�E�/�+5���tlv�_i}!����A���%M�[� ��3̏��~p�y_�Q������L�<H4�2 ���?����a#g�J��a�u�.ɳSFG][RqA+(,u G�X:�{���� �'D9%�i�̈́�ؕY;��L��ū�h�Wu#�2��A��6�#�ٗ�$@$������{X�B;�����j��=4-px��c-� lB�q����tT;;�b/qY���@S��$�X����-�~ѕ��'�j�)��C;�j�� |2N�.%�����~2�]��b��O����!28`���V�]-z��C�=�.��f_�~����f�d�'6I�C�Kw�?�G �!ŀ��Gzp�9��Ǟc��^싷M)�ǣ��Ҭ��r3��?�x�+v'0!�$!���Q�N����?P��?��|Z�vce,SY�n�����o�#�qM�+/�w���%&+ՆH��d��ݍ�w����`�Q��f�˲�7�+F����r����̈��E7 m~�7�3�S�vH6� ���IB~}�U9�EF�Fњи���L�����R���1D�O3�fD,����hϵ�"�y��RX��h���f�J�o�̢\�7���I�S�պ�>��d��B�}�ޡ�:L��YپV��f����bU ���?&�1����� ��`�䓰�QN�spz��F2�d� �����Z�a7��1-�sH�|�]���(A�|y���7�U� k;�2�>��2�m��O�ȳ6$��)���7�ỽ���M���Y���4��V����}N f(���ZV�%%$1�\ޓi��&�0c�_{�s�)iǯw�[}�@{1�e����-D���lK2$ۤ����x�����Ym�_T��p�<�Y��?\����aN��a�+��q����3G�˅r�V�F��%��c*g4���^�W����t��0��檯�U��w^`�CTB_4cK��S��Qsde���������;u@O� ltC����|���oY���)����l[Ж��:����zv��]n��=)�����?�� =}�]�X\���_����ї�+���Q>c�]�a�W�e{-�F�b���e��ǒ�4�Z�K]�4�\�ߌ��Q$�_���v"� v���6��R�D���h�6�L7��9T�UhP�Tđ�v�z_�2W���z*c�tp�����#�{;�g[��@`r)Bz�]�s/��=�"�wlԳ�h��)�� �<�y#К�d���2�.!� C��)���ܬ�X痲y���Zݸ#cLZe�����uS�g<y �Un���g��f'H,7p����R���[���^M�v�{�*F��*�8j�f m.qjl.��Τ%���R���]�q�o�e�?I�~�.RC��T?�NX����a��� 5^��ϐ.>� ��u���3�@[O����4�`bٝ?c�p�'���~.��o}C�;��T��95#h��X�1O&�4��! g"�����7�l ����o��E9����#�[�/����-�,J�(�8�9��퓰a�#1��[o�՚�S��5:m�܂q���9؈2��>ns�D��`�2?�.���d����D��!K�)�'r�6�C��*�U�-Ⱥ�>%Tİy���(Y ����qL�z2���9&��=��� �Ǻ�W�4�(jK�<�U�-)�%Fԗ�n.��ҍW7���� ��E��Q�t~����nY 8'��0Og ��� �C�Kl�&�w�z*/c_7C����Mm]����-Yr���8��;Ҽ,�LyZM�h�n��� �;�:M)Jh��z$�l])�M��C@������p�(W�~F���hE��L4�lJ|��^�L��(̜�]?��4�����S\������Z� s> ���ek�Dt. ���i8���0J�ѫ�-�z?�k���6�4M�!�ۊg�#ѯ�h�Dc9�������N��e�P, s�1 ��r;T��8`���8�h�Փ�j�Wݮ���R�B�{����j3�z�b,�5�#\��<��vS�g��(��mL��4����<1*u��#� �M��#g�$O����ˈ�����/�fʥ���XDE��!�'+kB}�&q�����Z���Vjre�[��S,�X�L�5�.�,�A&PݫO���Fn�t1�b8��=i�h�m'#1)���.��b��w�l��J�������uC�X�>qKg�/C���d��"fA�xx����_�!�Y����\6�T��&��&�5<XGP'�ˮ��\/ �l�}Tq����{� kce�1:r`}q��-e�i�ێJ_��K�D�CI����8KPc�U��U���FZ% |��ăG�������]>AT� �]J�]�)���'�aN�- ~z�S�T�opa�]Yۉ����� Z��$��~6���gA�`����w���U��m��Ujъ�LQ�Q�u���=`~'Y��J#���h*���k�;�V����[$爝�Ej)��\��ԅ#U8f�w�#E�����,��"��D���)g�+ҤF��۫�'KX������Ҋ��k�h��Hk5 C�0�l#�fN�6�Қ��F�_0����tO�S; {=U�C���g�x#�9� �C��;�]��Zwb2���B�}�����Ք��Ti�^ԡ����)�kY��0c����ܟE�8��H\%]Y��:Ċ�<��ؽ��~Y'�oTcݷdf�dj��S�yz��``�������߽�G#K�~�|�]me�i�OW��!��ԑ��: �w�)���2��� w=5p�ks2U4��+��"�v��ZT�k�=�FRѾ�+�����9" �U�.#�#���+3��Mc竣|-kbFŋ�n�K�-��� }�����K�dqF[}��_���g3_I�,��>�@�a��S�~a��ol#i@���3R1���F��"��o�#*�����ᨶ�៓xqΜ�5��-�̰�(F�ٻ�J�P�I�������8Pyl� ���`.k"� ={����`�����g8������ӆ�(?�@|�pzC)�ut�m8�{�Es������J�@�)Ѯ��oTU�����&��5����v��#��T�CM��l���yU9&
Static task
static1
Behavioral task
behavioral1
Sample
ef784be3a22fd220f7e409d9d821e9b8802afb63ba611c68a6d0887f85d5584c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ef784be3a22fd220f7e409d9d821e9b8802afb63ba611c68a6d0887f85d5584c.exe
Resource
win10v2004-20231215-en
General
-
Target
ef784be3a22fd220f7e409d9d821e9b8802afb63ba611c68a6d0887f85d5584c
-
Size
4.0MB
-
MD5
c1c1898e903d510a040ba12b7838b2e5
-
SHA1
91e814f99ace82cad8cc8bde919e7148bd3582a7
-
SHA256
ef784be3a22fd220f7e409d9d821e9b8802afb63ba611c68a6d0887f85d5584c
-
SHA512
fa073c10de4f3abc897f4f19bb6c4b6e72a5f0e3a27d6266a158bc8a236a44fe01c2e52a37d3a2b0cf6f78a6bc9e3a1bf69affa476b95e1060a6d3e226fee4c2
-
SSDEEP
98304:t3/+58f1r2yIrOqFH3aCv6M8mqHS4sjsmRzhIn98E3z9ADmrQ9CZlT:tv+y23Zt8mqRsfRKnWE3uDmwCf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef784be3a22fd220f7e409d9d821e9b8802afb63ba611c68a6d0887f85d5584c
Files
-
ef784be3a22fd220f7e409d9d821e9b8802afb63ba611c68a6d0887f85d5584c.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 847KB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 92KB - Virtual size: 384KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 378KB - Virtual size: 756KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 68KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 295KB - Virtual size: 296KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE