Ф�'[in��+�5���j���,�D� J`%'�ͶAG��a�s}�9�'� c.3� .��VU�f�NH��ki s!z� 1���?�NIXh�/K��7V���+��1�I�6�1ɍ5���<�>�`�o��_�tLj���Q�{��c�N���Rڈ��Ӭ���U��Mfz ���a��\�{�v��(��{y�PZ����|�tuΚ��lF��}�5�aEnҝ�(�6M��k�8�W1r�c,�[�g��r�!j���xJAE�б|��:�8���1�}܂�� N��h�5��t�N�ͯw�t�X5W�o��w3-�����p�vf���o��j:Co�_��f��F��Ud���s>:�ܴ�[f4PM1��},���I�R���_���i����^Ҩ� �j�+��Ж�C�q��H��瑵��U���[ܡ�v�N��6��@�vC�zz�o �;� �Ur�\?�eM���8"I$����I�d`%M'����<�1�J�0}"j��M%B���N#Vo��������p�o�&�k�B�ix����=aw{�Z+(-� �����o��NP2<N�R8����d�.����v����T��/Qk�c���]�_u]4WV4^(�kV�C)۪�>��"�(�,2�>d�p�\���n�����f�r����zc�� D��yc�)�Im�������b[�_,�"s=u=���m�8j�.�ۧ��� �B��F���G�>����S9��>�0��|�h� ���2+ l"��+- ��9��_�-�����Q�ީ�� b+L����;Ƌ�7�68ve3�m90������GBҎ�F�����e�M2��1���.����R����T-���'�<�"P��t/��.:[:��i��>m�T_�ߔu#��;�G��!�����6ƋV#UB��<1��N�?xe:���D �� q�=�Wu�N۲��|�p��y���0<:��guT�1�6����cю��$��|.��h����M��@㥋�W0�U)����wo����v+kdL���]��}P�8�/E�[d `�KA�i%W.���_�����p�7p��f���e��-����P�TQ�^� �7&7"TVZJt!��J7Vww���ɓ��b���?^?L[7{�Lm�a,�x>.#@ �9<��{s>�Y��:��_rM�i�?��RŽ���3p9 �(.�=������I黀��E�T@q(���C%�1C�\!B5р����4v��j0�'�$���1I�0���z�^�+�����P)�g�d�Ȱ��V���3~�^��!;AA]](���3�{k\�ِ��Y�^Vf9T�������J�0�5MBwOH3�S�>:D�OcD$�����S���G���Pѣ��JsT���p:��M����AeYc���������C�B��� ��y��ҹ�x�I���Fܧ��'��bOT����d �-AT[J��9��%�4A��|-�j31�w�e�y8U����72"*�ٙ��VNΏ�LƓ!��|q1�ӺM_��pf=c�8<�?P̚Tq��bݟw�{��Z�r9%����BX6@�X��3�x@��?��,J�����G!:CՎ�8NI����鍾�AH�I�yOw��Є9�X�B��s������Vl�;ʞ/�U�� �������2�jǚ��#g��q0+�����%B�i����w��� !���!���ֳ��@��|!֙�Ϥs<8���L���Л��lGky��d�sA�<��\����r��*�P��U�G�eC�o���#��w��R���@�r���"x��}��zZ����D;�@i�.d#ήD(�����״[�����@�h�P�ߟ�5:y�� $���D�)x�1H��.a =e�|��+�ƱP��m�;h"i��J�����wz�Ŀ��ցʈp���|c2��n���8����z?^R�d������hQI4%�5��VUw��Q]����E?`aPpݟ ������b���)�X��Γ�����qw(�K;3�IX�e�5=�Fs���BqO�qn?a�c�"�C|�1��B�"�YG���p"�D�r�q�j�Q1�=��{sMG K/����(3��# -���?�g���Z�n����o�&ү*j7U�Ѭ�*�X%��B�߆�ҵ����,?�P\�-���a� ���pd2b �&!>��R�>RX��Й#��D�|��2��zoD0t.�7}��8e������Ʌ6�;V�c7;�����d�0%{J)�� t&�˹8��C��bP��.-���&rJ3BJE���22��P���>s�}�0s%����>-YB?^WII��F�Θ�%IP}�(�`Nn�.�S���T�<�k�vx�� �`cw�����\G�$��~6�q�F���nvr[�"�:�C��Y52����)�IC���������mWW��3�FZ�B�j ��f��0ܤ�DH�g++B�X�p��7ۭ��>}u~�h��x�ZM�&G5U ��Յ M����V�a��Vw�����N���Nt���������T�9'���%y#�_����+�<67@��R��0��=Ͼ�%�;��j�e.G�.���\#aކح��Q�l:�/DŽ��Ɯ������y�{�������^|&o��wBه#�<U Ҟ�9��]�is��(5D�Ɵ��,Ā��&�?�����E��(8O�Au @���^h��rު�?�(��6SR0L���wt�Q�䳳=�>�9�|�Y����0*�j�·��ѿ�<Bt�M\������RN�;�~_�Ȗ�oG�$�z�(��1���ʇ��t��[�;�P�A�d�5�.�"�lJ`�0��:�l7�J���w�nXc$7�А@>v���l�+��a�(� �Y���8V*���\jN<�\j����0��ӏ�_*�e�L]c��c�Z�4h�L\Y5T��m�|o�a�6��!��u��j��?� ��I���ﱉ�����Ν,��~ʡũk���H���K|�1m����b��C�[9�Ե�k��!w�41���0������[Qց{���OWZ���܀��Y�MM~0ۥ��;湅� m�F� 74�'{��0 ~�W~���~�[ %H3��u�ݣ|����Fl����!m���C�ę!͢6���/��0��@!�� ����3��cOw{]��\Y!m# ����r���)}��j�:Y��3/i~�c%��2 IF��F��:`p\���/)}#����K\��^�I��ߊ�`��@�' �Vo���t��,���!s�k�]�v�wq7οX�?���ˤf�Hơ*����t�i]�9K����;�iԐ����+߶G�m�%���N��������i���04�CS=y|��D�@�=@R�Ve
Static task
static1
Behavioral task
behavioral1
Sample
567c7cc8dbc41709e622735fbec78d31.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
567c7cc8dbc41709e622735fbec78d31.exe
Resource
win10v2004-20231215-en
General
-
Target
567c7cc8dbc41709e622735fbec78d31
-
Size
3.7MB
-
MD5
567c7cc8dbc41709e622735fbec78d31
-
SHA1
ceb4636c3a8886cfcf9ad875add546c90c6b3b1a
-
SHA256
0d93940e74933e74d9bacb3678be2dce9769af15658934c09db79ee0df1e043d
-
SHA512
b9e7ff46fed5b6f5799f1f832adbb1bc714534e3e3829203f4fa8e0fb5472faba0ba6ca42d4284164fc3675d9f34fbe5d7f61626e60a25ef525788a53a17e188
-
SSDEEP
98304:PBk3y08+tiC6WosZJnhhdEWXVyXGR7YQbwqNjj:m3MZCEKdEcVyXGR7YQskf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 567c7cc8dbc41709e622735fbec78d31
Files
-
567c7cc8dbc41709e622735fbec78d31.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 82KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 26KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 14.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE