��[��j���g| bӨs�`�����0Pɡw���=;�~\��;�ݜ���o��l0O{^d�8�DX�{�?�z5V6�j���縁i((�0ʎ��$�c,�I�2lpOw�6s�����"ϡ��@�{��c�'�^4�|{ ��]�Q��ʻ=�%1р.�$���{�&�%�r�����z��F*)�m��>��ܩ�"ωn�t�x��K�Г6�T(�Ri%�;'վi1�䗎E���)��S�eD9s�������Vȧ�>��Pk��U� �RR�_�<>�9��(0Ѹg,�`��p� �/��G���pA���ܢ�a?k��n" ��W ����qд�r;ծ���8L�/��[Z�Z��l�'���S ���>��CN%D*GͰDE��'DO��.��R�6($�0���=�jM1��E^����TǾ��cNb�D Cip+\�E�s|���6�4DN��ǂ�u�z��/;��̽ê��Vc��촫,�'gk���$��Ba�wDo�/ !��A�N7V�{�� ɾ�<U��Զ*���к<��_O��V2C��=N���Й.5D�q�F-�v�[)L�v�����jG�H�+@���#��mʾ�$�������q����z��*Աj�o����'�b���P���Z���&���+<E�N+&ā�P@h���?,c�ݭ��:3�ս$WEz[)���I�����ǙR�J�/��[TR&��H5��[8�`��)L��1T���tM�&����:6"!��U;�kpe�^~��:�*D��;r��s�h$��t�u�9�ҁg�$t���bi��G7�~`%�S'�Ec�U@!���L�f��A��>�<���L�7d�O��8CY�$r ���#=#��Ա��3tuA���.�SIqǰ��f�}���S|��ˈ���|��"s��DQz�~����N���T)Q/��' K�PfԔ=~f��VOPY��*����2���n_B�ê�f��3��@+���+������a����R��"ۀb+l/�5�DZ<� ���*}>��%� }̖����4ʬ�*��o�XH��_�38����S�%�ĵ�������}�0J��\��te��,Zg�ئ�Ii-�����0m-I{qJNd� 6����穗�Q�u��$֒)�� ����{7�/�ʈn�1Әb�?��-�6���c��ɡW��A��>5�~�����I�;���'��ǡ��Nj�>?X�jƙ��#�7p: +y�%l���ǂK�۷<��%���s:G�\�n/��W9���)-�f������:�i��8��X���n^�A��e3�rk]Bb�����{r��<�[q'�ɯ$�M��72٠5���s^k�m�K�J�W�� #�# D;�F���J&L ;e��UW>K7Al�� -4�y="�P`y������li0\Lށl� ^}����,�����u}�����0"�L�u�����*�Bŀ��������K�*���b�GeZ�,�C�ȁ+�n�,��0"��z;�>C�"~�2��>��h�{�6��s�AW���E��P�O���E�)3~��r+M�PP��}�C��?HN1/�}?�>���'bp��o'&is��U�G�`c�ٹ�ZK�e��`��.�P�j"i�gl)l�4��Q U��P�Y����1��`Y�f^��[z:�m)2�M��֬U&AH:����=+�:x�%��ӯw�aF+��|h�JkH�F��%�S�����pKNj۪S���"����K�ŝO/�qc_y��k#ő6nF���`VH��e,���M䕕�tʼn^DEr�Da�����}gF"�9�����^ �M=����Rz�DX���4���"�2iqE{�Cq��D苄I�6Lub���T:C�A\V����o����OЈe���� �98���N�&���jU����q��B�4 ��#ۤ\��+};y�:��������,�*�x�]��s����gdr��$���5<��v�D��r���\�C�漑�̷K�;��w˱����! ��'�'OP��ŁS@|t#l��<��|����g�*�S�'�y�>��@�̲�47� �RK"Ќ_f=�,���T!��9����A�R��%�s�9�Gie����ӗ� �Ja���%#="�f!�0h��꿶���_��F�,O�62��5�md���HaI�v?������G�l���Z@�-�V���CnO�,��W�h�H82�� �ʍUЖ:���Z;����IywQ��9�Tr�uD����e�=1,I9�E��C��γ�}b�Q�`��ۈ��ҿ��%��H�| ��NY�����>R�܆f�M�L��JХ�OV�d�F�.�\� y���3���zHVr���֔�=`Y��P���f�/����;b��u,8�kC^�Fڍ+5Ka�i~ �A�פ�LL�����6�V�Ơ�k�K1)�]��_���ޭB�?���K� L}5����U4������WL9��r��K����>��b�}-$C݉ω����^��P����f1�~���̀ ��/�#-�g3���m%�Hx�����K�f���g���I���;����a*)W�U��=��Z�K)��[������D���3ْ}%��9'�����=0ZA\���2ą�1ƀ�d0��~xs_lK��/6r��������� z��7����<!�5�Kfg�v���&с9:�_}����U���.0R����!Y�9C�Ol��2�o���@��/�L㾨`����K|"9g�}i5a��%�q����8�S�*��s,X�-|��&�ʁ.���mǓ��\�����#u';�a=����>4��0"�7�uF�Ő���"J"JYI�_��gQ��Jp�}5:\����X�h�}�>E�{��`e8Ӻ��<�F/�� �v���2q:Π���L �uJ�( s��&9���� @<������8��7E+ӄ��kB�Na �?���a�Ei���r�l�j��B�8�=��gô�kaj����ݭ�����ux H L|��A]���z>1��TC ��3�u��͉�]�`,D����WN�(uT;-� �|p��TyfE�;�I^�W�)#��| =������`1*��U������˄����B����wKh�� ��>F����+$��c�B$��:�u;����9� ���Wkf��������ƎR5Wo�`�Gbw[����� >7l+M��Ν�|���+V�����ʌD���<�Tec=��hE���ͯV�Y dUO�j�(iV������z�O�����A�̸�S�ӛ wsG��@����>�\��k��u�A�v��я�{w~<��#C���H<n�K_J���е�����ү��3Қ��v5�e�����{@~1�����>���� 6x@ qp%抦���
Static task
static1
Behavioral task
behavioral1
Sample
94c3dee9afca99166dab6ff6d0547d11.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
94c3dee9afca99166dab6ff6d0547d11.exe
Resource
win10v2004-20231215-en
General
-
Target
94c3dee9afca99166dab6ff6d0547d11
-
Size
14.6MB
-
MD5
94c3dee9afca99166dab6ff6d0547d11
-
SHA1
6979d0c7cc3d96e3a5dc5dc67f4be479f1f6c7c9
-
SHA256
17bc7716f8525fdca444ef41c66e0b35149fba99ff0450afa75af1d201077f09
-
SHA512
6f95f55ed83e96d6c8f275b5cafab4eab551bc6373ed74a9a0b75d32b7f4508100cdbeae818e8422088bc979ca202d5d9930f08bf7ac44bf152699e6e3c5fb8d
-
SSDEEP
393216:icQmyQufRsZmS1wyrvW71cjH6YG+wygF:iJmybOsC21cjaMTgF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 94c3dee9afca99166dab6ff6d0547d11
Files
-
94c3dee9afca99166dab6ff6d0547d11.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 12.3MB - Virtual size: 14.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 105KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE