�!uT��`�W��[����L�E&hAcw����'�?'���b�z֖H��k���x��������Q9��)|c�ܟy3*f�<J�J�ةh�K1��A�4\T�e��^��@:�����b�P����3��K��_����<�I<��~Xt}�z �< :�Te�v~F�6^�b�9U��9X��λ��>w�7�����\��t0c�R#��3�ȼ����1L�13Ȫ9�)����v���6�o�6��� �o.�[�ϻ�op:jY���>�=HG��}�ف�A�T���͗�zEdj; �.`���>H�$z�ֻ�B�D�sO1��g�����8�=�V��c6Z��C������`.x��<��nMt�h�HCDYtѮъ�k������2aNRZ� V�&zKL�.�]-9������$����a>�+����hȱp�B���i}� ����#]��z˭�1�����O�c�ѡ(��p �MD�9�V��NwU�&�7�������C:���Y �o,8��Az�j h�v�CJ)� K���������Z�KZ������M�p�B���(��N�/�{½0u���Y�¥�x 22�)|M���8Y ��L�"�CJ�5J�Ϸ�g�>���TS�D�X��d"Q����i��^[8톪��X�~���9cA��Q� -�x��vXtZ_���$��O���B',�.�֩!�m�9��zm�'�5^�k:�n}_�M��! 0#�T]B��H�<��ffg�W(��MIѻ� S�]41dI�m��Հ��FA-��&:?8E�`�c�<|B9As�Q��ҋt8�x��$�d���ZQj��jEGP��Y� ����<̔˵SW�wa���d�Z]5��"��Z^���)�4B�+�V��4�/+J��>��qhC3y�}��}�Jn8���f)f��+�G�8#��"z2��z2�,,gz;s�&9�Ԇ^�ǰ��2��4�3������n�ҩ��gi�ﻭ�����j�ms���S�iY�+�}g�&�EXK�%�V+�H��5+�n��&�S�-�۔�QT�a^lI���f�I��%S����18�m�W-����&\xj>��'�)�C�:(������RxA8���'z���������p�译Z�K��%���O�Z���R�a� �����h.�����+ӭ:~Z�������f�m=��M-{�N��znL���1#�͍PQj����xo�W�z��m#d�C����E�o����Q[�ҟ}Kcl���V�����;Y�� &۷��5�<���'��2���$`DmI��+R����_���m̀vi��Đ���1�Z�7n Hc���8�`=��P��w� " �"vK� ��g��m[���m���S���C�J�`T����g���n�2L����|�e�d��2���W��|*yܭU���Ƚ����-�{�7���U�����H����!�F�H��Kk�4��_�'��_H�F�m���]�W��z]Й���Cۡq��q��n�;�_��)�<^őq�a-��v[�NX�DAh �vFl���Ag����Bt��|p�I ��`���M�- m�3X�?��r��a�W,b:/�$�4��|yD� q��K�!���.ܴ1�^�Ă�����L Ѝ���C[U�-kfouv8r��� Չ2�c���e��F�j͚G�r�8��sZ�6-����ݍ��蠟�=%����#K:j3��"�VI��dU�����)�j g�6+����z1��}+i0���(����i��� z��k��}@ZL�JP�ۜ"A}5��W�=9��;���A�ڨV\���=�/�Q��7zm�)S���M�u�R���R���p��1������Ye��9��A> 3��0dH�*K�2��#if�e�%�4� ���6��J/�VkB��A���aIh���$����>�d����L��Ӓ��V��:�o�qm#M�5�U�ƃ����4������O��Wr�G��oj��c���"�E$��"�6��!��x^T�$��,�}W,^g���\�Bk)�jJ���U�1WI��X0��;G��̣��J��&��k&�J|E4ݕ�d�4z�D%�Yﵻ�S�W�)���pKM�Zr�֠��x���zdʷِ����[��K�.��S����W����n�>���H�pg֪�-ȭ����z&��{*� /%�d-��Ԍ�NM�ᝈ�)�"��~a�K�c�e���{&�4��6'QT?����ͅ�����~7�rH��(��r���6]Z �y�9$&����9���i���z��Pn V�Kę/� K<u9���5�+�z�%�*)�k�fR��������X5՛�D�ry_b� )�ݢ����a%C0�)�Rd���LJNH6Ά$���u���� �$���s������9�;�po��Y����l]���_���H�"�Ev_>=�"b�X b{/�K���M������K����x��:v�l��B;GNY�vT:>��Rn�}h�t�ގ5���4��{Nksك��>���k���5c~g�5��ޭ(a ��B��%^V����e� .Ki�L v�`��|%:&,?����e�HD��{6-�=�e�$���룽�9�.��S�����{ ���^Jx�����43Hk��Y*I�Kt!d�Y3GW��zb5F�W�Gn{��k#4HY���i��T*qa�� i|�H@踇1��J����w��!@k�jl%C���yAoP��"�3�)<���G��F�WK����(��e1B�E�Ї�nD�I�f.�K莙�EU>��/*�%�d���v��s��e��%W o6u��gd�6���@�,IP#?� ��������t8���V����m�8�L�pH �Fg�+R���&��� �}�������!I0mC���=��m_~�мo����k� �JM�W���m.G�k'Z)e����F@t��e{gӚ�&r��2�0\��=���٘$?��Y���Hi�n�)�XC�b�C� ��gD�%���T+&:xF/섭��k��&-���`�w�˷��xy������͘�J&=)犟���0Cb��%ބ��@^mA����tvq��Xe]����n7�Hװ�,a1�@��@-r0`*#�Mj�x�G4��aWMt:��]?>� k��I��To �L
Static task
static1
Behavioral task
behavioral1
Sample
/SpiderCrawl_1.0_TEP_alp.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
/SpiderCrawl_1.0_TEP_alp.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
/ע.exe
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
/ע.exe
Resource
win10v2004-20231023-en
General
-
Target
1db96b62a3e81b8083ca8ee2668f5dd178d1936dab470e43b01b9064e24dd04e
-
Size
9.6MB
-
MD5
27662e714d319b12fd2fc9dbd2d54ce5
-
SHA1
f047e08920f7e71fed6d1d3d09ee36dd2f1b7003
-
SHA256
1db96b62a3e81b8083ca8ee2668f5dd178d1936dab470e43b01b9064e24dd04e
-
SHA512
f5850710a71eb70515211c899804e8abb767414d4787adeafaf423a7c746960cf214f9aba8354a12c9f7526e9a44bbb47e77439bffe586c6af350456d5a28701
-
SSDEEP
196608:5MvuMc/ea4b2ClIOBhJ5n05GKqTXJMnjPy/yuJimMZL58VyDm:50uWac2Wh7n05GIQyBQf
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001//SpiderCrawl_1.0_TEP_alp.exe unpack001//ע.exe
Files
-
1db96b62a3e81b8083ca8ee2668f5dd178d1936dab470e43b01b9064e24dd04e.zip
-
/SpiderCrawl_1.0_TEP_alp.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 400KB - Virtual size: 932KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 224KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 6.0MB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
/ע.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 37KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 44B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 268KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
/URL.txt