�<(���a"��i��'�l��f-��Zw��{�j�M�q��.7CCj]ka+X�c��/'dp N�P�I�k5�TM����� ��K����bm)��_� !�� Ԅ�f`L2�R��:��v��t��aG(��~ ����K���"��5A���"��P���m:�%��xB���%���ed�D4xFX2씅?V� K}t��[�ӌn$;j�^�T.Z�xm��J��v�[ɹ�>��*��C?���4�4�X�i�����n��A�����S<���������)�"́�^ �������~R��j����=y���=��r���*j�9Tg|�0N��?���o(`�V H����M�.��>���{���V7�I@�\����A��ҧ������d.9��A*�99�����KgcK����mO��� Q�����9L<o-��|��N�)������Lc���7F�:�����)1�;���<hq��N��N"��ya �[�\�<@��7���DvaG�<-�G�/R���#�OD�]֬g�@V����>b��Ee�y�O�V��XZ;lnQ����'Ett�����I��ӄ���߲�z�:^eEiIp2]��9�`���i��7e:nz�(�3��z�r��\H^����S�^p{YaE�/e��ޝ�- �)��l;��JE�!�˒ �cGw7r���<�a�&s|&*�uso��:t�#Q��U���P���AD�]�$���1\�����^���+��u�=H��2w1Q�7~#6q�0I�i`���0nG��m������N �-�3��鉞[�&Rϑ�����-�5zZ�ҩ��2��'�i�s�V�0���&Ry�J�5�|<>�IӲ�넭MN!ވ�kv� �w�4^Eo���3��2|���;C$��rÁ�lp�x����;=y������uV�Ǧ���G@t��pJ�8� 7�����q<�6 q���*-�-��Xٌb��H,y̫���e3@H\��UM5��J�r��'��C9�m�� �V�T� /�^�w������^�<(c��BNf�y#�#��E������]��=�?<a鎱J���:�"�n����� �"���Q͜��`g�0��@g%"���Bv>���Þ � �����&�M|@��F Xʓ��vJ��+�h����T��d8�TE=%��� �(1g���� \^�<�Z'�A���� ��C��==�3Gq}/�ٌ��b��ި����{�7�����҈����8*��f��A��iSv������c6�@���&@(n}H�M�n� Ӹ��{�U��߲ }�h��'gae"�!���{��>��B��Z�|r��H�(Ҭ4I4$L6,5)�*�.�Gcrz��"Xg��jrfQ�_� �����v���cg�%t�U��N���39�d>�J�J�<�>�{g�D��.Pc@ǖ�"M�4Ո�W2`��Q���ãJ�����|R��L��F<�ϰ�����O�@*�߸FcP>��'�L�1v�ʟ���x�ӯ4�DV�#��7�*��<M��C�؝��}��� $VO#�I lǯ@�y���h���7 F���������w�����P������ �'�g�kj�ŸS����x������}U-o�MM�� ��eܞ:%F݄��)���������촞F[]HiKa]�$BV�S��-�<v��;E�� �ۗm���϶����M�b:� ȏ A���x����S���7D��G�x�J0U!��|\_V�mo�� V�C� ��[���&��"���{o&l�%nu�����{�17�Ûs���@��� ��_�[,��S�pV�U�ty�91�r�cX�1^cu��wd֖�� .�P��y��|��D�d��Thm�����҅��:������<2-t���\檒��rsG�}\�0���ک���-���"��'�]����.ɭ���v��:�^����`VCc�M�>H���nn�QtL��',d���'�'����tf@����ƫB_#�� ����i6����=�ƌM���v/�l�!a0]�������ʏ�nVc o�K/2�ϟ��ׂxE��ƀ��~o�6�6�K�?\�ۨ�{��@�w�B^1��1�\� ��K�L=��Ũ7�ީq�w��BM5��=�d�Q��80!�|$��㿠߯���Ns�G�*����6q✆ �8<�*�-"�i�ɵ��#b��!�� �����t�TWF��2� >�Z:���Q�^��m���)��s!�ރ�<�� �gP�P��$�� �6 bޤ8����S�Z�6��u���-�91�S���H�Ae��/i�Z.}*��5��)m��\�������U�qx��\$zp�|Ð��/�+wج���McTV��g�`�0���>��>�(b�,�G9�����u��B�8����˔)� C�����%i�%y�&/��{Ͱ���i>�D]�V�}iX-�"�99�5�g�'��/�a�gO��hv �,���[{ZԼ�� ��h���o��'�g�TH�hy]�;J���Jep;~�(���尦(ȍ��#���&ҋ%Z:�e��J� eF>���Ӵdv,]1 8yP�7ç��T�i�~O��]���D�Z�� W�L��N��۸H�\/(^)Qӆ�*0Fq���ƚ��m��4.���}86D�+�3>��6�Zk�4�_l0|���EN���7=��J��T6�_.��q��pu��щq����;��TViQ����X��4�����T����y_Ap��?y4� �"M4��;��>���8�֥�����0ۀo��Λ�����BY��'���H�A!2�2���1q�.�|�,2�*�xn/��n�O����ܭ���il�]I��=�#V���\F���C.���>����(Ip����Y�ށ�U���z:Kj�@�j N,�(��͍������4��Λ� א��OR�Âfav[�F��5 ��oy�҂�K��2$�5�/�uz���mOk?s=��è"�C�xmp�ǣȮ���B����t$�b'��:>����i2��P� q�L^0Z��l����t���HR��Y���q�^&=���iK�k�HǛ&'�]���NO��H��|�?��3��hZ��"�� C��#j�O!J�{�] �t�VS�p������V1Ŵ�]�F��Zx���!�(���Hj���⛿!v�������� (# 9G���ߣu��F� b���w��s�w� �)t]AI�
Static task
static1
Behavioral task
behavioral1
Sample
f07c506836420d6e99d37dc6c101ff7c3bc49002293f78dfd7c858ccbd862eec.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
f07c506836420d6e99d37dc6c101ff7c3bc49002293f78dfd7c858ccbd862eec.exe
Resource
win10v2004-20231023-en
General
-
Target
f07c506836420d6e99d37dc6c101ff7c3bc49002293f78dfd7c858ccbd862eec
-
Size
4.1MB
-
MD5
115f11e0b50c87d5b52882f4f2346b4b
-
SHA1
8a6954b69e34dece83c5d42f010af15b8ff4c7fe
-
SHA256
f07c506836420d6e99d37dc6c101ff7c3bc49002293f78dfd7c858ccbd862eec
-
SHA512
d619415947837a5f3d126abed4976c19c8a79aec273fd302d38299fa0d2055007fc7cc6f365aa8d7f55410f4c8006bb37ae580f43c51a9a2126114947127dcbf
-
SSDEEP
98304:LkNft/SNR5j8OrRT+/p/R6LhC22Kl8Qq5oQdYadTjPq7O9OG:LkN1GoYy/p/R6Mkl4mQdBdTmO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f07c506836420d6e99d37dc6c101ff7c3bc49002293f78dfd7c858ccbd862eec
Files
-
f07c506836420d6e99d37dc6c101ff7c3bc49002293f78dfd7c858ccbd862eec.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.9MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 39KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cert Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE