���+���_4�E<o�����5A���c]�$^|�A�H�b���G�|t"��PPS<7���@,�!��^��/e��?�g�uҩ0%@$1n���`����>�:���7�^[F��u��^^��Z,���F�(O$u�J�z\{���� �_W�0�e�G�o��(;9��K�Q��*]� �3|���熡�W����s�8t��èw��蟊����R]{�$.&��sT��O��m<��J��q"����ց3�Ƨ#��rx:d׀Zu��]I�B��,D�O��\�8/�ό+��<��wp�]�+�x����$�Jo����s�j: �"�h�?�����V>Ե����i��2R/�]-�K:]�G���c�@�wК��b�d�:*rPه���K��\sA !�x�vE������GO[QF�}F��6ws���:�������h�Z��=��$mK�@R�B2Z���"���`��.��A���g������<`����:��&���E ��8�@��Q������G��)E � $:�7�팿wT߸�Vl��zH�5��ˠ����LDQ�.3`�4�$1s����4�֮�U��ۿ�6���=�#��-X{�m���S|���_]ʳP4�yL�(⍺+�����[0���Ҕ ��t;c�g�$��WF��í������ mVv���Ҵ�o\���5�'Iox\�1!I���v�R�a�� #<rƲ�B�����a�˼�w�I���w�?�ˈݪ(�s#��r�Q�����ZT�b�������q�\�z��U|�]M���x(���Z��$^-�-d�3A��G�.�~/NA��!'�i�dӟ�C_�U"%$�Lg�Ki��o��̜���X�E�a�Dɦ5��̯O�R3x�I)4�Ş5� 6��Yt�IZ���-X/�0O��}-�خ�t�贤0���345\+�z��n!��Aꋳ��@wC�=�o��T����d�p�}�6�FO����>Yz�d9�V���6�=��2\ˠP]*a�@<�f������U�uIŻ��ï���7�B���j]�����6�¦�����!����bp9��ۄ��O���.�[�g�{CfdX�U�(����<�U<���g'�t��g��8�rT�����_ ���k�W�HZ��`� ��H����y�B/H�Xՙk���ٺ��$�@��J�E�B��cD�S-���� PT2֙p����(Cdz�%����D��= 1����}�|4#�C9��QS���� �H9e�<t�E��2���`�cط���Gf��B��i�]� ܅|��ql7J��=[��Dz��^ �����(������b��Rہ���ݡ�<�2�/"���j�� ��|堼+X9b��V��%g�T$oa,t[��ɘ<��t�s���0�?�B��o�Ш�p,��ȑg�2}��\����M��]��g��M}�.�X���N5v[O�������m%6S����6�����p� ?�`v�f�kW}/�R-���R�+��Z3xݐ���]jY\B�7R�����l�J�'��$M�m�&T�*X>����π��D��/��(�dڰ>��6��Y���^x[r��#����X-'ƥ�0�:��)=���r��ݎ�<X_S�7��o��b�<��8���`�u��.��{3:5���rϤ�_��#��g����jه��'�}V���������&�(Zb<SP�P o�6Y�w�����.��e�e�%�� ��[$�)��P�#�e�u�Ӵ5S�Y!��Վ��˻#_�+���$s��^��Su/x� )�)��fԚ@5�q�?=%[Yv��_sW��Z(T`�+r���f4"Dpпs�W�?0���pAf�����P�9_�dϯ���T#�C�����%@A�wөA���)����9�{���4x�����z����A�G?�C��ʃ �uR�����9�l�)�B%܍������ \��r?^�����p�n:65E��o;�ْ��_�� �No.��p���`�\< G>�du��Gq*�v;S��� m�\F��~�؉�;�y<�e3�B>W�0Z;G�r�GƧ_@�f���A�XDSY����7���t ��x��}��W��Fy����3s=P5���}An`R��^�}���HM-h'��j�N'���Rtl0f�0_��~ DO�������n2>��e��t���D�L����6��`���%�3���-Մ�Q��9���t� �<8�Z$�VA�����]�#I�Y3KA�oՍQ=� �L#`Z�ކ�b"D��E�H��k3�ƛ4`?yf�GN� F�3��C�?S�6��~)`��$��;4��ڴ���Td�Oz�F���h]�e�K�6���]m)��p�\��'����ݴ������ʿ��p�V{u͔��g����"�c12i%�G���c{��*N7�}�ɩw<��@N8m��Mxv?�\�����u;�¦��QI�şk�~�#@/ l] Az��2�(��a�h Ѐ�����&�b:���G�۰���b�����ٯ��*�Ҿ��s��;c����p�k+<�\l�mNJ������2��ND��>��HB*���,��Η*;�֭����)��Sɵ��[J� M�Ͻ�A��6N�͓��AkL3�����$\���C]�x`���AI��0�������B� G&̣�㐌�9�-x���n,�L����(ҿ���^_��Nq1l*�c%��qi�j���a�&0F��V�H��KK���-t/��.�?8i���x1!rIjv����Qs��^��o��tl<e�[_�L$��؞�������ù�� �� ����0V��څe������t��z�u�P��%U��&s*���1k:jm�+�����N�4��t��eN�&&��h}/�A2�N� ��VA͙6���Ț�`��D|�<jkI��4z����;]Phϻ�-��|30|��e+�3;��W��m�ZV�"f$�-D8n�,��������ݩ�7}�{�g)·kF"��LkCW��s&�5� !�0��aɰ���.R�u"��W՛O����@8W���ŷ��\����N7��,����ң@���떺���!8��Rf�8#Xy.;��0��6����<��t�e���N�>��l��"� ���4���Ͷ�H8�{�e���+�`1�D���jN]jY25M��H1C��C7^�l=̀�"Ҹs��V�����Vf�'�g, Z{����^�p���u_θ����H�+[��^�Km�_��l�\% R�jbװ=�`�_/����0YWM�s����<���0h7K(����M�#p
Static task
static1
Behavioral task
behavioral1
Sample
0ebc3c08d0e3b7f973466d55394119ac.exe
Resource
win7-20231215-en
General
-
Target
0ebc3c08d0e3b7f973466d55394119ac
-
Size
2.1MB
-
MD5
0ebc3c08d0e3b7f973466d55394119ac
-
SHA1
b3d7002538eabcf551aa3bbf0b6cb555bea92acf
-
SHA256
3d19304d7fcb0611b685274f7650b68dfc27646078e3ab20f6725d387700b783
-
SHA512
20d0ded8e455397fbf8802b8fdca33ecd14d4387c4d3b12efe20dd6cb8b1167090686676679f8a0eeaf2772ae70470355b0f43cc3987ca6759160f1f9c47d57c
-
SSDEEP
49152:FxSuM2y2BwWdXQ9kh83qmK+/d1xuuuRqWKiAvFN19v3ns:FIuM2TwWVGkh8rK+X88WKvvtXs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ebc3c08d0e3b7f973466d55394119ac
Files
-
0ebc3c08d0e3b7f973466d55394119ac.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 46KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE