N�W��d��E��+F����Y]f2R�i�*�_�DE/��7�'���m@�Zj#�l��DB��I��!���\�X[���6�C����h���|˚�v�㡢�/��������l�-�Ӳ��u��/�������Af�B�7絚g����,���E��e`����RGB7�G2)�f�W]�Gm���9���ꋶ�B4ς)k,����qУ-,�?%^��>��ʟ)ѕD��G ���r����� ~z�h�' l��-��Y Xu�T��G�.���н�/���;�9���+fo���%�\�����?E�jJ)�kbZ��s�[>a�'E�[��dTTӥ� l��j���n��>7�9Q�WK5��x�<n��9A��ю������c�NS��������\uٰ�:�K�89t�6�[ve6�T��K��E{���Ma2諧��V���("`h/#AJ���xL�<|r ��v�wv-���{8�O�vE��yT��tk��W��>�d�������&> �0�B���4'�-��<S����M��O@�Ԙ{� �%QS��ΰpL���}�����˶O��:���8��7=ݩ}��A�+�'����T�JX��l�4���đ�������=ٔ/H�mx߬ߔ����<l.���з�Mm� 2XA��Z����b��7'�sCm Tp�fO|��`�������,�]l��K���[�����c1���6f��:���(���M�'���>�KcU���&�P��2Q[ fi��Vņ���'b��9��y�p�V�(�H����I��w��??��h4������M6�0��k�u�#���� �L����8z��0��Z�!�{��wY�ctMz�ϖ����JMM���>z�(�q��*������� ��C!+CUV�&ysH<����K����MI�_~)�x�N�>Y�i�o"��+�E�u2A��9�rQD�G��R�d0���Rr��0��1A�6��*X9H/(ӂ��������x¨���D�1�8]>R��dB[9�/B��<?�^3�\����庪���TsJ~G�q������#}�'��o���t�E����?���a /�(��"�q��*�Fc �����,�Ԩ 3��>Ƴ1ɚ@&K#���j�5?u�a3)-��_DxR _��J���n��������RQ���Kΐ6i�-*�<��ƥ��@������^�F�@ ��EKɨ��y%����f�t�6��Աv�A�f�L��0�ƼP� y�}bM���Xd����ʴb���z��Vs��4����yj��-���c���ړ���b��i��C�EWFO��Z(M �E}N�.u%����P3�����c<��y���/�y*b��o�Q<��P=�BARG�����^��1�;c�����*hv4�2b��05_3 �.G�Q�fn�~I�d+�����Y���� Gn�:�}#�yOs=�dW��*�4F��)+|�)53�'&�5���)��G�җ�oyNj�'�_��xuE����+���B�6k�x����l2`��1�T���1e�Q��cT���WS��Q� J�����ԕ�����1z�s�t,]O�ǻi�LIr��ֺ��/8C���,�T��Fխ��n�<=E(�!���˒�F1)5��J���3#<6�����2�=k��)�� 47�%))�s߉EZ��6�*�9[Kå��'�4H������Axn��>�v���>�K#���i�h�����N.e�4� �W�c<2��Cj�n[���!9'�d��"��^W`7�-�m�Lށ%���}M�d|���f���л��Hwz^[��_��`�T'}��V�B͕-_>��z�ѳ���0����V]ӟ�6��4��>w���ђ��m"C���1y�O�ݢ٢�e7�Zɀ�4Z��ʆ�Fb��i�0S����� ^]26B���z?�JI)��7�,�v@(�5�~q���Q�G���T�j��%�H$���F���ʼn��xp��I��v�h����@��ME�o%/���d�Ǧ�_����TDԘ���@��Y��N�8�N�<+�_h<�+�E!bo�������L�v{���t�yIK�z+����4��U�/rŅ:��9������U�t�>o�d{���jأ�S$}����U���Wjp�K�.qY���q��-J����`��lV�~���ÈV����hA����<���DX�o5AW��!hԣ�B�-A�߆u��ge��S�Ȼ�T;/S"{eS����%���r�1]>|̩a��������-e���RP���@�#i�m(��NdgW��XI6�H.�������tt��/�(u� �%���5�����7R�y����Sj�]��<���p����|��X��%ո��4��f�e[�9l,! E�QNv�P��@��g��$d��e^��+ K�*ʠ[\�$���!c�h�����"ܯ��Z�B/t���\��!z&���2>���\y�ԣ��s�0�,��<: ϧsNeQ ?z����9��;X֎)ͼ��c�Tv!�����������4�1�%/<�Hv�j^ZܢIl�(F�'`�+��C3�h���k��Y� %Y5��q22��-Sh��ێ�k�;Z`�+��b(�Y7��qf<퐠����$bi��K�Z� �6K��O�y����E�C�&�H��)_U">z~��Ma,l�,�U�{�����+CLcr?S8������i.t�*�S3`2*d���+�£��C!<��g��)8~�0���I��"�_BS@��� mݟ��P`Z̵�����t(,wE銕��3���ؕ�R�vtϘs�@���0���} � Y6N͌��s������۾��Ǹ*��'U�G��@�`�z5�;����7Lb�-��\��&�ǩP�7cHF��\ 9\3���+%bB�����59�����9����q�9�|� ��Fh)[�k���xp$�8I�]��d�*����a��A����sW<�&������S�M=8��,泠y�HF�h�7|�D�80�HYɚv)G�Srq꼵x�}��;!c~?2�w���.|�ה�v�\��E��s��v`I���=�X��<=����G��&��N�$h���2�IUc|.)���8�Y.��qw�*H��%��b��Q�O[�[�"�~CZ����H�J�_�y��b�n*�uyԒU��%���*V"����V�AR��Q��J��S�]���w�a�:֏�����kT��+�xw�6��k�4�>(�_�����;�����ڡ>��p�{�}B�,�AB9�E��j��Y�ʦ�9k~d]��`TS+H�Or�P�m���c%(��ۨ�{��s�@�iG��a�m�Ns#��7c�b�"��� D����w�����q�P�`B]`yHg�w�2K�"ot��Ra�#i�)
Static task
static1
Behavioral task
behavioral1
Sample
f1802fea7314ce449a91946805748383cb97ffbe68fdbf0e163ecf6cb972b395.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f1802fea7314ce449a91946805748383cb97ffbe68fdbf0e163ecf6cb972b395.exe
Resource
win10v2004-20231215-en
General
-
Target
f1802fea7314ce449a91946805748383cb97ffbe68fdbf0e163ecf6cb972b395
-
Size
3.2MB
-
MD5
70b523575fdbecd1c8ce222b5e06bf36
-
SHA1
c7e5fe1ce7531289e5f37d4983d464c9ce58327b
-
SHA256
f1802fea7314ce449a91946805748383cb97ffbe68fdbf0e163ecf6cb972b395
-
SHA512
8cffe8c28babe7f3900cd703e84fd955d00563c49a40d9f25bf625a36427a2e705a73316c22084337768337baf03bc716315b8331fc92449492284b432b67b7d
-
SSDEEP
49152:xzzxmkEbftpL6qxI+ftflJPTcvgVQu1RNNUkM4HIfFhdakLIGNuSIkP/AyAVgi:mkmt9hxyvTqNqkrHovvLNVIyAVgi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f1802fea7314ce449a91946805748383cb97ffbe68fdbf0e163ecf6cb972b395
Files
-
f1802fea7314ce449a91946805748383cb97ffbe68fdbf0e163ecf6cb972b395.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 163KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE