�M9�c+�IH�M+�����}������U���U�`��*oW���;����'�H=M�� �4ahۦ����g�"�.���X���\A��-��Ze.�p�\ɲ�gO�]���R4�/}�hQ+|0��OV}<$���@2^N��^\l� �Ĵ����.�S"�7�����(��r������4y$�k�3%�ћr�"O�+h4��wTI��D{��F3��9��D�8�*���@�C�|�U���p�PA��:q+kE��\�""ן�3On���2F��kG��_����T�,��_�(�^?3I& �I9�#Cb���&�����*���q�s#���y/�6S� /�����*���=��[@kB1��+��8�#b|�A$pw���?ás�L�\��"}� ��Q����Ī��V��T#ߗ����4'b�)]�S���8������V��$ϫC:�g�dq����X�q��/~�y������ʻN0�l��" uӭl���,2 d>ۉ�"����6`p�n~Ix�mMb� ��7�z,���LY�W������9�D���y>�gU�V��K��k!ͥ�`�M�)��y1q���&��o����60���9�.˚�N�����z"k�#ɏ$5��r^�����z_�F��\�)�V����\� ��1���]�R� 5���h~א�߈�q�j��މ�������i9JO�R�7V8���^é���f�EL dX�Rw�=%�+ϣ]����O|Ax���,K��,N��j3ͧQ ���m���-���3���jr�Qf�p��&T�|��)��NY��v��5���i�q�gزv����~1��P?3���F˞m�<EJ�U�T����ړ����A�o��~}�N��zA��0[��73�:3!���'g>���A'uc�Y�����)�̔q5�M�4�@��t9#O����� �p$�l��u@Ms�l��J�w�;f��2�6.e@2�F�"O�x ���74d ���8;TE���+<8e�������������H�B^�����H�"F�B#�[H����}#��@ᴝ K�࣫}Q�]������=r���v).H�����4�L�Ǡ"�c�rذ v݅h�� �kF6��� �y�-U�������g@x���X���iT��ye�YK����I�ς�PX��)!r�Gq>����|����i����Z�C��?f&ޗ�e]�/sHoԅΗ��-<����b8Pѳ����z��2�?eH�n�+��N�U[�����ُN��n�POҦa����d1��>Ϭ�j#'VX����GE�U����� BP���3`�x3��j��q�=�.����m�mΰ��+���p��Aw}�=|��������"�|��= ��O��klH.Z5c۠p V��j��#�볊ۻ��;��R�ny�uj�+�jǴ�t!����#$���o� ��鱕����o� ���9 ��I�oVI�O8�&Y��P�2hL����>@�K���8]&����~A¶Kz��Я�ˇ���x��e�bGX��3s�Ŀ�3��|���N�B���ų��' g�#��QT�����d2q����3c���1>�T��CV�^vb�Uzf��}�GK��@�j�Lm:oRC��LY�]h��vF���I�"!�f��b���E�(n�I��[`�'`��V��b��e{݈��WUY�v3���G���"���ߗ�B� � �w�ըl�q�s�e��'�u��Mk�-qb\�����i�N�+K���}.a�S��-Tn5�-")W��m6j.�D�l�O�u"7��L7P��8������<Rg���L2��~(�5�c��v��:�7Ȭ�*&|��I/�a�Qx�� �/�w3\���H� ''��x��?@�&V��F��0���cn�/x��dT��)��z���e ����MP?�G+�s��Y���m�f3��ܖa܄���<�q(��WC��։"��u_�}�=�Tb������� Wc�[���K!N,7�����c��1GZ��جD �2_mg�t�ZF@�Y��ݝ��%��P g�Pf��D�v�Y/l�CO����|O|��@��F>aX�g\��.'5��:��]%� ��' ��`��_����aQ�Q�6�zN�G���/����RfY�N��î[���3�I���@b�)�:?��?�zn��v�8d=�z%nӘ�I$���P�#k �.�i����#�ޛu��里*U����-�0��k�*F�&��J���hzk3� �"�����t�1�g��e\X�:��V,N@@N��MO0 8�gwi�>8��4���S �oR��䶳\�ˡ!���9ȜJ.cv���|K����i�$%8 TM�- Yg�8<Ң~����G��|7S�'B��R��[�Sb缀O8�>d�X����j�*��e?j����~Xu�^�c�Q ��j�gr�P�+�'�2&����r�V���C%/�O��y���cF5��+W����# �qX2��ۆX������I������@���ao��T]����b��� QV���V/0K^d�C-z� ¡�"�<e% H�?��2��E@Dr�<������N -N��5ղ�Sh$ߊ���qX�� ������'��#4����y�d�"�x��+�7����i�T�t|� ���v3G(EZN�>h��(ROV3���)*�J �⎷�\�B{iM��;7��Y-����C+Ҍ"��w'�O��U`�q�^�.&Tדy��( 24]V5�[F ܿ0V��F� ѭ��t��M�����D.�(m�H�E�+]����b���u�LXE�VZԊ�o�� ��1f\ e�5�Yઽ<��S�R/����U��{��*�����:��wb�\DzZ���RuV��-���҅���lA�g-�(r8���FD���^^o����(��s+�AJ)�^7�*�|.B�O�`hOZ���#-[�4� s��/,�.�rZ��t��I{ ˱�ę�pΟ������fI�4�қ�Q�fUTy�?v�aN�f�<3bx��Y�B��Y4k���}?�8�c����@�|.�����`�X\|,��t�>�%���<A�2�D�4E&�$�P����d�٘�7ƫ�CK$T�#��\�0Ne�� �C��Q��(�/����� ��Vjp� �OR�qƪq6���>k� ���]�� 㴷fyh|~$@*;�9�IC���Fop�+8l�[��r ��Y�׳�9����P�߳�#�/��=捻F�Vp}>}kE�@w^��|��č���Q�E���O|1�l�HvG�7���ݢ�����J�[x@>���9gc<������r�& i���d���l��(SO;xe����~M��DJW�I-�Ⱥ,�w�o�h�A����r�q�y��3**�f�`?�օ��{��<�`䟋�N#�6���܀��`T���t\�;�t�?a���;�Q��^�SԴ�M�r�K���{����<F���%�6��I�M0~��\'�x x�O\�:u]�`d�;kM])��r�K�˦V`t�4�P�;H��o��/��G�)�x�������m����]��yI<��Ɲz����؋sե�Y�U�#>z��b����S�b��ӊ�E�[�{�H��mJ$�Z���"t7p+�Q���7�-�^j�>f���&�AD�e��>��g|��1ӏ��/��#���
Static task
static1
Behavioral task
behavioral1
Sample
b1221975d7b73a7a1756b8c26aded789c263e29050ec415c0f5222a0104caec1.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
b1221975d7b73a7a1756b8c26aded789c263e29050ec415c0f5222a0104caec1.exe
Resource
win10v2004-20231020-en
General
-
Target
b1221975d7b73a7a1756b8c26aded789c263e29050ec415c0f5222a0104caec1
-
Size
3.8MB
-
MD5
7763e0ecf7faf8bdbaa598d0fc80a420
-
SHA1
7957bbafba8eaf914c362ef36581dbe536fb71ef
-
SHA256
b1221975d7b73a7a1756b8c26aded789c263e29050ec415c0f5222a0104caec1
-
SHA512
733c2e3fefeb0ad48cb4966e7e829a4ee0fbf9783733a2c59381e06b28b19ee440d8eee88ce785f5a725793319720c25fa741b013a29ac7d52686374b5fe3b39
-
SSDEEP
49152:uO3bz2p9BYT2HIHvEWvmOqnxlXYF7taUQhR38Jjwrc3djHvvFDYXFCQ1RAWri:pWp9BYTLgrnxZYFtihV8JsrE7FD+zr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b1221975d7b73a7a1756b8c26aded789c263e29050ec415c0f5222a0104caec1
Files
-
b1221975d7b73a7a1756b8c26aded789c263e29050ec415c0f5222a0104caec1.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.7MB - Virtual size: 11.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 12KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE