s�Ύ�_�e�>���h8P�,���$���ͅ�ş����"��(F�w42Ph:�Dgn�ĕ���l��9���~�h�8 U�*�U������(��������QmWt<Bg�I��� �f�5��,{3�cGM�'�m�A|�^!,��l�b]��'��3)�p,ׯ=r_$������ Β�U����=�Yi5ޘph���������~�w<�J٫]��/n����1F���{����a,�ή*�`���*�|�����cCjӕ�Fr�&�/z��52!ڻ�Ҁ���UZ'����tb]r"��T�F#}��v�Kfi�I�a��Ag�{m�V���!��?�B3y��|ۼ�����Ԩd�Õ��г(����߅퐚S������$Tk:i����酗۞�L 8bsO{��~K1��OL)/3 A~}.�����V{.�W�#��P0�v�z��:�;l�]o�����~���칽t��2m�>B�i�q���v�I<7���J�"~F���m7)r�������%����=�n�<������i��> ��KW��4o��$�WU�`*�<�j ��#�Oi(P��a�����)&���V��J�jWK�D.���"�r)�.��GT-v��y,��ɵ2���\ '��յl���aq�Ut9��8�hԈ˩��qe!xb:�W��d����2�O���]�a�Z�ɿ�O�3���.�8q{�hN�I^�b+:a���������_�p�h�s�7v�id�Rb� ��7�:f�VqF��t�}i��!���^�\jk��^�,M��KYԶһ�R ]�yfg%x�������jPnVeO���������P;�Z�hqQ�!����+�xC�����-H�9��2K8�?��M�Ŕ�T�fgd� %w�۴�^� `�F{E�B�E�� C?��w@=���al�bx]i��eɫ�a@����- @E��5�V��E���r��I�£t2so�U�?W����P�r:���)���*�q��a�'o�&&Xy�`��J5t���{4v܆_n�;t h'XT�77e�jʏ�^0:9�EO9�����6�)�<�᳅�Ɂ f������PN��9�G�X���V��o`��I��i� �Kʠ�����R����}i�!ʺ�����d4���G�?�w���(xZbr]㍱p�� I/U|"%O1��gj�WU�J���W��ӛ��xM(hU�p��Ha!��rvJ!��$��M�\hK��3�d�O��I������qT2O��#���`'�����LSKݤ�ξ���Y����n����1u}�̪��nRn ���,[JmQ�F̝�� Vf� ��wL�������7�)z:hB�?��dR��:^�+���'ʏ[�qLJշ�=�#�%L R?����J^� u������tvR(E[�h3��S�=X�&�s����e���ġw�i�e�pX/ ��j\��o& R�ބ��.���B:t7����̋.�d!��AM���$+�7������d�T7�'��AB_�o�~i�{ ��+;{� ɱ�{]2���`r~�Ƥ�jB9����5 PD�̺,y"ͭI�^da��H�� X�F_ i�I��f��:C}�,;���K��D�꽩�]�m:����h�N�ᢝ�o��Gp��n�5$�I�d#IF���@���q��\�2����b3�5�O�j0�IP��?�u!�qe�>6ʊ�iv�?)i�"�(i�B|�?�g�m����3�AC��4�X����rդ��"vK`f{���$�K�|!�w��B0v�"���@Q6p�� <U-�Io��3�:�4!�%E0�P�����Q"�7pj�r��>3���}��+w�`�q�bP�,>���.��}���}d�?k��Š�<���d�-үK�`��y�;��6��r4�[��h�����!D�f��(ǤF���w�:�w��v��X(e� � j����L|c�ɩ�\aP"f�5a^p��B��4�ɝE�Š>p��Ʌ��-(p��ZY�^�]�w�|s��A��Z��8�<k����b���3�v|��'��ٞW�V?>����+ɴ%��������(+D�S�)�DD���x�����#�uz���u�-z��.��F@��B�v����P? z.�ݪ�f�ه���u�.P��T��]rM���.>UI�J6B��"�y� �8�0F{��7�fAB��c'��Q7~)�[Q�k�8�=����=�M�K�[�]e(4 .����E�/�������X�#����WV}��=��UU�w��1ӑW4U��J��������(q�LTٗ{�˂m{�Zߊ�$�f��sr��/&%�ǻ�_��;p�c�v��.W&��S�0�s8��2y]呏��1mD����"\u�]���=k���zK�m?&���, n�Hg&�jJN4�Q4��(�i1�y����4z��kUJ��x����.�s9�B/ؤ����I��qeD���*d����v�S�b� �5��f��� �(�we��\�؈�`^߂F�w� ��7�p�?���|J�Q�P�A��Z��K/B�!ع4��#,sΡQL��i�,�H:\fx�@@Kۮ���Ss�#�IW|�W甩^�`!���l�T�)z�!=q/0�Կ\j3���э���p���\h3$�E�b9I���7v}��xis/��W��n��nʰFƺ���<�F~:_�VH�xf_!1�v~�~�j�y ���+"8@�}��!PS�d� �;%��nA�����E��ŔQǺ���4Ρs��w�e(��-�&�D?� ���`"��V�g��B��ϰ����HsԪ��C�]�Y����3䙧]�#�qN��$�`�����@s�-z�F�RiF⡡�:C��f���q嘘#^�;E�i�¾��S����xɢ��җ��P� shɶ�e₉D����Er��X�J��j@��s-Vӷ�j ��G|A�D#[h�$��uF6Lja��G��9C{�.�؞�(Nk� �Ÿ��!LSҒ:KǦp����������.�,$8�]$��K���^�.�Q�B�r�N���m������W��_γ�Xh���K�y`����Z���f�!�m����&#�o$���m��]@�W�{�i9ˠ#�:hf#���&��wى6?V���A2d1t��n̕.9���f>-O&i�]�ڼ�v��.�E��S�(�ƙ*��V^p�b�ߔ��@%l��(��ڴkߓcw�W�I���M�Go�Z� q�/�,�!��]�N��{����C�P��-_��GQ����0\�/���ZwZ)J����Y�q��}:1�c��:h����U ���֤{��/��㔑T�E�\y����t���?����!'р鮭�a� (��͇���!�� : g��0��i.`Raj����VLB��-h�����Ɔj��P̱#�H�k|��A�5os= ���8���_S8�/�(�p�Ҹ�A�ۃ�c�M|1������X��Mmőz�J�x�7���Z�BF�t)�)�9���;�b$����!zP_�YpVY!8y�������V�$�أ3.}DmK���U�l�Q�"(�+��ɘ�
Static task
static1
Behavioral task
behavioral1
Sample
791658585a70d3d7c97ee9a6d4c6fbb9cace5f51d139e3789a7936a33a729cf3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
791658585a70d3d7c97ee9a6d4c6fbb9cace5f51d139e3789a7936a33a729cf3.exe
Resource
win10v2004-20231222-en
General
-
Target
791658585a70d3d7c97ee9a6d4c6fbb9cace5f51d139e3789a7936a33a729cf3
-
Size
4.0MB
-
MD5
5fb299b025345228f9380e23542354e4
-
SHA1
cb4a83abd46691b26f80e577b91429e9189e3469
-
SHA256
791658585a70d3d7c97ee9a6d4c6fbb9cace5f51d139e3789a7936a33a729cf3
-
SHA512
0bd129cc18236fc36316c6f9b5950eb1b0c90dc8efbd5d9b20b7508eb3839c61a62210459572bebb7a7472769fb34514b1fb50b895cff45d47af5eea2cad9057
-
SSDEEP
98304:pDQQZu5MyxLb8T7pbcbWrk6d4QbUPaCDQuBiJR/K8V9PUvb:9Qb5LxP8FcSAit9P
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 791658585a70d3d7c97ee9a6d4c6fbb9cace5f51d139e3789a7936a33a729cf3
Files
-
791658585a70d3d7c97ee9a6d4c6fbb9cace5f51d139e3789a7936a33a729cf3.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 2.0MB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 12KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE