a593e15fa7d61dfba9a61f4bf36ecf1ce3684d98a947a131e8563
Files
-
854b417e9b0a593e15fa7d61dfba9a61f4bf36ecf1ce3684d98a947a131e8563.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 292KB - Virtual size: 580KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 32KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE