���}��������'\�Ec�h��f�����! ���i�z$Vʧy�c�"S |�.h@�k�� ���?�R Ⴑ��R��r� �@�Ej���k5�8�e���a�~=�L�R.r��/�#�'ΘZ�2M���BP� >���%�E$.6����;�t�ɺa����5��+,�z���N��q��e;J���;��������e�ge4�!��x�p,x.�P�q~(����T��[]ǽ>���v�/m��([o� )�*�k��hՇ��)��q{�1��xV*�c����LvTq���9�5������S���S�����|.)�z���������{�!�|�}�{��E`h�q/����.P¶�����>0n����X',��'���L�R��l�����E�Qa&%�����+Vџ�k�Z�."��^Ґ��l������m2o����㛙��?NdQq�0��e��5��6Yz:�9G�����������ă�E�۸ES���n�T�de���ӹ6O?WL�swfS�8@����=6,�2�"��eƔ��]�⭄��2���^~���9�]�h:e&N��:�������$u5=DU��l-�r��\[�����L��#���@̦���u>���5�jL`xЁ@ۈ���I�t'n��1Y�R~;`�_��wV�7�lߪL������k�9T�2ܞ��o2� e� <��#uJBM�Ql�GR���&��rG�N��.�G��N�ݾ���'��e%[(ˣ�y��zl����d�f��_�-Q{�����2q��� Z(-�ӑ���:���� S��I_��'3F��}ϼF#sLs�B+ �*�-%A!FM 9�u`�GS`��u��Y/����U��3��n���E?���#�; ����X�l�:NX�����ZJ���,������Z�>k��*�J�#�f�����\.O*U֪�����ǝ-�����|�v�>��l�N1�� �V�(g۔v�b�j;J;���j�,��6>�ߕ��e>�)�+R���!o�\�`M����w=�?X2Dn���LW���=�n�$�S�� �]���a���9��b�F�����i[���F��y�G��Â{�s������ "�8��y�sM��y0��$"@�����6F�5KS^%>�o�'�)�$���>W����0�%�X����`��)"��9x�$�lv������2yvD�<i5�%f�H��Ҏ}��T��T�;�W+:����o�JV�ۓ��g���/�R�M퐋f]F�w�6�b0���J�+Lh��K���<<]����%m�Y��0`>ʈZ�!����1tF������s� yH]NL"��@Y�������s���%��E��P�dG·�6���J���b���%���`�=(��t�B��"�<敿K�(� G���\��:?ڤ�c����@s���Nx�2s��S�ѣt�9�6�ڧ�q������.�x`�u���my�ef3��Vn3��&�[i�T'J#(����@q��Zx��Zn9�o�]���+G�dHHt�6p4s�px���������=���zw���*�2d��eia��بbʓ�O���A��u����W�}._f6�_��\>�(�������H���N ������X.��b}P8�$H��N���uk]�tӔ�+A��1�smDf:N|*cX\�o �$�,�����ԁ���<��5�����9S�!_�I�4�i���ɣy��ݫ ��C���Y������ʃ��Vg��οdr���t���V|68��%����:v�p:��4�&H��)_C�"`��K+<�v���t�@Q���%���0Ŀ�¡���_�i��쒮�Q�M�h^���!Bi@���o�R(����q�J�{����,�����ʲ��g�6vc���հO����S�Y<�o��f4#��(�u`|ʽv���*��8y��V��\�um�#H#�Mz:}��Ie�Dlb�'�\�n�Z2T�[ǝҔ�}��,��$��9#$2Z�J�`c � �R��G'��C�����|��I��q.��=M�\�����BH^�hm}��ӧn��a��=�/z������}2����Q��}���I�7A��yP�)�f���&j���π�?�����ܖ�<�=#��y�1,\l��p��A�X?�5\���G�f��Øv�5lu�֑����Nf�I�H�� ߦ�CU����E���`�!�|W��:�j��7}-1��IQ��h���UeA������/�)H(:)�1L�J8��|+0�A�a(i�m�1�#�V�����0ڒ�뉝� �� a0x�ӵ'��G+�n��)3��%/m�BOC�Ju��whPiz��z�i@�����r)��H�/��we�����b_�_,�E���Ug��=a�G����� b��ۋ��S�y��� liM�ʦHv�%p���6:��ɝ����_{�u�[b�x��>�S���{[1x�6U�μf��������C[�p)l(/9��)*u ,���q\�w�L����?.�*�����uyJ���r/��p-�����6U��_��1���T�&�_��YT̏���CEo%^��}���\$ �?������SȠ�u����oV9�D��f>]�L-W#5��A#˳�]�=��o�JSNt����<f��Q�!����afݢC#O�J7��O��V���o�o�K<��xyg{H=�-�sG3��0�v�������S;�+ҭ��+mߝ��k��I��J�FiΌ��}[+���0��Y��_\��>A_J�����;�����#nKt��ds�mka�k1��s-�ZƑ'Qj�{mwe��!��A���4'&p���������$��A�yB��?�� �n�Y(���ARzC!ð\�\�_K�}u�������!{ɞ��60�L-�j�eo� �9 �D���D���� &5+�EM�Q�M�8s�����Uotp�á�q^�c��@�g�M�s�G��f���ؑ��/�]$/�~l�8`s�/���a��i� Mni�l{mo���$�H��o��晉�͈�\��?۸g�~n�p��l�z��M�� &��D䭺A�h�"�1B��
Static task
static1
Behavioral task
behavioral1
Sample
feaafde5bd4108e5724350faaa388520c2ebd6077a1993a513aa5b4fc6d4679f.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
feaafde5bd4108e5724350faaa388520c2ebd6077a1993a513aa5b4fc6d4679f.exe
Resource
win10v2004-20231023-en
General
-
Target
feaafde5bd4108e5724350faaa388520c2ebd6077a1993a513aa5b4fc6d4679f
-
Size
2.7MB
-
MD5
c0873e94fe792e39a302847f39d0b62b
-
SHA1
ffdfa383b67a253c26765ac8db1a6b259db56bd7
-
SHA256
feaafde5bd4108e5724350faaa388520c2ebd6077a1993a513aa5b4fc6d4679f
-
SHA512
b5be969683849ca7e166b2403ee6ef024edafaf7d8c603ca91eeab242cf44dc2c6490ff430fa4e1fa880d0dc4a7b4cb31d0ac40b50c18fef5337e7e699baf5bf
-
SSDEEP
49152:5K+WBsvdVOsT5PXB3iW9K5HjBpLkmUfcWHGSDvOEXCKbpt5bqLwgh:5fkgV31Z3iHtpgroEFtA9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource feaafde5bd4108e5724350faaa388520c2ebd6077a1993a513aa5b4fc6d4679f
Files
-
feaafde5bd4108e5724350faaa388520c2ebd6077a1993a513aa5b4fc6d4679f.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 336KB - Virtual size: 692KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 28KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 36KB - Virtual size: 308KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 12KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 7.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE