r\�?��.F�fa&<�k�etx]���2�e��z�Z/REQҋo#[Q[o| �Y�c���_@���@�mJ2���b ���^^r*��� �(�1��t�M� �wR��\�1-{\��/eA�6a��=e�X��<�}�a�t�L����HX$L7��&\$�ͽ�l�������zy�C��: o8/.J׃D�d] ��H��\6��J�q�ҷ�Jl��_V>��A0��@��Юiq�[O{@#av�كPl��֚�8���Q(�4|+�&���;|83X"|�����|��9S��6 ?��>X+NUH�B���Bq�ҀQ��m G/y�t���)4�?��>y� 5]D���D���\��V�F�ʅ�J�?�ŌN��Bj�a�I��T@����@��v���ni��G��W=�lqnې� t:���,�ޥV�G�5���k:#7h���y�t�s�}]�,�������(�� �(�}����֍�7�^Ґ���E�©,$��O��u�ӵ�ʦ-�+�=-ū���#Zȑ�x'��� ;k `�Uk��c�js�� ~�0���pԐ� W���m-|�b��tm7"�q�:pD���?��&1Y�@�Ό=V��y�4 Ţ��p:Cu��\���9Y{����I\���V{|ҶǞ$�fo$�R�2����I-/-�v��<-��6�+�R�\!�������v���P����$mx#�I٨���'{%iI�z��I?�Qɣ�h��-�s��� 9��� ��LQ����܂����(��|_{|\8�2v�=i����R�����S�l]�:�ژ��h� �й���wx&nX1y��p�� �ge�5���P}�^+K��O߳��+O��2K ����J�b��ueW�Wa���*յ�no8���4^�ҟ3]E(�V����u�� �k �6̡P1GE��W1oqrz=�S�U�c�����c���0�*��a,9�B'xe�]�E$�����{�eP�4�]�;��CJ�ǀ�8VL$�a�0�-~�&t�ǰ���Ut�t�w>Z��/�?V)�!�����B�K�6��R9�)�'���4��,������>�G0Ʀ�*� ���$�!?tk�@U?��3B. �`V�[9y�-Ӵ�dZpa,l��{z�w���ZܯFr o��X�b�'�����-��M��������!�v������[�#���i荹�c�;��o�}�K�����6��f���.�!�X����V}�����G���"g@�=��� ����B�#�}#���" �$�U�s]�GK�|֝�{��������1�^m�o@ܦ�o�u����� ����_�J�.<u#jҎ0�o�u���k}�8x�,��=�6!�剓>T!F~�ѐwPۢ �H�8'%�+g�������屗���}V��)E�|����4�^�,'{���cr�Xsl�����i�C�VR#&�$��3 XR�s?0���R�@�(�NTA\������%����� uUP�DR#��+���Ká�7=虜R�Ġ�9E��t��VN-��P����!��e=S�YR�h��:#횣zhĦG�u�?{Yz����������lϣ1U��~)ʶ�e[�����x ��USw�2�����_CX�����,j�9H@��g\�=䨪�&&HY����/���@����x�vkaN����a��Yk��Y����{�ϝ}Ǜ���T�����gQG���}��SͶ ����ۂ�A��ҋ�!��TK�>4G�0�k�O��^�h�)�E[���N�n3��I1�w4[��:c��S�k��+���P,:a�쑢�(��i�-���Oݚ+5�eoS���[�d�<"�A���گ�����G1���]v_��\Af佔�?�����;+G�G;��m�k�:4�������[[�)0~b�\e�{�r�J�N(�m"R ��c��o-u&��j�)�fgA5m�W'ғ=<��,�t~����)�z�d=��N�<L�ӎ�F�� G[H_�i,�p��j�K�y��V� ���+e�2q��P�\欱L�����X�Z[��0���C l��� .�~�c��ΰ���{Al4QyH�x_�)�F�]�)����k�CY���JF���V��&.H�!*��x����T��YO��9)K�u�Bld&@7.�`�?��[��s�����j�m��N��w���}���yW,�A���*�U��ta��V�v��t4H�-io�_+:���ӛ �\�s�s�������+�1)ܫ6<O��iɿc��)��3��C��cZ�b� ���� }[-Of�/��јY9|���L{�v�BrR�5S_�/h�d��_��%t�I�Soq�w�z�?e��.��6�[��ZR�����%�x��3��a���s�+��-��g9�y:�7�Z1k��ݾ�Qu$-�g�0�u���vD'��0�os���\�Iް6%�~��$�d����Fd ���,���Ψ�����^���{V��#ѣf:W����X�sIr|�ҟ�%�NZ"h0��fe�G�Xp�E�0�u���wN������F��Q�2���>2y�'뢜2$�x �q�&T����}uk�#�c���)��/\I���j������0���V��{��+�f10=��!��L�:�li��,m,�o;�@I���qg�#��_�~Wyy��G�7y=���ۜ� �/-b��#Nwo�]ڇcp>���.g�������s}��\َ��4�p|<�f �s�@�O۷04��2=��9��b��֍�+�y���=����G��Ő��Y�\�DҘaPKt�O�]��'piat��%|��N�=���v+�]�r���>^��8���e��U5����Z�ֿB�%HjPq������C���t�W[6ʮ�R�v�2�#�4�Z�)�ެY�`u_2�*���J;#�o���I�8��nH)��7-�q���I�Å��� �()���(HԆ={��g�d�>���'��|�k�+����mD�a�j��{����3pP��[��_Ϣ�,��۸0md 1NNZٞ�<��߸�Y_M�]AE��Et6��7�2j!�<Œ�����%���E�{�1�j�2���#w"����,� *��fΝ�w?�y����"��0m��%� �`ZY\)��T�C��KCm��@�b?��:�}���mx8�'��&���U����a���5�c�0���!&E��Y�_CXa���E��ۺ��6�>$� e8�I�����߂�%�檜�� Q)���v� |��l�����P���������o��%���*��i���K�`���J�����>tOG��ۏN�@�D��b.|aK�������1g�$j���n�!���N|[���B�U1wʒN�/�5���1�Z$E�P�ntB���-��;������S+��h���o;��h�����J�&6sA���p-����LOv>�G��Gd���@���7x&���؛��t��&M/��0�9:��/� ��=.ce5�P��S�܂c���=� N�(�a�8c@ ,�������,��] K���B5�Yy��ݮ�F���^��������Y� �_�|����fUz�=���ߊ��٘\���Y_��11=.{8��e�6"�4|�e��
Static task
static1
Behavioral task
behavioral1
Sample
213f59eead51a270587cf6486ead47f7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
213f59eead51a270587cf6486ead47f7.exe
Resource
win10v2004-20231215-en
General
-
Target
213f59eead51a270587cf6486ead47f7
-
Size
2.5MB
-
MD5
213f59eead51a270587cf6486ead47f7
-
SHA1
d2729fd2095b81c9fd556f9a1475b8338b79bc40
-
SHA256
33eb65c0df876d5173fde3589988c8f21a7347265c39a76d7939357f4698216c
-
SHA512
e7aac4263c90b7139d1f727837983339002a489270eab43aeed3f050e65bc9be161c30828afec4a33624d98b8acae3f7371d3a58f74a648e8cf23e6595f8081e
-
SSDEEP
49152:l/PN0Mk7rNH7ohk529KO6UwWpVm6Se90apT3W2louXJtkbThGIG9:l/PN2B+kA9vG6dFEyJ2xGIy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 213f59eead51a270587cf6486ead47f7
Files
-
213f59eead51a270587cf6486ead47f7.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 153KB - Virtual size: 512KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 163KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 186KB - Virtual size: 6.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE