1�_�j���l&qYZ���h�Ҩ4�Kg�O�$�7� �x��"����D��k`����l�?U<��bDQ���� (-A��1��9��4�\���� ٖ���5�Zt��d�]|���q Exz�A��N����|VO�2x" ��,�%O ?I߾ߣ^��������e��WP��9j~��$ҟ.�Ft��� ��R��V:|r ���(W��^�z~,;AW0�*��+��#)���{#5�sTܧʁH�P��ah�/�mM�{�-��I��<d��'��L�e�xGG��H�;�]���ӗ:{� r��]}���W�Gb���C^����*�4�$�v���V���I��@�.���,{�.�S��<��=�ĝ�r�O�Q!z����j�ɸ˹o%�~�aI������2_�,l�f�T�Ί&���ʦ=�NV,_�B<��M ��0T @t`K�k�'�?֤�b_����d�x}��2�?�V�b�`қ�q�BΛy�z.�%�x�?��ůl�`Êd/����>azܞ�����7�Ǩ�ǽ t|��r��{��߬J44c#�Y�XcߣPY&2�U�)��.tGBq�>Q��g���dq��r�f�k3�:��F!�hBΆ��]���#m�����%�G� 5�3���cZz>o�'�`1t���f�%J���u[��w }OO���K����PTj�j|�����N6��ܠe�LA�t,ْ�-ZKGX�G�'o�눤�S�\��L)�Nr ��w���ś�� �t����3�u�{�Q����=�G�'�Na�>���(m<��`+��++䍍��9�{�ݾ'��Iۢ�~e-"Ӻ�\���έ6� ,�M���"z���<Vۯ��x"-Z��%l�����5�8j��DS�~8���m�Ǝ�~�%��qk�̈́1'�"ۙr��q��,~�/t�eGĭI� KRƠ+�'�ؐC?Ѳ33[>de��KU�da�+���_䭄���E�y;��x�>� 5.�|%D�럆�A�m5Cj�XQ ��o��*4J���R���ޯ�ó��Q��a%�߄�x����v/����r�Y���Jy��r&��n�[�+�$H�K|�gp��g�����4L���'��U�}9��^��D���^��e�ڵ�9ڀo�]yb��_���)� �$��v�P;�v#e[!�4ht�nU�[��^aK��� ��|���?���؊��O��;�2��J<�C�2�<�6�CƋ̯��V�t}��?��o ����F2�d,KD�����|�^}� L��M ۅA}ǧ}�onbP���HV_/�e�e�bґ��$�;,9+�-�Ƌ��8?��� �W��"����c�(�o�|�vP/����{Y���u��������P��Z4�ξ��r��ۺ�ΗQ]��f��4���F%OQ�����ޤ��L,ӑ��ʅ�Փs���~��WU���NFI�h=��*��e���tekS�ߑ����N�T_�m�u�+�.�_M���J/����/<�0dC/���6x�hT0w��`⼑m�ڎ�p��F���@{�"�(�o�Hm1>'�N{:G�ac���Q293����cĝλ��w!��O��.��w:OH�[�[�<� �M�����ʻr;-��i�'[{j�m�*�K\f��}�2�#PWO���"� �)��K�Ʀ�E��[��7�O���/]�J���\��G@2e%��q6g��^���e����+�}k�S�9��w-dS�jkK�k�dCT��.���&����������6��%���>��ň)�`�G��Ѿ�u�2�G�d��C���X5�;��%9��f��xz�&}�-= �X(�>W�4��]��� ���Z[���Yv�x��MD8� DE�꤯�Բ(�����q�*���j���/!��Ss�1'�U���V��� ����&-���J�4h�.��1��=��xj�8�x�*Mr@7Ւ!����mNPâ�wã�YN�������B t2���xir F�ih���v���I[�����i�8��+�K^�e{H����&�?Z�țZǭҗA/��8 3,�����U�*����;5��<�ƍ]��(o~WPehn��eK�s��4�o=��6u�����ŗ��yb<iY�>�;CT�X:`���0�#��- ��g��ܚl@�o�&�vـ���w�CDxZ�!�i�|F� D�9�o-^�e*�Tr�6T$��=�ם1y~����r.��ՄP�_�`:<y���ڵ� �4�ۉ��-Yl��Ws�pvj3[�_�E���%���6��sӻ^��Lt5i��o���[���c��)�zFr�`�l�AJ��f �� �&J�P�փ�s�� m̺;�(\�/i����u�Q��&Qv��cۥ���|1�����(#6� ])"�%�����U W���VƇ���FX���0�4Q0K�lM�a'm�k������T3����@��@*��;��_�w���ȗ� R��S ܇;ī�#֯"��~��w�n�����Z~-C���?���Dz ��������3*�|�Vɋ��q�/Ȯ��+M^'G�Gn������yF��[���bw梉�+��-e���G�����;����7X�����e_��9�6ܗ� ���������������L�2FR�� ��F�G���U6�=ю��0DE�A�!�*��wމ���L��0�U��L��u@����&3c����s�"E��u�MP��7�s~Cfx�<�H��n�����ߟ��F3h}����y�1rR2���,~�)wz��,���v��D.c%��*��B�Lm"�� }:yA{�?:+PV�t�V�4�uˌ�s�1�YHԲ�f�]�V�#���:�������;2�-h�歂�;����MH�wI�pW2�Y^�%�;�c��a�i�U��(čf'����!����>���4m���w<���_r¤d�C&�SK�ٝ&\@�F1�v]qS��N51M�j���.;�:����C�V���z Q�I.X8�҆�(u��!��O��� St�#>�bA��/?�Tb[��ۦU2�B���g���/7b&u%�5�v���q�,L�uē~d�Rۄ���v��]%�*�-��Zp %�V�]XYʅ�g|��kP���0=|J8��ព5# �bT1 N]w@�� �H��a��� [C���(g*��2�����i2��(�ݜ%N�?�9B'��e�|�Q� ����b-,�@�����BiK�v6ub���(�$�&�(4x���0P�����D�9����r�%��cO@8yk���?��d�sҨ�� ��ܾ����m��Z�c�ȗՎ7|�C�T��"Q��sS���ޟq6OMw �6�A?��r�jJL���+|ī�^A��>�s�P��F�1�x���Q�����G��i�ܔ�k�U�2���A"�� <����_�h��Z���g�8��Qr�����N��L^R���.DP�{r�H�l���8���>$H��;�;��`Y�L9����d1�KV3��ϫp=�#@��i+�Ԓ_v� � �yo����%�*��E����j�+B^��ߐ�-e�~�@��a�q���D��+7����f|� ô}$���qDR�Z*�1���I��t���X�+` ���
Static task
static1
Behavioral task
behavioral1
Sample
0x000300000001e982-6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0x000300000001e982-6.exe
Resource
win10v2004-20231215-en
General
-
Target
0x000300000001e982-6.exe
-
Size
34.0MB
-
MD5
a111203f4ad9eaf762e1a2369a02275c
-
SHA1
e95e3b4ad5dd7d9bd5bc6124bc64bac0ffd72f7c
-
SHA256
a8a817b6b2e3be5720b2a2aabb7ce1b3c15d83a46b58631a705cb556a036be98
-
SHA512
b62aa12fb137ebe598a289edb6eae075c94aee84d27c8feb47f6586d19c24e9ddccec6d418c0b8340d8c0bd04e0f8bcb3a9e49e61643ba0e9a0a1a237c764160
-
SSDEEP
786432:Lmab8ABu7d/ZXw04FbXhcGsVIz7x4XMEtSe5SB:KaQAEJe00CGgIfx4lZi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0x000300000001e982-6.exe
Files
-
0x000300000001e982-6.exe.exe windows:4 windows x64 arch:x64
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 3.4MB - Virtual size: 13.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 136KB - Virtual size: 332KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5.3MB - Virtual size: 20.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 9KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 172KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 211KB - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 323KB - Virtual size: 32.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE