3�:��9��p+}4U��e���!�4��R�� ��{�As�i-�r4P>������y�Z����/�� ~\�)�p�C�!�N�D�*�UB=14���ĪQ>��uj�n��Y3q���t��|e�vK��d�ؚ�h�%�,�>X�7sv�����`X�ԋ�[��ܛ���Oiu�y{q��m�[1�[��z:��F�C�3�,������A~�v�$��@ �ᥣ���iw�dэ���p�����F.h$C=���� ~����,>�6h{S�Z�N�i5֞v��&� C�Z���>��U�N��Tg�����0���9��>E�M���O6*fA���60��H�8yB��`��٫k�R�,LOPfѧc�%;�lV�R�]����V%��dP�ɪE���bs�Ћ�(�e����Y:��:��4����Lt�nq��L�1�J\�OZd�6kY�q8+Q�+wa���?�������˳l�V���ު�d�=iT��8Fj��OO��9�6�q�ޏ��M!�L#��きҔ��Ϊ��.�t5��{~9 �X��8�w�O�( �����,�z�Dg ��^����/m葨<�X�G�|1��ښ���=����ϑ�U��V��W����m �S}s���<�U�*%s�o��T������hn�hL��Ųz�{W�����0Ea`�QOw�#�������p)Q�t�<��X�`X=I'����!���jҙ+��)l��d꯴S/1�n��a��B5 %��,�'/8%�3x��:�2������Q����C`;����b-!�am���hH��~ ����{�y�H��d���b�A�l��3�א��.���[��6̥��f������Z�mब|��L��_�:�g���V�Pƿ8�h6��O����a�j]t�;m��n5�t<��]n�e1G�e6���Q�*��� �.�YL^��_ .M�����o_���Ĺ����뀵s.�tc���/�������[�������N�XUR�+��zՉ�ckΣ!+���eZN�e��o�h�^�B�z҇pG��'�4L˟`���l} 2=��:���ٍ����zv��.�^�t��r�q����D��-Rd""�Nn��=u�v�g�p��n���sk�m����Z鿇˸{��!&~�0B������ R]G7IeU<ɝ�N����(>tk�"}�7y"=X?���J7���l�W��a!2ex�ݓ�(�f})zV�jK���[���d�`3i= j��Vu5e�3$G����:g�L�� ��� �z��_�Ww"�h����$Wι�����c���蘨��B[G�!!�ٹT�}�OG���Vx����z����N�vz���/��De/�����$��W\X��]�'T���S�Ll�4��X�GjUG�lJ������iK_���rʊp0^ؿ%�2����4�����ړ���Fr�3Y�zvf�>��k�[��c_�.�&p[и�Vl��*�0�`Q�$���9J�A���5�v��di���7�UY�����M=�l�4������� 'Bikɮ�ٿ�CN��k���bR��3����8\_���pB�.B���<��dvYZ#��by�2h�,.��9�b�}�.543���m$,��٫dM�ݼ#!���m���9���l��)&�f ��$�Ψ[۲f��\`�������j��Tc�.��p�+)�чJ�͝� �����_N�����(�i�U2��B�P����a��>���������%InE����Q+`ɧ�|�ދwn��Ȗ�"�V��/k��&���I�<�L�]�v%�|�;8��j�p�.u�b\ �WС-_�Ā�4ZΓ�>��c]t�y{�o�c �;�]g>@�1Ҿ�����SI���2�A����2`[:�SK��[i�?��cK��0g`�e�p̻ fKU4T-���H&YG��h�:�d��{R��m�H��P��?lM���eQ�r���Q*�;jOs8`�Бc����N�Ҝ�p*�mv������<�Krky�d%�[<dz���}�I�ýd��?R�Y�D��d�LTHhv+�4y��� {�\�����7�B����9����iI�S{��q�.����t�/�R��>(� ��;��m�&��z���[3$���\���o�{�1��z�a�H+α.Ql.�eM�A���`�����d����l�C/�X"�t֓4���8,�����T��*�)���q%��pt)�lo��n�in�4!�VЕ�9:W��ڡ���uX�ľ7�A~�ʍf��u����Bq�LVٕ�0����N����F T� 1R`#��J9�<]��.�0��}����T���r�c��<{�O�X��E���@����I�T�|U�`����8����3�g5���!����Z!,J��>8�mQ��$F�*$��f�!��z���}R���8�Ul�����iCs]/�����&{����W[؞A��s�c汇���b�u�h�K×����o�Uٻw����-v �������b�s�C3�(�����{{4�� -Fi��@Z�5>�,7w�I�U1w�C�o�c�Q�Z|��H�C�"mx@�7�3�PtU.��ÿ�ٺ�,U3 �F���S/WK���������v~�� w�B���=��D��/�����A<md��5��(���2����FLW8LT��s뒑��G��]`���sA��őg*k�x\���&�?��lPCI��U��{��?>� 5��zs���P\H��o8uؘ(���7�xǃ_u;J09�(�S�fj?�5g��PS1�I�0b�8o�gA���!�����5h��Z-7ئ"OT�2��Y��;k�����aɉ�Z�����U&~��4'ah�I��P@��O����.3E�羣��RM.K�F@�l��sU0r¨ϟq`��g81��H ��U��p��uг�]����Hh:ri+�p�k5��I���k�y�\Z���(T�B���������ި�=��Xg����tC�\��w��0ϔ}��I=kv��I�(>g!���p��r�j���!�_�4Q��M��ۢ���J���,�D��g���-���,�e��Q��4�J����@���Z��&9��]Ln���'�]rh��4���Ә�T�j+�ݞ��Bn�V�KR]r-o $j�wg�����V��{-='��-�7õ, �2x�ЉL>˳�pˤ�ԀwYy����;�X=Є��A���q����~�^��>yk��u���9�����`�2�u��pA/�:��� ��K8�ʹJTL5���S��c��1��rQ�t��H ��UY��uoAG�Y�ƶ���'�5��SZ�=ܘ&(��n����+�X��H������i��\�n47����R|o��O���{8Y O�y�� _����9�-�jo6��'�2�������%\���̝��^bC$�Q�S0Оr|����I��
Static task
static1
Behavioral task
behavioral1
Sample
a6571aa00e008bfbaf6fd5643edf0013e351ea4d3a7d5e74d3389c9d0d3a9983.exe
Resource
win7-20231201-en
General
-
Target
a6571aa00e008bfbaf6fd5643edf0013e351ea4d3a7d5e74d3389c9d0d3a9983
-
Size
3.1MB
-
MD5
7dce839b7c21809203977d1f8e43652e
-
SHA1
97682e8ed74f6d72d651ca7b20538750fa888fe5
-
SHA256
a6571aa00e008bfbaf6fd5643edf0013e351ea4d3a7d5e74d3389c9d0d3a9983
-
SHA512
551a8bf284fcdf3adc600394cedbfcae86124f18176c2716191a997d84c7bc58bb682949b2a40aad3ced1f51e58eea77e98427e8e46cfcbf9131d5dc6b4c9c10
-
SSDEEP
49152:fYQN8qMwZZp7mPl8aKrz8IgrquVDQPwnXAUW8kB7PBu3OG0vrxUosE:f3drp7Y8lf8I50QP8AUW8U7P4km
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource a6571aa00e008bfbaf6fd5643edf0013e351ea4d3a7d5e74d3389c9d0d3a9983
Files
-
a6571aa00e008bfbaf6fd5643edf0013e351ea4d3a7d5e74d3389c9d0d3a9983.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 491KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 432KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 427KB - Virtual size: 432KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE