�������}}O�"&�K�/��-�t�1�-ӿ �n��EH~�|�\ؘ�0� �^����\i�X�HDla�\�z���eY��i�.��26�hF����w$�S� $/��7�ʌ�U!����X����L�2WK���.@]G��@�����[aE^�lf:��>��4\V�D?(�N#��9�`������@�PTǐ�'�Ӝ��}����9.uN�Vl�`���G�z�#���4v� �.#�}����:[8��%Rm�b��] ��Q��+��{.������ 9�E�7�!��3I�\��;�̰�Ձ�h:6���k���sUZ���EƘ�?uÐ�7����4YmM�w�����[e<��c��r���Q�~�%�7�r����݇�Xkvs�],amՇ�6�;���#|h͠Z� bHHȰ�p��lt�C��8�^ �G���B"���Ŭ�R����ZW��)��[�&.��Zx��r ��E�k'�y���,�=?�s���Aa���yw=��a�1y4ȕ�:�F��y��7,�[b�x��K�/�-���~:�rD9����OźCl^л*��_/n7T�N�%Qf�T��"�%�8���'0ƿnn�Ɣ�qf��x$eš���/�E��I���dH��f�.D+���R~�9���p���Z�`���[��(��ߐ7Dݼ B`�����F�q��\Eؖ�A���������yG_�H%���͜V�Q�!�&Ց�9��Â�,�P��O����h���㧕��TMSԟu�P�%��} �R6�|M䶑�#��Q.��� ��Ď�yno�zH$l?�H72���>��<�DpM��s�ا����� -f��] k0��n�>��m�6�C���� ���0ŵ�_S�[YD?0�%��R�m�m|-�Ɇ'�騴��NSrݐ{@�\S��Im��~#-Z(`�U��z �����͆T�'J��&�ٶ7�g���J�Lsj�� Ds�2�6��1�<n5g�M� f�����v�O�'PW ق�e$~��Lb���펻���]N�j�|5�2}Ϡ����qq�w��+.�Kդ���U��~��^?.�ׅ�K%��B��[�G��5O�u9���j���X�c�"}�G�Np�����~�M�a �: \bT��y�,}������$��I3o#��X(�J�sI3 ߞ��,Tl���L�9ܿw�V[B|]�F�h^/g/������.��a�����c\�����>.j��@��ѹ�/O�q���'��Z"_���gK�K>���iL@-2�(E:���[mM\%ؤ�TA�x|�m�>CO�n���k��@a��*I�|6[4������Kb�6�� 1�Q=K�<��"WT1x�>�h��'䔘�?pZ�e`�;���byZ��W�KQ�.�"�`�-���w�Z�8��K��v;�7�I'#v�k�yЉC�c�M{��Z9m��J#���-��D�[4q��s3'�dA�8����1�L�l��I��Ns��,*w|`�v�i�����������G������BΤL���I��V�W.;a4r�,eFqf��Ńɻg:��H1>���V/����6���Ѱ�Kd�� XiZ[W�*�2�`��ӾsJ���=�� M�F���l��*����E��}�3�MRn�z�kS�vf�I����MP��t�Jj��g� 8+X܈~�2$��=��fh.H~������w`������|���x�$n�蟕�][��Pd!��rϜ�~ޏ�tF��X�؊��U����\DF���� �WZ��w}����^���HW�mOǒ-�)��|fn$%<d2dd\���*I�$����+?G���_���*���·���xFb�f/d,$(�:��^+��Um%���v�ba��A@`�5Jf0�t��K��)!?_��-J��uE�ܒ������d��lLgg� ���� ��P�Cڽz0+m�W����]]�T�'���F��Ѫ�fH:��������A<�X��88���A� ,�d��3i�歭�nG��-� ��\(���rj}5�Qi=���$��M�b%S�3eQ �6dn�=�Js�� �U~Y��Ft2�ޝ+��m,��(�Cc#y�f��a#����0�da��w{�y����Z �KD���l�v��dг����^���|� ��l��@ 1WٺD�0D����Ʃ@`�/�{�����[���/k1��_m\����j�=����'�Lj Q���!{R��+��J4�Ŗ�@?3���r��U�%v�N��:z�A�ŗ��� �O��������Ɩ�Z��N�[e� NJ�x�K�'�JNG���;=B��f)$Ub� x�E�j�nȧ��s=3�a���l�b�&� '^=3w�9��@�C�h�*��.@��T��O;�{m��em3�+<�$�n������ɏ������3�c�,�oQ��;���.23Qx����]�E��� �����J��ːxS��z'!1�;uN�%��>�&�K���0�s�.�Kg��W�S �Ȥ�*T���V��/4�+���d�3B��������g�k]�A�Jg-���(U&��Ҳ�"F���R\�WM�jithB_`�}� �J���>�%t3߇�f:��\��g�����n�w �}z�N�ۼ�Y����w\�fH Ƶ6��$��6�hp�����=��>Aʰ�jX$�!�W����A�N��K�n_?%��w^����^�z/����z�a��;H��w5����&�x�>�Ho-8rq��+�lI�� ^�`H*�闁�����Q��;ɞA����`�Z2dp�(����� �A0�{b�N�]w�G���T�sڣ4SH���"�Nb�-_���X< 6.Z=�{�я��a�A(��cS;w�*�R�5�Q�Ս�����:︺�5�����B�����N������1 ���B̮��� >��Dc{?�"j7H?�mm�9#)��״U�e������3��"'����I���yK` ��G�?��{?�O/b��Q�vUf]��3�ôF#H �z\�%�������hl��qشfOlO��#�PҰU�WwX��a��|���TZ+�i��W�5o���
Static task
static1
Behavioral task
behavioral1
Sample
5ff651e93089b49e66cf21c04f60a9bc11e169fed3eba635c9cc8bc4f47c4b3b.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
5ff651e93089b49e66cf21c04f60a9bc11e169fed3eba635c9cc8bc4f47c4b3b.exe
Resource
win10v2004-20230915-en
General
-
Target
5ff651e93089b49e66cf21c04f60a9bc11e169fed3eba635c9cc8bc4f47c4b3b
-
Size
5.5MB
-
MD5
90d0ae8d89559ea3cc3918eb9c8f900d
-
SHA1
f4fce4536051aa647292ebe2e8c2e7a3b4bf4829
-
SHA256
5ff651e93089b49e66cf21c04f60a9bc11e169fed3eba635c9cc8bc4f47c4b3b
-
SHA512
bcadf6a21e6ac85d9f9990355b8ab1fe42c142c90a9d5706b821881779c867bffbc0a30d03a086177c4b667a7c50562b49c612441aa45719cc8cfde026a51206
-
SSDEEP
98304:eDFuC48gdEmtgJfSdCd2gUzglDuzEBDE3zNKdfcYJOPWqW7zmZTmGXw:P8gdLts6dCggUaDuz8A3zQRYPWqW/8Ng
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ff651e93089b49e66cf21c04f60a9bc11e169fed3eba635c9cc8bc4f47c4b3b
Files
-
5ff651e93089b49e66cf21c04f60a9bc11e169fed3eba635c9cc8bc4f47c4b3b.exe windows:5 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 787KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 383KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.???0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.???1 Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 96KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.enigma1 Size: 740KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma2 Size: 284KB - Virtual size: 284KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE