~��1@,���ٯ�8R�Y����N��n��w�6Ċ YU7j\"Twm��/����d�ݚ^}?8�3�R�F )q��(�xG�Nx�M��a��ȫ� JJ�L�5����Ν5ܜ�;�ga�i���֛��"d�&]���i������`\g7�<4h�P��Hҳ(�ag� ^��zY5���H`������4b�Jem��� ��yvM���1V �����1�>s��j�y���y$��Y�z�"��T0 +����,�<�����"<#_֓��3��=%��¡@ԫ���M]���MD)�� �+r/z�c����1k��Ӑp@���4�E��a�����X�B��s�sL��LG�^�w�m�H P�Y�2�'�K��-���Ь[�&�Ă���{�����2A J�%Pfɘ�ih�X�r��u�����,<���j�k�X~��S�^��Zᢨ�� U��Ȉ����]R�����Z��$b1��s�V����QqV���BJf7�5�i3�}i�D�E�I�Z���)�/ʕB����qh* K�vp�ad�p��x�����J��?<������T�q���/ a=yɥ����\�M�<����VJU�W�jor"?���A�4����ˊ(`���/N�7����2���t��CN�t� Ut�P����.��٦�@d�� �Š�O���?v3&J|���Dδ~Ȟ۔�+�E�P�n�ѕ�p8n��i��_�[^~b������S�3�q���/���*ʱ7 �����|V�!��@��� Dr47`����� �(��%�l�� a|������0<iO��pP���/p/��0���F-H�iI���-h�g��4���3���w��A���F���k�9�,>#��`0ezN���T���-Pr?�cD��g��Y���[h��#�5a��XF� ��T�����p�yh���h�zx��.L}�s) GfbшU����!{�����ϊ��A��%���a��I���[� �,�LP����|g'��?�(dNQ�߯l�>���?��Ȝv�L��m��A X�Lsu?��\g��XjgPj��w��[�p��9���nm-�^��BM.���H�}֯��!j��1#�>S����g�3w����?>�q�����T�����2}�Б��͒nc}�' e��q�d���Ӱ�����������v����x�a�N�>=aCz����^���2�qσjh�d�'����zK��4e!��$y�V����~!�t2 3�() �~T%�K���p���m6[ .MX@XEc����7{�C���d���(jX�R\�$�X����-�@�qc����Ӥ�s��b�uv3CE�5m�����ZI��������S�<��v�N[]�D�����A������| ���4�m]֊͡��w����w��"B�69-MM������w�Pƃ)���]�~Q��,6PHT8l �zx �z ���n��1�y�_���lM����xhD���:�n'^e�^�n�>kD��ʋ�$�F����u|i���B:5���PU.��q�e���e�.D��D�8@;��v_�^2�-{r�@bvLx�b����7u����Ո� �9��� )�U�e���$���1A�������Ï�(��G��ul�I�'��w�k5M3��ں�qɈ��eߧ�a ���Y�#+L�X� ����#�vj>n��U4Ifϻ���;���Mq=�s;q�b@et�����5Cÿc��ܤM��F� �� �o�m��}�Ώz�Ͻ�9��$O��겔r �w,�!yJ�I����I���/�ގOU���I�n�G������B�&���?���P�bx�7�.k�AY�����0%�hk���Hq����o~ax���v��zq/f�[Z���Y�]��{d�%�����'M��; I���V/�(1"��ԡ�ww��%d��� }C��J��8�,f��r6�0! ୱ����9�J�7���;�!���Ɲ^����1Δ,���M���YMB���E�}�^�eB��a�j���������^MQu4,�,�*L׆�����f�W�>���V�C����\]��ؔc�}���?B��F�ד��i=�qz�E� �� �2��u34�$ҨSH��Ӵ�����;e� �� �x$��Q)�gF��jQ�|Î�>�:A�=#���F���7v�H�"� �c��\E�Z]�_&���̭�L��'jz}1�z*�$*��jޕAt�����l��[��Dy?�_+&�Uc�Z��i_|�V���Q��T��aVȱuWh!���0:������{��d��Э���/eE���k(��J�.:6��.yA�xIJ�Fq̰|��I�N��/rD>L�{�,*-v`����K.��y�RI }KE%�N�,���ݮ�78����K���ПɃ����q".>��@ye� �:�1��������,�P��W0)��Y��'�WĬ�yG�~�� ��(SE-1��|C~7��������A �w���{am7��l�*�����,��tN>a<��8�Mٰ"���M�o���5���d*֑��h�-P]%P㏫�`��Q_w�낻���oI��A�]=9p���07�s&�r�"��=�d�ߏN=��0��{{�����~E�G,�g�� ���8���8�e��Z��o{y�,�@��E��Ws�휭�y�w�c�u���҉P�̓��t�Ĺ���"k}.���2� �x��$��Q����'�Bp�`À�"j���M��L�,��˃�ڴ�>�L�l�{��z���Þ-xL� ��jկ~�ZY.[��퐳��J����=�����k�vՠ�����}�!ao���)!V��(�"(5&�3u J�|ĺI����e���)&�����'���̚���^Ě����8��6$ʈ���iJct��ԛmߐ�P��� �� ��������!�� l�}�ʙ��Û�h+wz։W��y��f��wb_��i�:�h����g���dk.YT��A'p ͕(��ۘD�w��H����ȧ�lM�套��ٵ�������ƪ��6C�<���î?� |��������G��i:+]�R��A"���3�TR���u���yk�u�$c���x��|��,i)2֓��4�3�';�_�����)��?��Z5���2�}x�*���t�T����Z���H���A�:]@V����ze�;L<;����qR&����j�C\��p}ȉ��w|�N�#q��]�R_ .uĚŧH�9��z{B͎u��E�����A�������J$.���&M
Static task
static1
Behavioral task
behavioral1
Sample
2115b10faaa0755e1966a79595b6eb32.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2115b10faaa0755e1966a79595b6eb32.exe
Resource
win10v2004-20231215-en
General
-
Target
2115b10faaa0755e1966a79595b6eb32
-
Size
5.5MB
-
MD5
2115b10faaa0755e1966a79595b6eb32
-
SHA1
f5bb267c73b34f0fd88c8b92e7b17e3796741691
-
SHA256
ea14f22312cd94f9012bf01abb7c4bb3a1c64aa6a1336d0221c9970832b7812b
-
SHA512
fdb0e2b5296591efc89a24d39483b7834cb4b320a529875b2b42b3632fe0d8d5bc293987d9b06f2033b0e7b5f3bcdbf2504f8d37bce671ec8950811634753d95
-
SSDEEP
98304:7JrDVFLQ1gEFVk7oeI+SQ7frgou+D8I1Ii+1IW1hOWQoJMg8dkiYFog:7J95QiE3kY+h78Gt14DXfNWk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2115b10faaa0755e1966a79595b6eb32
Files
-
2115b10faaa0755e1966a79595b6eb32.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 185KB - Virtual size: 500KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 45KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 21KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 20.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE