���@���ᬑM�k&��ݣ��Gui֟}y�!u��~��ކFK���)�ra}).���Ĩe%y�����lb�@���L��AK�����0:�`j i ��*��|��GX)���{[,���ȃ�T6��mxTAY�b��4�O�U ���ēB��%f�q�M�&��aH�R�P������kUI��j6�qX5nt�0ٜ�+W�Dh_l��EG���SI�c���pW�W\�a���|B��������, 813N��E�it ���t����?���X��T�e�~�Ն[��F�C��yvF7����� �a���lh9���Y����9�����tG�eS�XQ�!����[�f�5W�}�������Ňo���nà�,�����>d��/&$6T�gPF:lFc�Y�� ;�����Kk��ΪI�dHylq��$� ���S%�e4��}�8Oz���/�oR��B68����z�&!��P�WW�U9�K� ��H���-�aw1Ғ�����8���%��s��<�~�-?�O�n�$�;& &d�`�}��uL�^\�s���莖V�����\�ɸ`��;h�q��q�҃l�ߞE�w��� �: &^`��X�K0��pg�L�"�1�Ė�X,��:����lx�[�'(]e79Cf,d${g=�:�.~��al<�!��S=r4ak`�MR������~"Ze�N6��|B1��3�X���穦2��0c��6��r����� ��jd�&��'��"e��i_��� �/��O ����Eν����N|�Y�$�2��~�T��81꧆a P&�B����r�PC]�.ӵ��D#.f�\��k*-��T��Ŭ{|���_�tl�(�հ��CL�Ar����Wj���r��v�<5�6j�Q92��1��1Ͻ�j�V8�&#��Fe%�9Z���� a���@t�ƚw�zU�7Д��P�*�A���oĔ,0��u�p$���>�mW.�BJ4���"��SW�q����F.#�L���G�הh5A�##g4�^��9�,���]��`qr3��Nф̉��� m֜�8�z�ٔ���N��=�:u�#̬����֍���W�V3C<su���h���lJ�}����5��_����%����W����������ٶ���G������_�>�J���v�O�)�_��}�B��r����OE�Ȳ� y��)S3I&�˙�D`�!ʊǹ՟��f#�g�� �"��-+U�J�.PV�1hkL��d����:��("U�0�r�h�?/���vͽbt����,-�U�'~�B�]=��մ����BA�9]WG�&F�K���R�5�a���`�Z%�<1�4�����>S�2���ra�G�R 4�h� �4����g�' ��n@g�٭�kG���\�T ��������g����A�zax�����=�isUVL,��R�J�oAA�)�=�'���-���QB���YO�v��{���;��~z���cP��� p9�NW]�8� �k��a�'�P���m�pP�陁�(D��!ø=�����2� ڴ��36���S��p��"s��ros��~�9J�*$5�i�X� eJ��z�B��2kn��WiP{ ���9�_������"6�� UC��Y2�#�#~:��6��nsД������?U�8�����p/�l(5�v��Pۜ��v{���Ǧ���0��&��������/y�&�3X� %8��]R��xa-��`���(���MUa���`u�;�����.�Mf�v&d��z���3W��u\����0����km�5K��'��Q67"��E�o:�b�����������A�@��Ns�0t��LY�W���� T+c(���y�N�FK��� ���L�K9��rm+KO��Y4�\���i��r��݁��E���� lS�����ڋ:v�o���Z��~��t��<}��`2Me�&��+~��x�,���w*�f6�@P��H�KF��x�}���û�l@�毻3v'�_'"�7�c����r��tA�� 9�\Y�1�,�����@�I�T��Pܯ���%��)Fl���C�N=�ۘ������DL�rY� �<�Rmk���0Rcfc�Q$��l���s���4�Yƹ9}�E���,LK���T�5���� Rkj��(�L�s�Y3/{IxТ�4$ 2�|��i����~f{���/��?rK�!�<��RZ/8���� U��d�Z���!�u%���)�>��"���+jzQ|� {�ò�:��t"Yi�'-|�a�1��_8ֈ%�!tC9�d��FN�I}'2����z��5;��f���9XV��;ג5���I}:6v�,א9 B��X\��~���^K�!Ќ/����iu(r��uJ��[�ƅ��5_�ڼ�%#[�,J%���a����JRṜAːp gf�l�K�&���=�0���0� ����T��Z����Ce�~Th�^����er���kZ�c ����Fd)l��b'U9a���Rn9��8��[������Ƣ�l��ߗVS����5��H���:�� o�u��a�|�~�ª0M8�%���� �y|�(�f+�����9n�=��ǐ/ȡ(w< (y5���!��*�Q ��4P���w����>@�<�+Gh��n�}���Ӓ�\f.��BD�'�t^� �͐�xRF�~�`tGD2I|���hm�F$X0_@��]�C zhb.�L�x�f�}��:�$��v�G�<nd�C��X���D\��"��UrBd ��Ȩy%6�5!88�j���>"��.D;�u}�����4e��{��n^�1�`�.@�'�D���QY���[��?�O5�Ϡ$J�W_O��A���y��t�'&&}�ӧ�J��� Jmm��@�ʈq������;�c��[���?���K�6�G���B����V;%>��`��z<���D���[-��z�x+/��5����n��@��=����f?a�I�Y����g|�� �}�tH��?��&f�a&M�;y�ңU���7n=�jn�M��"m~���L����l���y�� ������� 䎯h_L5mU�U�}� ��n�����\�9fw�1��P�|@����w�agE���t6�_�t�A�X�LX&�����5��c䃠<(ry�� < $˯�ui��2M@54����J�T����|����;N�D�k;��\^2�NRa&��1�>6�����3F�$�h�����<�G[0z�eD
Static task
static1
Behavioral task
behavioral1
Sample
3ec6d5fc3108530c19094a0fa4dc94d7b9c2b981be44dc304d4cfc2a903c79a7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3ec6d5fc3108530c19094a0fa4dc94d7b9c2b981be44dc304d4cfc2a903c79a7.exe
Resource
win10v2004-20231222-en
General
-
Target
3ec6d5fc3108530c19094a0fa4dc94d7b9c2b981be44dc304d4cfc2a903c79a7
-
Size
5.2MB
-
MD5
049debd15fec475bef735ecb7b8348ce
-
SHA1
027f88b28fd800b584a045db0ef8565cc2f01435
-
SHA256
3ec6d5fc3108530c19094a0fa4dc94d7b9c2b981be44dc304d4cfc2a903c79a7
-
SHA512
5540aeeaa1ced702b6b8a71d4c32feaed55d61ffc797b4d7cab44c263eba8f32ff4698c1f55b905d07b7db195feac8653605403029ea25c56ed9a48259c77f4b
-
SSDEEP
98304:8tOa2MQb5TFSREzKzYklU6A+L0obUW4nZdtnHNnobQ0gEM+W9z:AQKavklUuLlbUWeZd3nok01pC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ec6d5fc3108530c19094a0fa4dc94d7b9c2b981be44dc304d4cfc2a903c79a7
Files
-
3ec6d5fc3108530c19094a0fa4dc94d7b9c2b981be44dc304d4cfc2a903c79a7.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 814KB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 104KB - Virtual size: 384KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 9KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 30KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.9MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 137KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 166KB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE