�y*�ˎ'wV���Y��kW�g��&�Eu�МB�csO�j��//x����) �����L)�� Q3�r��&���W��_��'���y͋n�r ��g���Z��ۆ@����ܹ(y�b����x�t�����ΕD�on ��N_i�1�}��dP��fɿ�\Po�WC|�6 �iڰf?�R�f9�ʎ7����*��d�lO�0w>4�=�ɝW���ޣ���~'[_�Kc�����j����v�=��U̱#a8�r}�Z�r��/��\!��q�A�x����� 8��4U��X�鶃�r����|$��œM�j����i<b�H�G���}(ɮa�A mZ����#N�w� ;�m�7��9�n�V ?G��l\@�����#�����v�a�4*_�(�/��Q�����Ŗ�Mn�g�6|�g\}Zq i��H�C�����S���h�~J��/���Kv�(Ӹ�UH�(5��#ߴ���t������n����Zx��`���ј��ƥ�������G�5ZZ��t�jT[{�G����Z������b��� � `����_; � �K�c�I?�ّ�|�tc1�������g�z�� ��7��?s�������ڳ��J�����}f ���]4X��G{���*�����c;�/y����X��|õy��.mJ=�ݾ�I�M��]/�4���>��5�����3OE��G[�O��n��Ǧ$�p�C�w"}j�c�����<��)�;�d�AvkV��AXAM.g����*��'��V�i.26��IzĒ� �����,���&C�g=Ieά=+��;�f�E��L���T�Ҭ�Ŭ��L��(�6�r�R��d��6�]�D��W4h{E��S(��kz��;���k�C���l���9��kx�艫1bW���(�}����2����=Zr�qĆ�2x[���#N���t�lO��30�vU|�g�J%�qA|����@����;y�$`ٖ�Z����=�H�1�\ ��7F+��z���ZC-�l~�A�M�խ��b�I��6���A5C�N$<������4U��C?G���2c�)���.�;H�>�p9��|}�V@n誊��&9b�-0�Rvn��K���x���a����@��K�$��HV��9�r<��� u)@?�\A*-P��;E�w�ZAD49�!��V�3F ?n��'A�d �q�\6��Eu���N��Qf�+�@0��~�4Xϰ���&����+�A��,��c×>��Dc0>o5���K1�Sօ��7,ܟQݔS��Q�|Y����}5"�>w?�[������,[����@Ne]���D�&�Ѧ�.\e-��?趸B���$O���Rt$���8�.�� ���鈱NW'S�֪��&kx�8�=�;z�a?�X�1����v[�M����BK�cv�K��ț�C�M�^5��m#����?+�{�!��7Bpav�}�w�T�y�A����c�[�+�B\�&@�3DV�su�r�����u����|�٣�6�{��=3h�lTkВ������H�`���}����&��G��q��p��7���IZ�D�qD�H>$�lZm�\��TUh��J�7��MAҮF6eVޯm����A+���i~!�K����ӕqj�6�j����xv�^�P��HN�2z�S�/1&>02U2q�G��j��-�ūK�o�wZ�jQf�<��������<�5��-]��?�o�������v�싄%x,в��/.^�QB �` ��Kü�;���:E{�L�n�.�����esbn�c��H�4���:f��P�Pn)�Yߟy�/���� ��qkꉟ���H<�Ap��Hz����;ee#�9�p�&����}SN�W�o�=��*�m�3���H@��y���VUe�BU����Z3[�-��U����q��l��� L�Z��ր����5#A�h�BkZlQ��[���̕J�����J\mm|�C8$v���D��ʗ�V�C-iOgP\�T�4s� %�s�6�SYB�ue*R�a��;j���0۷#���.�H;.�D���jW���gdҺ��'� Dxjb�>������}�z��C���E$��j�c/�M����;>>ׁ�9�(���:����Y��eq�����rF�5dq��0�\�8O��=f[�<���+��v��}~s"7, ���[�6���8�_c1�b�B����zŁ\Fz�"/aL&�6�@�)����Jk���κf���?X>�v��?A8��� 1�ΔM��6�̦B(�/XuC#�2l�!֢�@�R��!K�/�)�Gъ`�n%�d��=��z��(K�����7�7�mK��K�����*'J�j���������CX+Tg��e��HUJ� 3I�/bV�7Лl��O���7b�@1T-Mk~��e�%��hKk#� �����W[v�h��^�y�-Q��x� �XA���� �1tss�/'r��H �IC<V[��s��"��a|�(���*�b9��ӳ� $�6��:�ʖ���Ü��&�NJm6h��JD��8XJ.��W����j;.���/�a�G9̿�I�� $��B� �r����,���͏w�qKq'��������8��E��.T�s�h́ҌI��\濴z3<K�����ž��?��C�\~�́���Y�_GAB$�U�C�Qm*n�� f��1`��#�t]M$k�/;Z?�Zɒ�^�������u�kF����y��*x�K�Q�X�`��؇�J���b|�Xn=�]ȥ"s���Z�':)F�8�Y��ː� �{����Ȥi\�z_8��Y|*� �u�k,3Y�2嵖S�,_0����w�]���A�M;1��6�U�D� ��l�5-�;M l< g���(��c��Z4�o�S�u�0�:�;j "���6O��IW��a*+�vR��HR��DZ6��&;z�+��,�� �Q� �e���{�������Ե���gRu������Ձ0�;*~��V*�>��B���(0�b�ǘ���D>�MH�=J�����l��,��g�D��c��$���>S^�E��BBq�@X ;33WKx���.�5J�,'����|.P���@U��(��L �Ѫ�<�s�YQ������ߵb�mԈ|[�w;1�a$h�K� ~�`ǸPk�].w�vj�����6#t�\����>1�Et�#t���@�߮mX������C)�q�{��lX�$X���a�]���Nߐ��YoT�H8D���JY�ޫ��'�! �l�B��:!bbJg���ںս�|�*<zI��]o���5J~�����n=S�gw�͙�f�������Fk��A䲇�K�ffj ����e�"`�#�����z�H��۶��s��R"8�d�L�y�#�T67������6%@� K�ʷ�@\�%*��G��N�7��0������A��k^��jN4Rdu�;�������Y�3W���zeXVn���`t��- ���i���2�X\y��p�=��]M�j��,���t���| F��,t�_��H�PX�Q�*c(����%�L{���L&�<�֞��U�4 2�J�r���c����rX:�S��e]���a��0�g��._���dc^2��=�]���v 5kG7���1]F_����,�0��1�,'��"�C��J�6�������0��&�q1�����b���=� z�9x��=K������?�{�n��o"�m�S 8�uM
Static task
static1
Behavioral task
behavioral1
Sample
ae2b82da7d71e212246c39104d20e75a7aced065b5811fcfe3e7a22b35f9e68a.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
ae2b82da7d71e212246c39104d20e75a7aced065b5811fcfe3e7a22b35f9e68a.exe
Resource
win10v2004-20231023-en
General
-
Target
ae2b82da7d71e212246c39104d20e75a7aced065b5811fcfe3e7a22b35f9e68a
-
Size
14.2MB
-
MD5
efe7a5b0aef2a61e3b0badaf489c0b50
-
SHA1
0cd270be6c56aef158526b94e63a10827c85787d
-
SHA256
ae2b82da7d71e212246c39104d20e75a7aced065b5811fcfe3e7a22b35f9e68a
-
SHA512
00bc0b87777ef16da6475c91c2ac7ecdabd37e7aa56a57604baec9ad7adffa484ec470062cf3313d6e2ebb0839b9a247e953c247f254ac623eada71e120b2a06
-
SSDEEP
393216:owKLW5EQBKNTRzhDf6j6OLcIgD3BIjh3jK4/wEfkZLB0o0l:QWhBKNdtDfN403BI9KsLsSoS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ae2b82da7d71e212246c39104d20e75a7aced065b5811fcfe3e7a22b35f9e68a
Files
-
ae2b82da7d71e212246c39104d20e75a7aced065b5811fcfe3e7a22b35f9e68a.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 54KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5.7MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5.6MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 536KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 532KB - Virtual size: 536KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE