j���p���7Y4����,'������(�T E���k��_P�,����\���9ʸ���@����#զ� �6�S.5��{~�<QT����L�Эי"������Ƶ��\ߤɞO(�"��i%G������2����fNΌ'BT�78j�RVg�h�ٌcC�^�Z�+<�'`���yv2%)'�(�R�g�cK���Q�Q���%�53�S=�I�f��G�{*�87z_⅜�N���V��%*���w���"{ ���~��g�8)��$B^��*8� 6O��ڃs��(<�k#�W��b-�����y(����J�#�y.5�?��s@�����x�Q-�|j���'��dUD��8�>�b@�+�(:p�����l3d�$�T�)sE'��oCn�d��*��oa)6u�*�d�f�L���g8�`*̂E � �{g����)��j������8�j��ƂՀr��JAc�v.�0T�h�s��V��<e�,�k��n�K�\5I�q�ɴ@�Ǯ��Q?P��1�J��ɡ���<�t��G~��0��xp�9�����>Pb�;�ք�þ����,��'8�q��[9����K� ��nm�1�q����!�d^�T��H��L��)�]�͎ �s�_9�8a�cEd���H[zB���0�r�0�V��u9ϛ��P�����&r�h�r��ԧ���E�v��dzٍ �uЇY��Yz�O��$����WQ��[���[�j�H09J ;Y���gl��_�4a�i$&�B3��&��4�r��I�#����u��=��.��a���+a<�ZtJ�9���~-E�^a?Ah+ �+��W7��;��/��i�/�+S��>��]� ;A��ͤ��ů�����o�?ְFA�*���SE��2 >#_����<Ů�����Zby5�G���y���Z>ڲ�W�e{|Z��W�.$-�7l�������%�� �y@�G9�q�c?��,�m�c�H�i �A�L`f�33��O�� ;�2������VX��6�*-ܟ^�,u���z ��<@�b�� G��l�mG�gU,�+��!Oy>A�fA���M��?��8�8j�Z�k^,�����8l,����zӣ�t�dG����.���3��+{-p�4��["n�<�C�$��]���D����<N���*��]��t%��e����t��5���'��+�l���$�qƔU�B,��.�c�ծP1�!�~e�[2Ȉoe��-=�ln+pq�1;�չfo�<��Q�F?[�E q.������ͥ&?>���`������! �z!�Sv讟��\��,z]���3D��G������F��ב���3XT@�v�y6���3 ^C�~��K.=���p�dsԎ�dH�I3���]8�X���!����W>�)��i�RK{�jFIѭ�m�/���B+fc�F�������-����|�ԦB��X�N$f�J$�)GU}W���Tf{����w��|���a���O�����s�fS�� �;ˉ��/��&����1��JBy1Pcxj��V�Uٷ�.�>;���"���� ����oo���(m���e�P���`XG'�3l��OrH�ö�K6��vJ��D`!@�ҿKFY����V���! �d�����HE6��Vpm�d���u�u�Qq4�:`�f�nZ�A��廣��E�g�o|�>휒�o����%1,1��������Z��٭|��XI�D:�B��� o�|��^J����=k��ǒb�hު*G�O�N�=�!6�r��z�� /?�O�&���QϹ�ay�� �u-�d��Lr9l}^�[FB|.kޓk�1&2�5�`�#"B���;6���}P bc���e21��bP ^�%M��X�$�]@Y�8�{���Kl�0�c<���^U~��BV�-�{��Ǥ1_"�+d�F�}>�U��� ��i��]9 ?r���CGL�j>z�S1��ѱ&9�}�x#8�͖<�K ʼnJ��h��/���(����6�6�K��X�����UP4�0 Q]���<�}��������+?K�E���)ƻ���E��R�,!;�l �n��6��{LeF ���f���Ҡ�N6�D�g13�� �*�,��e��G���k��$��ޕ�����w�����D��M ���L��{�BFc�ij CM�9�6dRE�3��� �J�Ohutp�ܔ�1��=�m�gY�{�UF۔��!+���Pt �ns%^.��O��FX��<�ՠ��5���*���"����/N�Z1�.xN@<�:��AN �zD`�i������ �=�U�e�9�� ���Nsé�L�Lw�:m��xj��S���JG��Q�u��K�WA���!����,�� �Z�n,qK(^D��Y�)��祧���BT��܃`o1J�!0\��Yx�4DZo�l�j<E~�k(����-��Mr��o>��Q���J������5�m����.:R��OW���R���s�������iv�nP��9k&����d\���R��h�@�O�OOv K..ZE��3��d�������� r#�/:���[��ރ0˔����;�A�����5��zq�<49t�[r�Bq����p��zٕE�]φ(�:���8L�Ώ�K6&M!����}K�2Q���țoβ���2�d G��(7��F$�B%�R�f;�Ί6�*�Aف�Tk�'�Ϧ��� ��' g��z�ykz���9�sI��<�ǟ=�����}���"J�7b�+�}l��S�B�嘚���F���0���HjԶ=�$h����6����m"�qU��<�sX�˅&41U����ŕ^?ԣ�!"�����s/\� M+�a��~�H:�t��S�c�&n���N�݂J�7�n��f�F%��W��*ϻ9��]�O�L �4�N�,��M�EjYpq�ay2a�p��v�@Ֆz&���yzr*�b��u/ڬ�3D0d�T`'f7}���3��͛U����Bs���?�#iB�5������G� ��m)"O��VGz��Ϝ��<7OE���t���˯n�a6���~b�u�T�1��j�$MO!�T^`_��H&i�$��'ʷ�[������8D^x�Z��U=�V�5��1.5�NlsDS�5���h��@}n������V��������n��~�h|�eiH��.�_�SuIS�;b� >����۬'%4�G
Static task
static1
Behavioral task
behavioral1
Sample
0d3e06a50be5a628c3b205eb98c4e0bd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0d3e06a50be5a628c3b205eb98c4e0bd.exe
Resource
win10v2004-20231222-en
General
-
Target
0d3e06a50be5a628c3b205eb98c4e0bd
-
Size
2.1MB
-
MD5
0d3e06a50be5a628c3b205eb98c4e0bd
-
SHA1
b222c492fbbe207ce1363b97c3d1b266c3ed3f14
-
SHA256
349d1f45e87fccac9cf0c359ec211059c26eafc594a53a15c67e71c1b859e6f2
-
SHA512
39e9187c330cf0de46fc5f0a6feaa86f2a5fbbf51d3cac02695d8874792c14265edaa5b7abbd58ec753d439b5d5c9d19386b6e8c223deb96ecec7fa2b97f5873
-
SSDEEP
49152:X+UtLflZkBuC+Mrw8ORHaDx+FwooPXZhScYtWMo+ADroETmL:XplOUHM4wooPJ4XtHIvbA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d3e06a50be5a628c3b205eb98c4e0bd
Files
-
0d3e06a50be5a628c3b205eb98c4e0bd.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 46KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE