t�� )��F^��'�-6�ܖ��G�l�h�l�e�,�hTš�w�-�q+$1���[H�:v:_���*4pc|j� ���.=��=Ak�q���-�ȉ��:C�;a^(liv"0;�N9�> <�9��\�Nae���E2'�n��5�bܦAJ7J���0���@�Z*1� f��1&�U/����z�Q�KnO�zH故F�<u;�и`�,�x�i��ҧ��0�f�@d7#ż�${����w�:/����@G�+uE!r�X�d 4���%��}[�Rq����MJ�֙����i���jH�(����|MX˨����^UP�e��7�囻 T�����s��fJ����_XĖ7(V.9o�Rς�đ�,��"d�)m�L�k��ܮ�����sII�=(��!��:.�P}52��J� *lk��k8UHH�N�93��1��J�|0���m�5ɝ�+�x�� }��d�q���1N�*�4�vg�=�G�{��͖o�fPOKdw�Z���R��o�$��$$?��<�nX#�+�(���8���9�%�O-��G~)^[�Ynv��W�E\ �ξ����O�i����I��a�{Rb��W��=���ȝGB�߆�N���f���L1)��ϒ���8��C���鷉��s���[;�;� hp�UOa,�B�;ۊ�L1��^E8'1�q����w������t�pZ��z�|4��*�U��������;�!����E�4B9}"��V�A�����/�Q��߾f"������sA���G�j���5Ƶ����"ݪF%/{�!�F��+O���"�hb^UI�7�{]��aUD:�{$���V[�����6Hv����{98��AW� ��'����E*��YKX�{�[��� H�QK�!� ��Y����yЕ÷�j]�l����}"�gK�(�5L�M�&l,w�`�`AV� %�����[od��'L*�gS[�f\��G����`%e��>`�]p����0�\�m�u��#�M�8҆�Ӄ1 ښ�=M��`�U��+�3x.�����$�j"F'��bO<��E �������S-�.]�&�(�7��z��D_n ��:e�������77\x"t��#�`�} ����AƱ��V�����u��bA;��lup���j�#��p8 i ��N��\�gFr"l^L�LLI͑���a9��h����_ڀń�m>�0h�1CHAXg��N��ً���x xw��s�F���q �r��D��%�b����|E���螑��ԗ�ob�9�f?1�q'�p�bn ������0z��ɆX=�8���H�dE~L+��B����S#�u����{����븖y��ݾ�.�1)J,)�h����u�y�� 3@p�u��H�E��f[ԯFZFbℨ� ���\;N�]��C_ՙ��A�����F�9�� �A�S��,ֱ�?$�t�ƪo�﨓DH��g�Y�9��[b���S>���3�W��4��~@���!�s�]PHѽM�Z�����;��������Z�����u6�#����s�_ TzP.;[_ew����Pj���J\>�î�� ��+φ6�)� ���Z}��û�C����`���<[IӜ�儞����ey۞)�� jr��u�����h��[6>� �?щh|��tߚ��&��?���)49`���������pGN ۱����H��>���X�^�/WW�TШ��-����*_ݵ)�Ń��ⷲ� ��O��=�����nY/�c�,����!�N�2,k'(eq������6�����(g�8-��fN���7�Wѐ���qR��.�焢5|b"!<HrӋ�/7�'�s'���=џJĪ�o[ٞ��U����-����%"b�M��b��1&IЌ�Do�C�I��Jl[w��uDQ ;/�s7D��cv����V��ٝF��vR�5��3�|f����@�ˢU .� X�R�"��M5��\��*�\�c��~Q��5JJDgJm� ̼��4ˈ��$�F{ ֫�f�8PmO��GA�5����/pv/��fh����D)�� �� ��g;F;�.^�8D��!K:�j<�����)v�5W��kʑ�s:ή`��t��M�iOl���*\�V����D�U���^2����&O���Z�����! �p59�$�A��d����҆��;,���@��Б�=@v�~������ 9���K���'^���=�UԊ\�5�R�:��#�a�y�BO�Z&ը���{�����*���Vs������Q��F.�} I~*)1U�t伆F]Bx�4W��'{r��>�>�\E glU�|1r<���ӡ��u�t#M$�@O���H�B/��tj�`����wqĬQ�(U m'�諳�����Dq�� 9b}/��!�N������� D|������m�po�Q��-�HD!�¼�ZӅ��<��n��~ݺ:���'l�&i1�Yԁ�!��A�x �NZ]���j�ub}���3pί�.���<(DC{�x�Dn���"r0ܜJ�+춪|�᧱���=��j ж,�y��;�*����9�)�T����õ�7�W!~6ռ��J)��6�Ƥ@���N1ܔK.�>!:�ܡ0R��~�"e|��uLkv�6�q�M��M�~jw���W��W�;�0��اϗ�1a���*��� O���d�4u�������P�= �d�7h�wV^T=3WE*Lx�����0�=C��P|^T���1�{X�?{5����к�7�Z�dp a�\�nb�`6�2A��lA6�S{���k��|7�6T.��g�eyx<P;۸#���"Z�[uA�"G>˙��)<|p�y�B~���a\�i~ߏÑ�%�8��F�:�T�K��ॆ=��}-�2��'�e�z��h�X�F��5� ��ǰ�з�V�^s�)}���}_���*�J3%�VVI�HX��\=�vq}U�L�{�1ģ���V��%����L�w������п �y��(p+�{�Pͥc�D��P~A�}8\~�%`y�����Y��H�ٹ�J\�Ī P� i���e�A��-TR�lD��T[�:Ձ;7�Gf�=�q���/|s-Z֍eZ�բ���b�p�H���ݜf;�Jl\���h%>T��qo+�ɫ�dn�LN����79dX����Gǭ�� G�Y]_3��kք��m:��G<��IC�m�p�6�5�kUH���,ċ�;�k��OA����$�k�}Myh�ۄD�-��c��7�ss�t0�R��'�U��Qz�ɪ�/����\�3,�͝�v������������\7�kf�/�\��ؿ/]H>J��W�nX�%X��aT� ��_GvR�$ǽ�X�Z��G-��/Jg�@�yo��+��h$IYAQ(���_��2��f1l<�c�*nY}_�K�Y�Ts�
Static task
static1
Behavioral task
behavioral1
Sample
123358138adc342c5ba1b925b3d017fb.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
123358138adc342c5ba1b925b3d017fb.exe
Resource
win10v2004-20231215-en
General
-
Target
123358138adc342c5ba1b925b3d017fb
-
Size
3.3MB
-
MD5
123358138adc342c5ba1b925b3d017fb
-
SHA1
f862e4b2a7305d1054afa7d254af4dac426c56f5
-
SHA256
985623d00580f79c9b16127f9181393fa7487390a2a896ac21c531b641a13883
-
SHA512
f30d0fba742fc65fe2ba2e22ac6399e7a9c88f4105a3ffc82b44e698e8947194b416b2915a662e0fa2a07b946692d7b0aa62b8ace695d7c79d28ff412fa09c42
-
SSDEEP
98304:oyff4+YEwglvIgtPNE2jv1YMdiEHjWNF4R:o4g+YS/VtYEkm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 123358138adc342c5ba1b925b3d017fb
Files
-
123358138adc342c5ba1b925b3d017fb.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.1MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 38KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 186KB - Virtual size: 6.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE