!8� ��_���uZ���ЮzI��I�Z���� <L�I)i�Wk�4������x.����^�`��:��@�S�����d�_;���j�Nh߾����>; �ޖ'���PɒlPFnQa�d�,�k�DI�Q'�#z&xQ�m� ~]h~��0�e���f�;�J�"$���"l��6I�>�_��K̘ș��� ���>1��^�����P�#�Yۃpí�i$���z�Q�I�����a�5:`�PH�����4�iYlW�zUPi��X�gOI����=�xX��������Z�i.�;�Ͷ,�k��z7��y����I��x[���I�WO<�^�Td��̦�~�)��z�z ������yX� 8��[�e�Ph���������k�v��&lF��ٽ-1�����:�0L�|����0'7 ~yɊ��廇K�a���Έz�2�^8��p��y�\���2���U*Y=�p���@K��˝���D�P �Y���f�T�s�O���٢ ��FG��,TE7�� �����tÝ{k�Ԁ�r�����LF�WX���g�6v�F�dh�� ��x�ZĘe��#>ֺ��R������I����9���"�D���A85���K����=8wI�����i��w�vw�X�F B�'�2��<os'6��r�Lu��K�e�n�����{5��4KF �����:/�vs�6�\Q_M�\�c��(���w#�����2�CPo���� T\��MN���=oZR�}WPH�����l'��V�� ����^��HP�)��Ei+��0�~O<�Rt�5/�P �΅p����G�e��R��n��H�S�Ow�M�<��z�mFg/B9�ć�*�� 9ԏ���~�6gy��Bw�2�� \pn~�FŲ݂u��4�}�WMe%��p�6������P�I,0P,���?��y�� %Z�z�ق.RS 崘.��{�l:W��}ŕ4WDpP����0�bg1h�2�,���Kb1��s��d:��ڥ��KE��J�Rυ/�m�{��](� '�-�ރ�ӕ_x���$cɫ9kG��6.1�_0G���y>�Jr����Řa#�i��ך *|�����{�(�D,���\ۺ�'4YTdd4��8�����GPNTE'!�2�����{1�P젢��p�+�$�C7rO�1���Td{(a��u�,�P��{�ьFDb{�G!m&�!y��I���o锿�����'*���ᩱ�����K2 ��]h��i��_�lr1���Tr���3��^��>�c g^�Uc�L�7���/�XLdž:���ChE��E-Қ��s˜��fVm �������A�z���N�It����d�8�Q�7-�c�[*e���V��~9ִ����/$���� b�l�\�̎i��]�,��0˸�NĴ��S�k��'�1W�d,�'<�;���)�u*H�O,}��\)Xɏw�S�Il R$f�.C��8F}ώǯ���>/�{��� ��,4J�".�8=����ߜ�W㴍Yp�A�ɱ��/�)ϴ��3َ���0�L}��vL���]�#E��f0u���ڭ�/�l���h��"S�K����p�:�p�fa�)P���[���a�Z�9�;{`�@pU�B�yoG+K�s_L0g89�Et�`��K`2��HeS������U�P�sz*�w���G]�}W�r���`���`�u��-CW=�25`p%�d1�F)8��3s|Z�P���ӛW�#K���o�D����j���w]2��bWw��xd�A�h 55S��=��x�� (��A z�Q"� $��:�F��X��' �f� �����NJ +�w��xeG�ߧX�i�&��I��{(~,�����L$ÌV���_��'�%,�p�v��T���� 1ٕ-Ϸ�yd}�x��:m��`��p����G��A�5��Ȃ��v��:`��=!��Bb��%�B�IQ�u��)�P���6��Z�!�%_ٺ����t�^�Nh��Z�0�?Ny��L���d�r�g�t@�z����DK}�Bon��7���_mӱ���b��=��(a��y����9�'�կ�n��;�B���g��yN�R����/&LL�����I�CCɇP(���r�V��I�Y�Z��`%�z"N�ǴMc6D��D�|U����벰\1&���x����mOr��A7�PF��э����l��`�����> .=D܁ ��ݵ$;N��W�<�ݲ�*}�� g�H�%՚�9.�b�����ɘ"P8_����Y��8J�c�T��u���Xy<�6� �CA>'���-O�h3���{���Y�`�k�*2.M����dו���t��n����7&��,��e&�y9����������f����4�\�c(6���>�\��J�� �O�S�����lϕz�*bFr����DNL-�=&�a��T:Jd!s&�Z�s~���cc��-�=_��jr � O@g� �`��ܸ�M͐����[H�4�pe@� [ԦQ:�Lc�4l��Ŕ)O.�|^�J�%ב��(�<�B�n���j�����9��y�bAD�g&�h�R��S��.��MUp��N� ��<k� ���ڔ&�G�z"��#�����vä����Kr�{�\�x�es6���n�ͱ�%��W��-�7���R0a�y����k��5T�M�� ލ�=��Ɯ.�a���(R�/��'��DUT���G�y"��X\ӜS�����խ�����,U ��q��B��.��՛��Q�؏G��sa��ݐ�[�;�PQ䍎����j8`}�}��V���m����4�Y����t�@���=�� Uly����kyT����-��Q�X/���� 1��Zv�bq+"h���9YvsR���y�!y�j�,�ջ�fQ?�G��X%�&��\�`V��E��r�F`ey9�nJ:���,�XK)mpJ�]���Jr�.S�όu�r�7H��i%9��v������^��Ƥ�$�ʐ 멅����[��d%zzl�o�E�C��.��Z� >J��4 <*]�@���W��u�0��Ǽ�Z��y?H6$�];�=�
Static task
static1
Behavioral task
behavioral1
Sample
401b9e1860b786d000137bfd9f44fccc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
401b9e1860b786d000137bfd9f44fccc.exe
Resource
win10v2004-20231215-en
General
-
Target
401b9e1860b786d000137bfd9f44fccc
-
Size
2.4MB
-
MD5
401b9e1860b786d000137bfd9f44fccc
-
SHA1
4bbe96c8eedac455a28326385763171035b82a60
-
SHA256
27c4598ed1a8f4ccc478dcc0989f10ea072114301789883a4cda72a656b2fa61
-
SHA512
5e6a346e48768d4386ed83c41c3203ed5f5994613ec790e4b186a8d1717fd898b1592b2d1ec05eff800e0244c723c698af0d17ca64e29b9b9f0654cdc04dad3b
-
SSDEEP
49152:gBewRgvHLE6RBZVsULtb749L6JIqYAXvbU2rdkHxFDe11:g8kYH5gZkXvbRrdAFDeH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 401b9e1860b786d000137bfd9f44fccc
Files
-
401b9e1860b786d000137bfd9f44fccc.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 31KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 108KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE