)�"����:v������ڹ�+L{�c�i���?9e@;�e0�l�C���m�b̟�NSd�����Y[��\W�«a�ڧ{�@�7�d����Q�?0-1�������x \�����D�4�e?8bd��Y|���F7l|���"�~�Z~��K�c�,�A��Ƽ[��'Vb�bJ��i�;��$¦ɵS�ϵ��U�A���㍞��ҝ�^�{b%�g�D���&�|W6�_�쌁A�qr��� i������)SM'�m� �g綖�ˋd,��3�w�V�Z�^�T<&����m��t<r�bz�$r��Xj�(�V6|��eyꭼ����o� pݷX j4�JT�d��E��oc����M���P �@d9�����rA����O�o�$NձSQ�dN�����?XNW�}�������D� \�:���>�/b�5�D:<�P�#��L��1 QRΊ�� ����s,�c?�!�C�v^��c,�B�ן�Iת)$N��+���Z�^�Ѕޕ��z;&�ZQw�/�ame�V�DR�H��F�ܫ�f���/�j}�@7�E�k`|HJ���L��c~)�[��H�k($�f��}�>B��:��(gcZ�~jǾ 5���֢d��,~��ϟ�97�G���s�:���v#�4�2�W}a�P"|���a ���J�Z{E���WƘ���b�Z\F��q��d@���/��7T����蠾��@��j��\o�t4K Sv|C�D��+(l��߾��D1��9]/Z�Q�qc��i�U��]���-z@\�A�Yzu(D¥o���PΥ�R�-�'v+�/��� �D �:��kt@_����d��p�]����$%H��=v A�M����3��o��E�)�p����vW:�p�)BX*��vk���4<���8ͮ$�F��l�d��h����1�0��S��f�� E������,�W��!{�%RI���k��A>P ���c��c���A�V�w���}E�����d Q��;�-IYf\O�hE��(��sc���s��,�Aa��F��w: ���&�)]ӄ:���f�=N��I�)d�:OhҒ3�m�b�f9�?��E�_��C�����W2���H'3��`�:�\�ܿ��m ����P�%�*����jR��Wд0��u+���ㅋr\U��v���LҦ�,���XJ�r����ƹ��CzRo�� f�n��CX$!�����y���������_"�n����Xd6�b*$��ڏDe&*�%N�E�������xM�!B�2�����m�C�+:���S `B�*�%�i�w���������3����egi2�$lz�r�,/;e2ڷT���?���f���e�@����[�bR�0x~_ɉ'7�%�������3e���̴ԝ�vl͚7u�����U Co��t���n��PZkG� a���7T%Ʃ�=Rn�Z-G �8�ͭ�)ɩ��v.A�j�Xmj�)���73��"�x��"c��aCB���jc��Wxr>q����C]�� ��o��$d� l��%����o��j�x�I�RK�P̗u�Y�����? {��BR�OQ���[jlGw� s��1����X;�)����4��;��l��"�K<�>��([qS�.�StH�t�>B��@���h}�]���8���w(C�K�� �k��3���#9��_�� ��s�Eم�6>ҟ>c&+,�����J�;��8��z��~�a�\`� >�PzE�,Q���j������r0��R���P�Ѯsȋ�^nڨBx�\H� ��gK0=�� )�(?���7��:&����.��Ϫ�]]�e��nHyї1��z��~ɠ�����И��J�$};@�p �wc�x���dާ�K��ur�K ��g�0����Y��:���1cj����V6��\Fe:?�����J���FT��`����V�74������F� n�f�]f���(,C?�o/�(V6���͈���U$!�r�!,m:u �Gz� ������E4��j�U8��������2�Y�؟��1��[1g���^yv���X���6���/9�Mc�C�-`���߉�q�,WQ��w������3i�;�0�VJ�;���� M�H���:ǯ7�D���d��M�u�D��j��e<�d�(���/*�wF��B�3]or7��OK��:���o$��W�o���Y>��.�|Kz�J�f�B����{*�����ɘpַ�� ���Fܤ��y���<`�/�|w\f�D���v� �ʹ�_e����Ni���r���V�+M�I6^�P���.<���q2���rN��P9�\0F!�~���DK��2��Y��~��Gt�4��q�ޗD@���rv�)<\��~��g�d�t�2�90p���J=�.�Y�- �l�1م$����{�9c�-Xp%J�{��C��2���ZB�4`��%g�O9�T����ب@�H$�~O���M�|�l�{�Y٬�~�}��8��4�}*g���w:�McRQ8YN�ON���7 ͳv �ě4�WOz��J�U"U@��ɠ,60 ���_��#�|;:����B"�bD��єc�q#Y�I�}�OŨ����������DR�� ��m��)�,�(e �����@1�)�noV8D�7�&�L-�U$tg�K�d�����;��x�s=W�t��*d/�j����ӛ��p&��k���Hї�'rb"R����{����хv�NZc����T������좟��Դ�$���0�r'��@gv8Vf�i���y��T���l-��(�@�|!�\��y8�=V�1L6}o �g��o���lDHR���������4�.մi�ļ �C9���G�~=���������e��&�?�|��ERB[H [�������Rnf�sjx-S�җ�ծYuO�F���}��7YWX�ڂ�Xȷ;+��O� W�b��Z�V�`U�Idt6\��|s�;����� �bÝ��{�b,��h�������$D�BB$���vyM�����_o`茵�U�RF"/�u����p��J=�Do�$���Q����h���ʱ�U�Ű�(�-��������R ��'����eL����*����H+:�H���P�����Oҡ��v�DBsfߎp�뚆��Ӎ:1&�e���8̫M2�jhC����3}��/T%��4���9! @mZ�9#�<f����S�G���f��,����&7�-<�`����b">4�=�b�m
Static task
static1
Behavioral task
behavioral1
Sample
b1b8ed3802225be50a4140c109be319a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
b1b8ed3802225be50a4140c109be319a.exe
Resource
win10v2004-20231215-en
General
-
Target
b1b8ed3802225be50a4140c109be319a
-
Size
7.5MB
-
MD5
b1b8ed3802225be50a4140c109be319a
-
SHA1
690e5e9e2756707b2bfe8be39d62929f21cdd7dc
-
SHA256
983d4b79c8b62d0b60cb2ee4901966624b8f15b0d761de787a293ec424cab2de
-
SHA512
1ded545e14dada6ce3f389df7eb4453f2d9b1b30cc88ec95d6cdbc31ac29d42ea13091fcd00a063961817339eed84e5741664ea67ecd953c17dcefa4cc171bbd
-
SSDEEP
196608:Zeq4YxpErtAS+n9a9wkcqy6u8yGE9EMAadvSi:Zeq4Y/Ertgnq/byjGixdvS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b1b8ed3802225be50a4140c109be319a
Files
-
b1b8ed3802225be50a4140c109be319a.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 3.0MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 126KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.3MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE