����r�%�:y�NcI舒�y������6�ʅ��h��8�f-m��n�`;�l�v-�%�6�;���n�V���tR��� �n�����H�iM��m� \5�w;��EyB]����3��%��m.څ��ܤ����"U�!��g��e������O�&#��(�AP�1�������r���5�5>%K� lL1e0�� � ����@|5��O�6:{����H{��Wm����E,�A<��{R��A�_��M��ǰ�,J�F�Zb�I����^���|m�{�\�t�,�uqh��$Zn��L}���[�pw�h�e��+����e1�\0�����蕚"��= ��_2��J�@�� & �{ۅ�f&�!S���e{r�Jw�]�-8��p�ѧ�06�V�L��uO���7�eb�/Q�q� M��[��\q���U�1e�����C��L��bj�#D�u��~�t�����x�H��aO���l���y&����ӑ��|��&�����2�� I�E"w�X-�N^��h��w$~I��?�O��Ӫ3(i�;��2��z+�-�dpb�)�dڨ\����V;ۓ a�az�j�5��^ ��D� �^��N�9�����.����+�������s?c4�K9��K���3%+q�$v~�g���q[Jں"ģ�Px0?�m�zC�'VNQd�H {��Q��"I�߯ꡧ�%J���2�>%FX&E�r0vB%}CJ�*�r����(�]��3��3f&��I�E����(ϫ�)�HΝU����M��6�w^���(�[���l2����WX$�ɅPU����Va��Y[9���2<�^�|�2�����c��������|����A)�G�3P��.��v��齃�邍�|�"���9IT�05`��O������mK��6�]�52��s�"�*YS-(]le*z/��� =V�ľX[�_��N�B_c}�)��Q<��)?��i��pZѓ:�^X: QZ����$fK)A:�E�;u���oE��;��%XV9��j�:�2���;p���i�6=��8^�t�zM��ŕs/ژ&=$���R�k���(']>�3=�@�J_pj����w�HN}��:#�J67��`���X!(V�/��1�ȱk��n6�zLt�Q�|c�~�:��&?J�mܿ��Ȳ�D�Tؤ�aI4)�@qe9j� �D���v>�m7��0D��QTm��� (h�S�����ك��/����a�[j�Lr��MZ4ܨ�2����:X�1=f�1%oDe=�j�6�������B�M^�q�0�X��������.��-� |3��6��e#�����#ht�^x|{�eb#j�,���pƎ�5�����(m؋�1�J�+D�c�d+�;��='�!�b?v/�;l�S���Q ��/�ۢ8r�D�3���%��>�A ��\R���wK/�i��G��ybӽ�&Рכf�M6/豌Eo����� ���AR���Հ��6n��E~���b#ק��j�K��W�p��h�6�49Bc+}�s�G;:H��[{L�c����:�v�,���\�] ���!�Ga�d5Y���L�KdS�qu���ey#��[J��'���ͱ������H폑f���۵ϛ�ߤ�sFC}Om����Rr�E� ���ha ��oD[×{i�V�%s��M��NQ5,�R}A9���nUk ލcBH���=w/�dQ}�h6���~5�̯Нy�E�L���P(��T �m���p��Z���M� � w��W�\1�M�pO�qھ��'�`�5�6��yn��j�OV�����\�z�>�Y��9��4�*����<�ԿVq�A�.�w*�~=�v���$SOO�� J X.�n{'�,��yB�^lĤ�܀�4���!���J�=��s�֗�m��g"g�;-����`Ƃ@�tTl�~7��������|�\� B�C�`�a�F�dá�S�*��e��I�?ê�{m�>���b �Zz�g��6<H4�́��������v��^@�V0�5��Z��j!و�IrZX�,�چ�ʈJ�0��J�k}�Ye�[L����NJ�P(�s/jP��ֱ^�[��@D���O�m%�;|/�5���.%0�/�*N�Rt-Lۧ�`��q� �� @C�o�#�8��H��!吮��,����v��z3�$ش�5:�C������#,�z Zf��*�G� @��aC3'�<'��K}�M�I����\�N1=�'�82(�g�o�r�ڝ���`',t'�C��l����~R�6���7�SQlB���{\%�0+�+`=�Y�m�!��!A}��vY:�������Tɾ��I�X#�%�]����ýf��&�飈a���+@��6�&��b�V,��i��#�A�O���]9���(�`��a]�.�1�_�-R�֥T'�Z�<�b���垚�>��'ދ�Z�9Bϒ�6U�r�$IN�վ(���f�oڝ�M�������)�X8���M��qծ"��� -פ�2X �wB8̮�� >����7�vu���5h�n�����4�Z��dw&�C�5[cw�#~�2�s��nD����e_ �Z\���!(�RZ�5��M�/��n�2f����;�����@�U5H~r�!����XС��Cp�^7��B`����/ �p�`Y2j>D�F�V��$�D�dh�����e�)W�q�%Q����>�6ԣ+ �����GC ��0K)\��}}�1HE�&�1���P�^�,v8d��p�~�?/���E)�P5ܙ�'��Sk�r)�W��F��_����R�|��Uw�2Hv��3I1&����*�%� �6�7�ܘ� p-���r������<����\ ,���_�������h�L$MY��(�ï�fӱ6+���ٵ���3�P��9��̀\�[8�X�~j��e���h/����JKq��$"�u����fU�b����բ�'Y�o�����T�������ج`�g���0�].�2�r���S��e���q�0Z�EW��b�֪J��*~�U��4�}E�8�p�b�j�Ar'�ی��)���4�o������+�X�n&ǰ�I�Τ� ���{���Կ<���/�H�\��{��$���W*�F�*����Ipj(��k����o�N50�$��1�Úl�����˟�
Static task
static1
Behavioral task
behavioral1
Sample
2818e64ab6c8100e34819703383e3259a061eed19229ca8f22c4e4f6a6cdbedf.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
2818e64ab6c8100e34819703383e3259a061eed19229ca8f22c4e4f6a6cdbedf.exe
Resource
win10v2004-20231020-en
General
-
Target
2818e64ab6c8100e34819703383e3259a061eed19229ca8f22c4e4f6a6cdbedf
-
Size
4.2MB
-
MD5
6fbeac5ae58dea3fd96edc981f854b92
-
SHA1
3613ff5647fb573e911e385ac0c1fd865bffceee
-
SHA256
2818e64ab6c8100e34819703383e3259a061eed19229ca8f22c4e4f6a6cdbedf
-
SHA512
c074d88c5db6a0229add4565761547be69927ec26d6099ce45ce619a43591cb49cb3d66fa05c98d23981b3ae87fabbffabd19a94bc7e8b6bbca231c2ba0abf02
-
SSDEEP
98304:FGmUtWL1Z6paUinAgkYgmSVlz/VkSI8lph3WVOCHwXB9xpY:MmUtWGJiAgkZlzNo858HK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2818e64ab6c8100e34819703383e3259a061eed19229ca8f22c4e4f6a6cdbedf
Files
-
2818e64ab6c8100e34819703383e3259a061eed19229ca8f22c4e4f6a6cdbedf.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 2.1MB - Virtual size: 12.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 12KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE