8Tt,�6�y:���S+s����0N4�80��/���4�������������j�3�:�� �����V�}ei³�'�' =�V^�p�i�����t��\ }��@�۔��`iX��e�,��V�ofe��kP������O床�� �Ё�G�S������Q�i�`��_��Hҥ;i�Թm��mu���!)Y�� ѥ�GM�5���-(��g{i)�}:�ͼ��o�j�A�EH���y~|G��E�9������?2v5�x��L�P����m�VQ0��W�%lS���H�8~X�qϠQ��5��O|���n�̥$��ݽ�y+�EeXx6�Ґ�Q��@���wV`f#7�����t]+�D���t?�CUT�:�]u�U�� �*�"*��&��=�&���S�~c�2������9��?N���h@ 4���}����� WOK����� ���|4Q��_[S]���>�U�S���r'�@A:\<H_�^��,E�T[-X� �_�5ba5�f}z��V�Y;2Hp�;f�.Z��^��+�0��Ue.pc��:����}g��7�0.p����N�-�� 1�Eņ�qyEm,�?Y�[�R�!�������Q�<;x��=`��d�q����Y���w���� �~!˙WH �F�d�랆������p �r��>��x�Z�ڻ�����Cz��K��{�cj�r�N6$��g\t�{���|�4��Ǚ�ԫWTu]bu�5���f�����A�zNs"���" ���8�imvl������q.�R��8v���~����P4�� (��N�����.��0vu<��m���`mw�\n9V^�qx>b�0��a����H<t��nj��G�Z;{s�Z��yx,���6���K9_�nb{}���E���)_փ��Kڮ`���'�|~p�+��,<��Q8���Gk:^�,��g�g�F��g'�� � ��]�X=��=��8��x�ݶ�� <']'�0flt�|�����)2���3�w<�#ׯ�}����"�y!�p5��2*Ϩ�\���І��j6��щ~v�":�J����P���A����c�9V��ZO�� ��n��q�~�X+;��ϋ��Q����J���F}�X&�:��}Z�z�d��_y`_lc���>�B��+P�!g&�ÝJ����טS�]��d����`��ʁM�*���9k��-r�������F!�˼�z'�-\Ċ x�#)�X���"/����ɢ�œ!R��I�U[i��͡z��0͵)���f;X��O���4���~���d���_�F����6a�cq{�Cp���v�2�wl��� R!V��|����A�1Ss�J��r����e��Ǖ���Oԏow�PPaH��5��3�G.~�L�Q�F�D֝u�,��k��E���h ��R O��j]i�% ;��J ���.D�q����'u��+v4��z��d�W�ǯs������/$�1��q�D8e��n {����ٌޚ_��f�hF6����sq���+�J�{��d@�N���b��"�,:/O��e�|��ߛ�[Jr����=�q��9a����{ Et+�?���s)�m�����&I�u�V5������ˋ���v�H��o0w�����l����*+R�n)��G��M��s�lX<=�!<����?N<z5�%WC��H�$��;9j�������� 4k吞5)��h �(�F Ow|�d��`��z.�3�m�U��%�a�����¢];� ����3�#fM��7l�S6� %=��wk�p��GT��ع�&�[$"b)l�B4��?���r�P����ڛ|��ԗ}z�x-�����@zu���Ƿ~�?j�a�!s�����W �}��ƺPf���H��X��u�F���|'�PQ��o�A���b��6 G?����qz�n5���ŝ�d���k�O�IZ�f�lt��U���p:Y���|SN�� >P�#�n�w9�!��:To&S���q-;��w�7={WI�4њ�������H&7������D������tp1 �ڣV���m��Tt����7��:'.��r8{3�2N���!/3�����¾m)$�W�x@q^\��������ԧ���U�',sg�AVt�H!*�g�w>/ה�8�`vj��h� ���� C���P�ɰ�c�/z�S��M뮹��hQ%r\������.����x}xZ���3ޥ��/��1d�/���s!"K=Y�Kْۭ+X���Eg����Zf]���O �a�:�?j��� �s�wP�d���^~g��:0t���h� Ig�����M.��(2� �m=qr::�)V�������e�/V��透##N ��]#��R���E窔��$��OF�x�n� .�NqO�t�nL�t�9;iP���CR��Y�+*�g���xOt����v����7���p�qT����h�m���F?|%��K��]�̧�m�T�a�$4�r���y�!~Xw@H�p�Dʉn���{�����w��7�2��7_��2.I��m�GȚhɲ�/;�Pܘm�fq�(%��]�6�ׄt�A�@6y�����!:c������,���(�i������`�Y����i�+.d:P��)T�x���?�D�5%��(WF�'ε�tP�Ƞ�gA�2G{�DJ��t�?$ߗ �H�.:v'��Ƒ���b��k"�=�����fg��r~,��J�n�9��k� M�F�T�)&y�A���x��Z���S �0PȚ��c��[v"R�ih�Eܢ/�� �����58Xn�b��%)[�������2"��#�И�ĮI�A�]n�����:'����E�G.wH���z�.��0ނ�Y�d��|����߶����y���)di�l�G95�����P�?|��e#eGm�[%$̋;�$��8����t�� � �0����t����3��e����NM�U��)�ۓ�7A�c�!�(X�J !b'Z�dؘd*���HB��3���|ѝ �5C$�P��E2]�N�YY�f�CҮ�2�:�L���0Sy�"HCh��p�I���]#S\{���w�ޣ�C�K����{V��p�$�A���>�De_h �2�xp��^�+ߛ����H�8���s���;�khO]��T�j��T@��T�3i�,-�.����,�f���[�˚e�<�h5̬ć�^KR��W�.z1-ќ�ŤӐ*,���Po IwS(����؍ϟ#���+X%|��kV+Vsafp���B���f�{��2/f�e��~J��Ƿ�zr�v�t�lW��U!�x�c1��������]4��*�G0�e�7&�a;P��#�Y��k�R�4X4epzjG��Th1)��_����~���k�<���b3����� k�Z���g|�,T��͔��X�\�/ㅽ6:{|������@���9T(-b]>��;9扗���7A%�0nK:�nx5��sV��!�:H�Pg%����F� �"��c[4�T���S�����s*�7�c�Qv����������6�� t6��Ikz�\.��9��N�f�ˠc}���/b��iպ<�Z��ǰ5�'���51�9���n�H��¼YE�ްY�>�//���()�dD�9�D�;�[�b�ߜ�x����a_7�`'f�m�*�����Q�ќ;����s�b���#J�8G��N�����夠Bf��Bx��U;r�-l���@������1PV<8�O� �
Static task
static1
Behavioral task
behavioral1
Sample
Rise_Free.exe
Resource
win10-20231025-en
Behavioral task
behavioral2
Sample
Rise_Free.pyc
Resource
win10-20231020-en
General
-
Target
Rise_Free.exe
-
Size
45.7MB
-
MD5
6ac21f6e444abf4b6f5391f7138aa796
-
SHA1
1fcbfaa12a0e5639f7bdefc81e2650ad2ad44ec8
-
SHA256
2c28aa3e80ba6c454525e4d3d66f4f586f00fdfe6b581a6109326008b407b127
-
SHA512
d2cdf82baa91805e142cfc15bb1eb0b9d4d3828aa9b30e10fcd91e48cf7d8bf23c5304a92aa8616ec65332fa6e4a77b627780a2d2946a7331a45f27bccb0ba64
-
SSDEEP
786432:++0kmAiI4Qs8Q+z70AQpPhVkggyVmBhAGXkfRveGBW/SjF7Gk3fgtN3G3lk1NdsQ:/bfPf0AWrkxyV0hArriSjIZWlk1Hs5b
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Rise_Free.exe
Files
-
Rise_Free.exe.exe windows:5 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 84KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 36KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 273KB - Virtual size: 32.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Rise_Free.pyc