�.k"/X�"�A��c��YggN��=�SL�Ǟ���B{�Y�*$&j����I~���=!뵄�K��L�R��X�!���gTZ&�2(3_:��İ������QϠ��ު�g�փ+����DJ3��I���vշ�lYi��O#y��-J�r|.]{��Z��ޖ��L�ϵ~d5����N��-M�T�W��r� �u�Q��))�"���yb���(���N�ɍ1.C�g����J�)����n��R�n��a�?����3���MEo�α=��M㘧�G���$��C����������g��5p�cQ��ѫ�^��k�?��%������n�@2�4��m��G�+Ba�Z0�E��gHD�`�M��7YX���_�o�=|��gi�+L`2@����Z��9?��g��D�"ƝF!���ҩ��F��Bgp�5���P�� ��O������v�5�~C��z����{����A� �\'z|eZh�}�?���ˤ3=�]��L�[��N�M�ڐGƲi��L)���~��I�.=�/�Ǹ� j����I�uά�n���<���b��7��r]�)�W���� �c�� HD��R*h�srsE.֪E��.��He`�Q��?9�hj�wzK�%r��=}�݅`����9���b�� _1��+�"����A���zѹ��TK&�HjL/Y�Q��Dt��л��3_+{R������ZD��������T��c���a�!R���b[x��u* ��d�� ��l�ܳ<!��ntJ����ǘv�T�숄�G�A�rV��TF,�X�<Ջ����|={,a�7;t'��`Z��)V�8�SN�wC�=��JbLMs�q�F��GK$���_�:Tc����Ϯ.k"�����;;��j���dd������ Zu6rJ� 3����4̙�m��;�S�B���V��uM��]�2��^���w5�1+�"�gE�4A�k5!�q�O�������% �Vc�n9ȸ�p:2Ͱ��Sa���ס˼��ά������N0QL;L����+=�(x��Y2B� ��D����i���Nq�Gez�XڔWG[[� ��h�p��k�����4tj�g,����{�z�Nz@|0����<a-�W>�to݈R��-$�Ӹ�A�}�Y�q"K�h�!82K\Q>L܁k ���ՑY�N���&,m�|���B(�-�&�n�ֈ�L����3KC��>H�8&�1��z�ʗ#���F�Lǣ2�w�K��4��'FÏ�š�6Q-Gayt� ���?{�8�d�l/�0��� �<��#b;X�߂?���zc�q$�y�K�s����1��G�< ��! �q}�����\?��5������`f#�,�8��)1���4�w���a� !s�����>� �u�LYv`MLs�s�,�������זּ���bQ�b�y#vb"��|�J/�<}������?�>O���{����hg��n��$��/0��� �&�tH�"�=����x�Lz$Q�1�����{l�F��O����)�6a��#8ֲ��#��bv��8X3����>���^�t�zb�O��,JC�3C5�♫�x���e�q����e^��n�d��l��{�[ªR]�&jc�w;g ���,��:6*l]��'���G=F2��"5G%(q��91%���G���~��q{@�b)�c1��ga� 岚;ذ�M_� w����3�SUZeH���FwJw� ~iK' j��kT�]��f��Y2j��1�'aP�d����<cm?��j���.E�9��;�`c0�CS�Tr�C�n~��D�79JA�:kj�x�xCR�����kR�M�Jjh0"vw� ���T�wo�9�U�Nm6�3�!C� ��U�)C��)l2�u ˁʾ�jl݁6�{߿;mL6�bR>�U9�����������v~��A �D�g�Z6�kr���\�j�����v2 q4�C� Z�X���jy��@TRq�7(�ʱ�� ��?�L�-�(8v,˩��vO�r�{�iN��D.tj����W݅l�'hB��+�5�vD�6�0Zf\Dc=t6�:Wc�#�%� ̹iLLv��g�~�I� u,�ha�=HoL�Z�E6�5��֊�|L�85&�b�Щ+0^|�,�0� ��]��g�}E�_�ܟ���~�:D}���x:�pg=]~hd��c|��#ɒ�$�y�u����W'_"!L���M�I�2a9 jC~�Z��F���hy����3�I]�4)K����|������������p���t����4 P><���y�����K:�Vzr����"Dk���2�&� |�aaN���hk+��)<`+���Κ��A����@��N����p]���*��{M8I.��7�J�+��� Qo_���I��<�ڹͷ�*t��*d�*+k=��TKLx�V�Ӕ�������* �Ʊ��{=��n{u-C�}�yj����u8��}-���m�]�����g�^�q�eV�:��T�z�d'����߁�����2*�%;�ݰf��� Lm2�b���K����W�Ș3����5-���"��& ���R�!q�'��Z!Չ��]h4/��fL�D8h"c���$c$V(��b�y�뚽��u��������I{�YtW��8L1�MF~p��S�a��{:E���l��73�p<8���Ҿ�b�E6�r��"�ߖ�X���������{�Q��v�*�X�1�����E_^8N�}�'�I�j���C�(U�b��`��<�h�A@�f�_ ^Q�50�\���Iҫ���'6�n��8E�f�����Q۠{O��}g����kT!Y9�\O2�f^�gӲƖpt:sA�N��9��ln\&`����Se��p[Q�4 Uʺ��O��7 ��}�W.A��s�}W�'n&�m�bW���6������6��ր햇�XpP�q�D#�f�1ҵ��bz���v��q�r�c�@^�\�c���V��ԩ�����B�dA4��+Z� N>�L��n�i�$ڋ�_'C�ѵ����B�e�ʢ¦��Ӊ(OU��#��z/ ��3'2F"#\mL\��+���٪�턤�cε�e�XѻÅ�t���pͽDM��AuR?s��д�:��o��6��qu����G�yp�0�i���Q%$! F�|Ѽ��P�U��Xl��
Static task
static1
Behavioral task
behavioral1
Sample
251df6baecf3c5e5c5785c2fc7febb4f.exe
Resource
win7-20231215-en
General
-
Target
251df6baecf3c5e5c5785c2fc7febb4f
-
Size
2.0MB
-
MD5
251df6baecf3c5e5c5785c2fc7febb4f
-
SHA1
7e5e274f6f46d4793e7a9a06606e2c5e751de5a3
-
SHA256
6866047c62e3db3eb6b7e2160fad393a3d8ec1ff54c986fa9b54f0249e07d45c
-
SHA512
5a26254d75601de91ae4667424a01b890dbcbb464f9e1fe73ccba0689d2ffdb7bd8d49f200abbef9e93537777b66191636886d244d8f5fa85213bfca3bf5718c
-
SSDEEP
24576:ihFmZgkCJE6LTbxHfEyc4lWrdgW7DFVWbDGosUAap8GsW011wZBCEu6dAV7VNCfT:i+ZMLdrc4QmWg9s/bGsW01wJyfC6W
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 251df6baecf3c5e5c5785c2fc7febb4f
Files
-
251df6baecf3c5e5c5785c2fc7febb4f.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 42KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE