�u��ݽrAZ�I�5� a�0�h�g�6�����K#80�b�������6��B߶�t��*��@L��.���;�'���,�C����[C�y��0X�0���� a�?�|tx�F�Z��-If�l�_m�c���d�-r�m���x���4{Ao:(��μ2ωD��O[��.������n>�i��������w@��w���M�*9�7_����Z��:6�$�������ș�Y�Ao�|�,��TIJ��a�B���nk�XY� �vG�4@������NȞKR�� GLF=w<ۘ��8�.P�Ax߈=���9N{�II���C�h"rL�weS��=�. }��}���F�I�}2^ٔ�r��rY�G���$�'�V֛P�ʘ�M\��Hpz�[���PO���/�E䐄��\��܁5�!V^��*�|[��XMogc��oό����-/�����Z@��~��[�����y�� ��`�ϲ>�rŢ`���wθL�x�)_�r�J|@�'�����JB�|q���>g�5�������g3 �7::����K�r��D���z�*<b�Yq�r�1��i%n�,��a����KM����Ӻc9X�A�Q�?��v���$qH0��� ���)ga6����-SCX�]����O@���j(����B��7x�b]�\����z�`GS�B�l��ku�Vw���� �m��2o-�Մ߰�Z�%G-����B�;>>�ħ6����֏�}(�������!r-i?�~ce�|��o�$�<��q7�P�4l��GK��;�quj�.w�'�R�&��b%qh22&��������������Z�6]����l��JM� f���Ht�뺧�%F�(�q������D�Gj�q����XZ�Xi9FRY;���Y��)S�E�ǿ�翛��_e�أ#����:w< ���������A'�.���X���*��ҩ��"_�o�e�8̟����0Z�� �s5�҂x���0 ��m�5Xvvze�V��x1Nf:u���� v��Tm/��_߶'�Қ,&��u�79��d�Ix�C5���*�����"�9�@�����i}~?����*Ł<�K�<z+8NQ�Vp,®kMP���!!�������j)���X'焂}��a����( ��]�I��7o�8��LmT?�ۋ�,",��A!�`�u�A��ƾ��$����3����h�M)��'$<���}x�r�r6V���O�?��o�L����,n�r�������8���<�A �yp0��#<w�,���R6��8>���W���������J>3�U<�t ��J��L��*�ʠg��(������Am�3�� �0qa����"B`�������@�Rf���b��Xś�¼&�P���t�DLI�f���.&�Q����E��u[�HL��rFn� V�����t4�j�.˛v���q�҆#�ٍ�Z_�"8'����r�Wb.���]t�j����2�_~���ũ)�E�)�~J��Gdڸ��t��]��TEf�ۋ>wb��a �3�R���_���!a�7�����ϫ7��|�x���+��� d7cP ;����D.Ai���a�U�6�\z$�) P3ѳ`��cH����\�g0�'�����G=�ܚ��i �Z�Q��#�^����5���<4��%{��.��z� � &u?\�A6��r�apm�"邥�l���{�h������g���%#����2��a����ݲ�}����$Ym(����1Rd�^��Zk��6���p�% ��-�~# =�p0`����_�Ud�N����+�@�c�t�!�����s�..���u����7A�m��0z�U<�^��-���)v��w���F`��8`)�K�A�_�[�} �3���1��J���r:�>"�/TW���u�p�����y�'mj`�:��/�qc �4B�4^���T�ר7���ͥ�����Լp7���I�=8�d��혆\�����,�Q��pf��}������N��9Q~�.4��0�gQ������H_����=w��b�xD@6-��Q=���^�8T)�B�/�[Ģ��z��i�A���d��,:�����g��@��9+�l˒��xgh O��u�� �6��S&�Ni}¥���3���.�Œ��`iw��DtM�j��Z�0����V�՚���A���:��������w(����� Qf�եځd|T���V���jx+_y��O��(b�7|�Q���S!$�'f�y<Ԧ� ٞ�|��7�HK3��L�e;K��E�Yr39>�������/c��;k�+����_=6�E���E�C��!�6�C>捖�Z�>���L�Z���S"�We�Fcd�{������&�1-j fu%˧��������p�>�Fd.����O������"/:Xw�� �yZ����� `w�1p�(呮a�ғ�-vg)m`��}_ �/���N����a��R���16 >����Jk] 7���]�dT:;�+����F��h N"K��K�HP����*��~��g�@{S�"n�GaW"%�B�ڰG�T��v�"��s�MƤ�n�έkپA��4�kŚ�ޘ���FK|�?�Fx�L�g���{�����dq��Y带d�ج�+�>!^����KcR�0o�}-�D��'�S�5�n#�����A{��k�R���J2w�����/SA�� �i����v&������ ����]!���bBၞ����Qq���9)G�TPU(SCD���_��A�_�t`�$����"n�A�l��^�0y��㲎��d�`5ٌ?t�<��5���Q��$��4��q�d�X��-�ן�<�Ր��ﵟ���z�T+鑳����i�Q�E�~�Ƥ�����E��Kќ�v���3��u���%jeb�Ql�N�gJo� �R� ;V+�A���=>��~���=�ǍĦA��H7��9n5]�7��]}n�E�{*�h�P�FOa��@1ƾ�n����[G���S��NC*_'n�Gq-p��8�g}{�f2-��T�<q�����Y�`�+�|h�3ќ���0gwP ��
Static task
static1
Behavioral task
behavioral1
Sample
980a822d59ae915d87a9f1bdf5eabb1d4a3ac6b7c4dea5865121e56a96600d62.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
980a822d59ae915d87a9f1bdf5eabb1d4a3ac6b7c4dea5865121e56a96600d62.exe
Resource
win10v2004-20231023-en
General
-
Target
980a822d59ae915d87a9f1bdf5eabb1d4a3ac6b7c4dea5865121e56a96600d62
-
Size
9.8MB
-
MD5
6e4549ac5b18960f750e1af53f5f83c3
-
SHA1
e6904ee5590958d0f82a5b163340332997d3fad9
-
SHA256
980a822d59ae915d87a9f1bdf5eabb1d4a3ac6b7c4dea5865121e56a96600d62
-
SHA512
71828769dd657e16e37b8269a8a516cdc1e5569d06b30cbe37b4a3ab22f19d3e17e712dd757397ad7ff13a7da8797860ab9560bffd4ef10e3912298333d7eace
-
SSDEEP
196608:Q3hhtQKT4rtZS6juhbowIVrfdDLD8aWJQKrSxEPAWWjWETKN1:OtgrF6wDtwVJtrS8AWWKfT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 980a822d59ae915d87a9f1bdf5eabb1d4a3ac6b7c4dea5865121e56a96600d62
Files
-
980a822d59ae915d87a9f1bdf5eabb1d4a3ac6b7c4dea5865121e56a96600d62.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 860KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 10.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.7)" Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Q,/ Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.SCY Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.S$l Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.5PS Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.~F5 Size: 9.1MB - Virtual size: 9.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 755KB - Virtual size: 755KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.newimp Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE