�_.�X�-�˩%k���AE�ϡ2�����$rD��K�Q��������O��lR�; �^��RL�z��ĭv5�sΉ~��o5}����,+�:���졻�� �!����]2P*����}���e�$��3�� 7��GH�0�Q%��ؚ�0��Q��/!�"����6<2�1�6�MvXJ�o�˅�C���W����d.�4��6����$�N�D������+�@:P��!�c�L|KY� ���U7f�/c-��M���ė%&Q�_��$C[�o�;_�F�*:�{_}�DL��_��3��,��`�4b���Qn1�����Z�I�wA'���k$@���JF�}���`%�B/dL��<<��F�b��� �R|�hn�����1uaF#�%�k� �żmL��� ���'�g�����IW��`Qօ�4�[�ŜǙ9�:�u|��-�߲2���|B���(��,\�\O�v_�xE�C:@jPlZ�:χ��fѽ�_5�'LU�d��/[/�Z��x7����Yh� �t�Ҿ��R��#�e��"�w��Z:���qB�a��}� w�앸||�_d6��Ꚓ> m;TY��x�6�4}� _Z<TI�9�%ez*�3 �d����~�ٸ0'��D�h~ 7��CD<ow'\��[��ϕ��Q ��R/J�����dݝ�%���m�d����&�2��J�V��O���������#�#�KޙY1n-��1p�Z˭%M�a ��h}1U3�"o��"�AwHocG��AT7�N$��-Bo?�L��0(czJ6 1D�e�j��@z��ػ6���|[m] �Kإ���ŭw�,���?��@դE���6Pa ������L��:l8�3ȥ�����ٍ���{�ڵ0,v����1"fV�1�ZK��8T=Qz�m`���� �oxN�j5z�x�v�!�MXi��FpO�Z��]gI.��P�ӕ䉁���T������5�G���H����!���ͯK� �����D���?aֺ��l8���s0�5 �lb���~�m�&�ՊF� �9.�A�[y ę>�Ta������k��:!��dդ�@ �bҎ#���лf���2y����h��+g� ��:"���B'P�â]�ӄ���n���|�oF�Er�.o��=@���ˬ6�xg�uf����AS~��<��΄�"{�^�i�Uh[W@㙕�� ��;y���n�$9��C$Y=z��4C5|o<���O��I��[i~#�GGd�|�%L�3���< H�K�za'/62�}*A�)���wf�@/�;���e&1��K����٠<&[����������v������ J��Hyⵚ��ν;���0[6��`7�+D4����FϷ[S�:�q�Q������:�:�뮧���/�q� r{ޡ]R�HaI��Mz�Av���0z����F�^�=���NL���FtW��Oi��ޚ��i��q��5O ���s��ȥ��:����iX�ϳ�p(�g6#�N.�w2��+�z& �c}�܉7�خ���#����)r�U�v�Z)d9l��.-��0џ��ۈa�lp' 6�}���n1 ,:��-�� ;�}-z3����������;+��Z&���%a���C�G�X|�m����u*��̈́���+]&{���II$?ꕝ���g mf�^���7�� PR����;�,#W���o,�#v=h���.���!�j>��'��2�Z����zn?�������ڤ��, a�� �����4`�������:,���%u�s�BJ`)]������Z��K��f)"KWj�;ph~-r5�Q���*�`&��0d||>a�h>ׇN�t��Fh4����ɳB3^�����q��W�3�+z�- �K��;��6J�.��0%�u�R�Ԩ��F[Doc-;���m�T�?SN��Eg�N~K���.3!n��b���c�/��rX���L]dΙ�Cuv�?��c��6[Jۤ�/ �҂#��Ý^��� �8_�|��,l����&a��I�s���8��/9�SP�1��k##��)=Θ��y���l'�ֆ^�n#���.��j?d�~u=�ELJ��I�'=N��t�<�7 ���Ar�P��|�G�U&*�34w6����ę���DKw�o�J�����dm��ۦz�>�|�ԥ��y�ԃ�,�:D�BLJ2�tG�[�w�ӹ�(2o,V���W*��գ�#�pXSf\���)A�eN�qUg�1��\�ʘ^�X�#;�>�����Hf�;=����B�^k��A��=t�U5��㮜���F�DȽ1]�'��P$s{����'T��-��ϲ�_n�s1���h���i�KSP�v�) g���K0�n���r��1��w=Ni �����i����F0zm>���u�G��حI��n�MLp���1@�L�ygSH��oA�f����K}��8s��W��w��d�}�d��ڞ����O ���fճ�E��̠}�䠀��*^��)\Ϯ���J�6���8����T3��t������ �U�^���K4I��]���ݽ�:@���u��tb�U��5�~L�IN�����co*=�#o�S�1�QOR�&������.~����!��[�spf�̈́6ӒL�di(*�{+��)r��Z;�ٴ�`V�f�5oy \X���]��Ξ���^���{����2�gA �,�*@Lne�+��T��s����Lk�@�f�r�`?��; �� A��VŃ�B[���]}�G����x|g��e�V� ������f)����[��cWM|Z����4��_ʝp�;��ױH;����և�W�:���ި���$=x�N�:��*)�m���}:��{��c���6�6�bX,S/kaA�:ݐTY<k�l��`�F�����j'C�;4�E�-A��7�� �+s8kSӡ���l�U���6T%��4��=��+$��``�E��L�D�5�t���[������|&��<w�����iQ�b�}q0`#Tkm�u����uvf��3�ހx��w AK�m��� {����fQ���`5������ǖ�RhA�G"�p�J�fD��{�%��� 2�SW�bW��5]P~�����Wd_�y �'.�A����p%�}p��SM�)Q�Ow=�S@�:u��V�>��_�����!~*�P�D r�h�v�cD7�X�_�����|���ֶz��f��8���Q���н6B�� 9����"��5���_�RO�������5)4 Vb�:�ӈ~�z�{� LЊ�R�P�Hj�T�2D� ď���V����AS��ƅ�}�|F�?�\�.���V��(7�t�ㆴ��̠Z4q��*�����D|��!�S�����[y8��N�"�H��$�D�9�GNʘ����m��@������������;�VX��C� ��O��V���&���$�c�~v#���Gףt�1��;�!*�Ag�4㬃[S?�2,�4�6�����LH�"����Ѐa'���z֨ �2H��ND4��3Ň4�Xp��m�+��M]�]�l�C�����e���L^�9]���8�X���9m��P��و���<}�ş�[i���,���N�G��ܒezJ��6�UE��R=��JA-|�B@�ޗ�Ɇ�
Static task
static1
Behavioral task
behavioral1
Sample
3738544aff29c4090dca00a7bdd8d78dd49595a7ec4bf9a08ec4a66650d7c2d4.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
3738544aff29c4090dca00a7bdd8d78dd49595a7ec4bf9a08ec4a66650d7c2d4.exe
Resource
win10v2004-20231023-en
General
-
Target
3738544aff29c4090dca00a7bdd8d78dd49595a7ec4bf9a08ec4a66650d7c2d4
-
Size
3.8MB
-
MD5
962853fe6741e3eca22385eca3ee7407
-
SHA1
bd615a53a26047b43d8482a7a39ee5bdb97d47b4
-
SHA256
3738544aff29c4090dca00a7bdd8d78dd49595a7ec4bf9a08ec4a66650d7c2d4
-
SHA512
f603a3dd66745d6da59fdded1c2793e692a6c20489da159d96b13a951b351fa6333a3dd0f40168eaaa8c9ec379265d13bc2642df7078eb5aec421641066515a7
-
SSDEEP
98304:Fk0f4cfUCPHjKhRGl8sUKw5L+HAOAhokv88fqnuM4xWYtU:Fk0fDUCr8ol8XQgO89vzquM4xw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3738544aff29c4090dca00a7bdd8d78dd49595a7ec4bf9a08ec4a66650d7c2d4
Files
-
3738544aff29c4090dca00a7bdd8d78dd49595a7ec4bf9a08ec4a66650d7c2d4.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 348KB - Virtual size: 744KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.1MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 36KB - Virtual size: 368KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 12KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE