^� ��ڜr��D�6�f�0������^�K�re!ow�%ڛ��?��3 XCMΏ�?;���39�a�+�����N6�N0*;�R��h���,�� ��̨�d�xK�;����`�h/@��I����nB0���y/����Qm�����^ݡ�'H�*�����������>��u�����P��G���#����h��3ᷮڲ���@ ����� ,�b��3_�H--{g�ç��J˰ꤙ�ޙ��{iB��G��`��N����B�c�-rA�W}g��ݨ�u?�x)��ZI�@D�^�3d����V�R��^��s�O�:��JK �kaܡ���M�c��{0�JzQ�p�M1����^�m�F8�0��/c��%��(�*�}��>���*.�&H}�T����5�zY���!;�C��8�L���F��D�\���]h�hPa$H����t����D��M�E_�Nfs�4]s��AQg-j�7M�� %zV7\e��2B�vGG������UV��z���f ���� �S�}�>���[�%�����R��h�."��F�˳����1��՚�4YU��0�}��hGi@+\'?s���V��������+N��Wu��/8����?����@M�9�G�K���3����?)�"�����_��y��2�[4�Y�j9m���-+Q��4d'rfwI_�+�HVk/E�t8QL�=X������ B����q���(��}Nw��ެ����˼*�P�����!E��a��ԍ5���ƈ�C:�>���R �m���AĤ�PK��?�tr�e?&�ɪ��a@ÿ��R &��}�46��-�����m���*��C.�`���- �qu��rv0��A���t�(���� F閡������͞�&nGT��Be%6>wMIm!����=��������ߐ�[�f�azK�@|N�B�g�����D�+�F�C��?����a��O+wexD�e�=��dЙ ߤ��� �6%����`�6��PmH�d�Y�X��d�儒��V���! h8�W�hI�F5W�����n���A���������a\���"t&�����F��we�7�� %������JoD?D(l�@��Ʋքj�K���`��Wu��h�����X�^^��z���{%��ȣU|�*�^�{��b�ۄ�4�!S��N ݴ�=$W�";�)�bO1@�Ǝ�ӼV�02)�X��mi�l��)�႖b yXr��=*�����m!;�s�cSI�j�ݞ���� e~�WQ�GQ��y��G&=$ 'ja��X�����B�����"�NJ>�I�^�+�yހ�d��%<���C�Ke�G(�-��Q� �� }�#M��q�]�!�d�sq�H�SA��1�������(y2 �ѻ��h={s�g��:;4�S���sBI��L+�����.6\Y��0�81�Y���@VP�_���^ӝ���߭�&���bVD��O�5Gc� ��5�{c/w���Mq��3��+Mg��P���u��[{��q"�;y,D���'ӷ7��Kh���ց(B�6��(~q˫%�E�D���V������K��x��K���ėe�y/���6��D\�n����u��0�1u�5��#܉O2v�w��"S�� ���k��0BD��#�� )5<�&l����H��+�<B��aA����N�8���Qb���LP�l�*�wS�h*�WZa#�D�Z�*�[�)�#�U)�4����X��CNួ��)�{E�*5�S� �9]���Q������S��xq��3"�8��|��m���a@^^B��Zb@��=�eI��z�j,C����K�}0 '��a�2e6��.�^����v^R�eV�����@��9���&�e�{�*m0��a͆��A�"�V8�q�wf��J��.�P$����ݲ��&�J�\��k+`?h���p�%������{2�l���g��>Z7�%�� OL������y�n U������#*�"@�H S��1`q]������"]�4���8� ��$�bQfn�8@��ȇp��.�c��� Է:BL�Z�u�o���,�����>�_q8���U�f~2��1j�_� � �qP��U�{�8v��'�g�W�Щr�|���B��y��-�m��Y,f��m�J����C0��ea��<�ʓ��崈�����:zF��*�;�#��)�M���F�v��`3��������C1�R�4䥛qT<�� �~j��Gn��}�Vd�Y��0�HM���юh�f�+�c"���h���~D��+L͑�9�P���<J�8 )�#g�&���+���`9��JJi�)�-vJ�6ۭO�k.�eB�Ή���1@���X/��/`׳�N�.��--����5����U�L����"5����Z�ԯ��1i��{������`�E�I4�YJ�!�O��/7�4eu#�%���8\#=H���*���$�OV1[���S]�N��u��4��l���;�0g�6�M����Z���Q�v�ݔ�aQ��-Kp���� �� RhWA�̓OS�b��?U�M-+�2�_Gx�}4��qvI&0��Ѓw�����@f�'�t����7)���f���K�n T�� ^r�}�>U�o�H�h�l^�A:*��Qz�}�������8�@^���G~�-rЏ-�U�Ȓ�:Ug�3�:��?i ���`c��O�/{_$(�5Z�Q��3>�Q��r��C��7s�F�_�=�B[�Y��e�D�)�k|`�E��U����Hߐ?:语)��A�I����I{��t�s��ap�i+�ۼ}� 1�>�a_���d6�5H��ibߛ���9��01�u'��I���H,F͘�o��+[�%]�Y����i�B|�# ��N ey������K�rh������"����Y�N ��������*V�B0�S�w���v�a?���[�[���b #�%.������}�a���&�����q3t��>�{�#d��ĜZ�(F�M��.�Nl�+�0dij�< ���KR�W�"B�Z��;��$������*bi�T�?��C @��l�D����M �4@IfZa����͐����k�v�����ip����oJv�/�B'������F��&��- �_�FZZ���̔�ٱq���h���D�����PM&���%���9����Rs�W�n=f����a�E�d�z��z|����jw�]��Q�7|mM���9w�=}tUƏ+FO>�Bx �gYh$�Ψ&BǹЉZ����6������B�2����E�ݍ�b2�Dx�$�A}�Fz�.*#�6a�=CT��������2\�^ 5Gv�O�Wʋ}jI��5Q���>G���F��7��X�R��������Ӵ`Jp�~ �܇g�S"X�W��'�s�_ $r���EFI�{4��_��h�����(��Ѵa���-jzf4K��ʱp����
Static task
static1
Behavioral task
behavioral1
Sample
207450ff08453cc47b40df231032d4d0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
207450ff08453cc47b40df231032d4d0.exe
Resource
win10v2004-20231215-en
General
-
Target
207450ff08453cc47b40df231032d4d0
-
Size
4.6MB
-
MD5
207450ff08453cc47b40df231032d4d0
-
SHA1
8204c388e65ea1d91f345a16545e05004101869c
-
SHA256
5638a743d42c3622f1826cb1120aa4e22a40d1e853472620071cba8a1388409b
-
SHA512
1fc2a1af7e4167b22cfe7f70e146cc0aa140ae2085a67b739dc1d72aad0e410bf820e3f49a89727d36a4135e06499a722af10e39b095070f0d3ac5d1d481823d
-
SSDEEP
98304:zzlsF6obmLepm99gQS8kzdO1foaQr/lfO3wRXzv7+ey2dDkkCkM1pue8:zzlsF6Sc9BkzdIgailW3kDTpHdD8kM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 207450ff08453cc47b40df231032d4d0
Files
-
207450ff08453cc47b40df231032d4d0.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 2.0MB - Virtual size: 7.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 141KB - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 49KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 189KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE