��:0�#��Ӑ���Nk&B�M�ŢGA{z�S��{��L�]`������`FT#��@T���y�z�>�6��m��bj�ݼ���m�.�峿v_�X��d���Il�;J�*yD���Kf8c/H;�J�Ƅo�:�U�?t��K�j�N�#a��9�x�\�6Ӯ]��F%al\-T�2L�]��d��v�/E���]�)�V%�?��-�5��?�����,����������B�P�Z�^�훻׃1�� ���?�daw.'G�Z���d`]���*���Õ�9���p!ų�\�8X�߉���'H��6&i����H�=�ニ�#��B�V�����V�G8)���k�F�W���c=r7�JeEL����w:"��N,�T\;�]�zmD"U7[(�g!�y�6VO@S����oۖtـ5�tgZ�$%8ҙ�ֺj�����I��T�o[���M}�녶r���^�̨pbu� s��;��.R�WwY�Il��y����2��cr�H�,�f�[_'cK3�>��0�6�{80Z�_6�Z��z,�S�mQ�T�W����r����KE�3�8��J�o��v8;#Q����H]$.�懦wC|������CT���,���0����I3x�~�a����0=4?9���? 5$<Eqj����P����������ixb+����������-v��(�_��'���� ��Pl;1r�40�n�Y����ň��0?y�N���8�Er�)�����#P��"� ��\|ޯ���6� �8P> xy�,Y�}�ߋ��0*v�%3�4�O<1�0�7[F�bE26�P)v?ˣo�k!$v�Ɂ��6�5��"t��*���y�)��C�o� ���Z�Tl� �k7��ȗ��V;�N�tF������n�X�|;�(n�V�7�)S#�0a��\n�&�:���!��MA�JE�w�S��6�F����s�����!�9N��s��#{��n0Z�S�QTϕ��=QҌ�u�'s�W熝���ꛨ|Ȋ:tN#7�/� g�����M7���� ���f�<�7F��J��f��Ӫ/Ri��];��k�r?,d�"�0��Cl��<;��Z�Kzx��G�l1�ݏ�p������1�ЩղRå����J�M�&!���LS���f�DVC���[�H�4?ІP���V���vi������2�&�W�,��N5�A����B7�$���PY�xPb���s�o� f^�!k���&�Q��Z���b �F��ƀ(r��l�!KU��}H-yis�*/�]=G ��i �{CQ����k-�����@�M��(Z N���E�o�1�l��j[_p��j"<��R��/'-�#���;��D��mB�f�Y��:� by�-tz�L+Ѫn�^���r処�t�����Af\r�moXa��-?!��j�B��.,ϐ F������{]֊��@��Uz� |Q�\�Kv�D��̅���ڹ����0�6@�HY����\�rf(�c���`DQ�vާ�p���$Է����� ���]"�M�y�z%q5�<q�֫hN�S!�U��M������B��P�,��D;Vժ�\�U�_k��:|���*�q�1t����}j�K*#������r��q:�!S�s�I`!�})��]�����ѭ�R�B��Y�(�_Rk�?X�8i�.��=7���UJ�`z�끀Z�S�4�н�G|��M�5G4=^��$���Ǖ���(eװ��2��d��f�)]��Ա��u��<����^4��n]ƤW��@�-Tz��uu`�In�O���l_�E#FO�u�͏v������}�T��}��غw����+l�vj�7��FX�5�/fd�a\��d\�{]�@b��O���T�+���ŕ�ў>˃���|#W�3�j~�| �b�4�e� ���*?���wB�nn-�< I&i�����̎30����� ������E~MxG���\ �cOꋟ����91�;�3Zߝ �X5�f�73z�Nf�ݔ�N�[�=E��=N� v��d�Y��ɌWH�,�*�-fNչ������)K��]��0�X��6�E�j��EL�k����ڢa��6��,泾�����X� � ��O��_��a�8td?�)b5�����"��&L�j�g�0���l�� (��Kb>L�f� .L���N����#O���q����-۶��+���A�JPR �����M?�-�����a��2_�&�҇1K|��I�5@5��oc�b�UE'�ϩbc��Yƭ��T�*[ɇq �ت�b�D���[\�R|w>������"��od��K�l@]�j��Yn���<'��(&��#s�bp�x)%Kj�v�f�jN� P��=NGn�߿��2�$!*FY�M�iV5?��Q-yzp7K��lm��ww� ��J~�t��s��!��+&)'A��*���,%�`���N,��ÇT26ԋ��q���a�/"��@�0�$㇠���Ys�țAaG"�&����6������f�˵�i���a�v�ǣQ���W�N��c�}W�9ڸ��Ӟ*a>�S� ����q���-ΩR����V�O'�'����g��N�qp���VTإH����D���$�ٟ^J����[]|�~�v�wz�2�٧������_������RL1�bM�v�}�"K��D���\�(�j3S��*�ݮw�\����&Q���B^?���|�~!3~�8-�O��0"��;+ �vٗ\�I��&��� �[P���x������yxrB������:�% �?/�˧�`ei���W`�����>����[�L����z���_��=\��?�d2F�;�N�ϭ�M��PG�֗��v��Z��S�a����͉��$͌�eh�f�G��AC���x�"��Lu�E����H/�R=IJDw��6�#���W�_ll��a�9g��3`'`�J4�_j;�b�M��ڀݻ�9V�.��?�&�Ye�A6ک7#���r� d���t�[�T��?df�/�g��l1��Xv6'���L�t�G�#�K�b��8�U����Ed���<�3�����.(��z���
Static task
static1
Behavioral task
behavioral1
Sample
271e48a30dd107527fa4e108c614acdd1e66d51014e16a1d9019329deb38a7ee.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
271e48a30dd107527fa4e108c614acdd1e66d51014e16a1d9019329deb38a7ee.exe
Resource
win10v2004-20231020-en
General
-
Target
271e48a30dd107527fa4e108c614acdd1e66d51014e16a1d9019329deb38a7ee
-
Size
6.6MB
-
MD5
9d30810fd0784da03009de5df8f569e9
-
SHA1
d955f683a8e2a75675f969bc4dd22017e49a3e97
-
SHA256
271e48a30dd107527fa4e108c614acdd1e66d51014e16a1d9019329deb38a7ee
-
SHA512
24b137e4f62d2a345305788e9000de9fd294e5149d0f003cabe76d4d0baf221caacb07dd8b48f4c1036d17dea82aea32f2b6e4c5a9c70e7e47cfdf86250cdc88
-
SSDEEP
98304:0MKnUn916dVfc1TUa1xWBdFKpwL8/HRMNZnhhAl3dYr:TsW916d8Ya1kBdFKKL8/HIHcq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 271e48a30dd107527fa4e108c614acdd1e66d51014e16a1d9019329deb38a7ee
Files
-
271e48a30dd107527fa4e108c614acdd1e66d51014e16a1d9019329deb38a7ee.exe windows:5 windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
CODE Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 84KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 85KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 130KB - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 944B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
linholer Size: 615KB - Virtual size: 616KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
linholer Size: 876KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
linholer Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ