� ��3��pfY�)�U�g��GNJ�0�s�����o�qeW9ھ��-�_Gג >� ��SdR�3�d[W��s���q#T%T�2�,�,o�3j[�K<��Wa>�U��B� J�~�c��s�g'��T�}�*����ݡ��-Wme_y�&��7��~Nm�����{�u��*�ҡ?�`Gj�8�������5TMu��� �W�Z$���*�r`�=�˘�m�}{��:�Qo�x�'K��Q���=<�Ц������P�A'�MD��ʑ:̺�+C��?' w��-�� ���2�1<��T��kҤ'VG�_�P�}T���R���H��I�ͥH2�RZ�N~�� �:p\f�2�P��M6U������¿�M�7�)t��RP�)�/ꘂ5)��maY��[�Z���9���"�a�Z���,�_�4��P�F���̖J���5k�n�+hz�����_*2"���!��⺵a4X�����o�@!(���Y�>�K_@]W>���)c��[LjZd� !Y�g�.$��^���� �*o��j���2��X��X�^�o�pM�l3�?��,�����_9g��xN8 uc�|�hj��S˙�Ͳ����Qu�]�M�j*eЍp��p�m64�B�ou,F��7j��zwq�;c���`%���A��9\9(zٲ��z���g��PáF��Нy��w�7��j�<CϼH�00)W���J]]�KͰ�I�p���faqV:���#���q\K�34�[���@2,���s�1.҇���"�^�i ��*�>ѱQ7>����Q��z�}*���� JjԂ� A~�o�_�^����2Eo��֙fP:�bq�+(�ڻ�X[�[�9;��#Sr��qNhXr�;,;Q,��>oguq�û4;��� 0ZJ���5.��0�� �����Ɂ�x��q8�����T���>�n�3�6���]`��I�;��K���[ �>8��*o��c���qE�Ƈdu��>��ho@E�ZZ�VH��$m��6��s��3�4W��K�v��Q5�x�D� �Co�|���'5�-NZ����2���l���,*-s0��Ơ��;#*�}*ޢ-�h}[��0�s|L\V��G�Xڑ�ԯi�Q���kSXW�ơQveiȩ��7�����5)L�`};2.�����LJ�����!��D����۷�ȝ��=�'�� 9�a���+]��^,D ��}N��ZG�������z�C��� �i����o���� ;���^+��E�.u����NKr�]��W���4'��կ���u����Gzf�!��� r��ݯJ$�G6.w8�JpvZ����u�$c��0)ĭD�)sd.�V+a�Ѥ��G�ƹ�i�Jk<����?s�~��:�CEoX�V�2 ��uy�7�d�_���g���9c���XY=��:�?C������4Ͽ@�*�����v-��Iiij���F��'#ٛ���#�#�G�}>M�iC ���<W��n'C�L^���nC��B`�"�5k��it���I� �f.uȱ�9��$�:,�@ڟ%����xC��H^���@)N,E���9�MW/�>�����u�nH���KY�&�'O!�P���=r �r������; Z��y7I��>$;.�f� �Y�-��m��O�guX��#�AP�����rr[c�<�@=���\)i��7�W��Jl���9_�H,T�|S����?��\W��׃�GG ��ɘ�wL���ן����\͗��/����#ȵK.́�T�l����������+�4nf��M �*FKp���c��]� �7':P��b}L�h�X�wZ>��j�]ժ�O�K�5��M5 ��t:]eMR�E���J��G�����7��Ri焕��ɽخ�a��5z%>l��z�f���L'���q�!=�AX� �91ܢ,���W��#$����i�y�G�n�vVv��mGN��}� ���L��6���26�I�iMiLp��<�[O��h����l�n;b�XKz^rp�����#����\���8C��;M���i�R��im�\G������a�d�PU[�w4o �͝i�ꎌ|���o�BQ��7�aCzr"��� 8(��\W�q�4z��`VT��W��� ����������at}'d�h���g��5���9�����2�}%�E��{��;���/V�$:�k�3�����Yޢ;ːm�� �q�1�{w���q Bp) ��yEc�!\єJM]������y�:�Ѫ�[ƺ��S����Ϣ`���Ϸ����˾0I��$-�kS���k]��e:}��s"���-02r��$�yZ�49a� �r�&�ËoW)�P��Z�cQ��7����[�z�������N���gX�Lt�إ��]�\LefF|�N�Έ��Y�h�,��4>��$��6s{�o&�]��6gJ�j+��7��lB�]�]s�k3������ �y��K�}�ї�P��]������h}�F�l���e>��2��%|�j��b�SE�J����6ʲ5֏�5h�QR����/ pC�L5���hʦ��#Ҭ�gpo��[�.1w[���>�K��0*/�>�?�7�ިdN���`����n��Ӑ�����kb&{��%�5B���*������d͊���G�ό���p�pP�������f"��m\�ّ���z��x s���"�ѽd���8��0i��sf*����cY�V���"쓽 �KӼ��b�b ��q�|�����Q,�jXS!���z[�^�;�.~���!v�Rf� �.+�ѩ=N m���l/�[���͍<Dޯ�(ÓK[�},+�ՌM�>����@��z�����!']�$���Z��E#�p>��.��JtQJ͘��I*C;~��<Q���S6&���FnK}l�B��m�Kߎ�"~2�|,l$�K�r<�WǼ�B�$��n�q�7A�uu��v�������� 4��T���>���nHIA ct���.�����ڔwg*�"gj6p?�/Dl'��nE�����k'*�d��6��J�4� ]��IY?��+����6�]7r�`��H���֘��/f��@^�#T}ݾ$'��춟�@���� /�� "[J��Uq�s*�U
Static task
static1
Behavioral task
behavioral1
Sample
197378104cfd57004846e8d869861304abbc880a8881e3e07f64441f1489c850.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
197378104cfd57004846e8d869861304abbc880a8881e3e07f64441f1489c850.exe
Resource
win10v2004-20231023-en
General
-
Target
197378104cfd57004846e8d869861304abbc880a8881e3e07f64441f1489c850
-
Size
10.8MB
-
MD5
484395281e9512e53a4f8c76ffc5969b
-
SHA1
674dbae2c45ea9b4b0cc1f18bb46e0b32171ee7f
-
SHA256
197378104cfd57004846e8d869861304abbc880a8881e3e07f64441f1489c850
-
SHA512
b3f6b24aba52ad837d3bedfecc7e6b653c18e6d2079f8fa69e6a821bbdd3ee9adbe769ea84d4eb7dfaa45fd14a3e386dc52224a9a04245760f41163da7a0a4e9
-
SSDEEP
196608:Ha0wXKNmO8BTn8Kj8pPf1G6uo5ywWhbf503BrrX5kIIdpCIkl6n3Qjyt0yAkG:Ha0wuPfg6uoYLSBXkvCIkty6lk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 197378104cfd57004846e8d869861304abbc880a8881e3e07f64441f1489c850
Files
-
197378104cfd57004846e8d869861304abbc880a8881e3e07f64441f1489c850.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 2.5MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 340KB - Virtual size: 860KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 83KB - Virtual size: 10.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.7MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.8MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 328KB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 757KB - Virtual size: 760KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE