�y�~��9VW�G)c�f����3~��?/��$/�ٛ��T����(>�ǫ�r�F�`qU������L�`�)��[��D��sb�F����IW�(:� p�1�bI�ni�T�<�AZm�5fn�=$�lk�����M]} ��<���F�"��.�C/�q��o&v��1Vl}�T1�k���$���.��VA2n��*�Td��pv��3�?q@�>��CR�,�'M}Ue�Q��H�4iN(�/����W4���-���<�KH˅v���w�"��$,rw��?e$�.����m��h�`�ǽ�C�[$^����S`5"����®�b����T��龑���l�ޫ�=[�ڦn�D�%�e�}������� 5"�aclm �Ke��O xJ�s?R7u}#���uՀ�8��h��Bs>���-�q58,L��?�@B��eH��A'��p���9v�U�Ɛ�n}�[1�����6b�j��,��xu ��EDu�� )֩1F_c����χG-I�$��[@IF���F}����(��i(�y�w�r�;4U���Çy�"m��aU�I^#w�]M�����+vV�o��ߦV�E�B��BAS���O����W*<)5.� �? �sFI�����CN��`F� ��+HL�p+�_8q�K�%��k�$���"{�R�J��nqr��_� ��FFBҌ8��O_��!G�� ��Xƹ��a1Dy�x�n�St�ƒ"�L=P9�zc�������-��Ե*���~�� ����Z��Q�.;�Le+�z /���a5���%�bh��W�~�$0 !PQ�syGHR������>ێ,`&%s@�� V�KQ|�E㴂Л""�?Hx�NYrʥ�7;��40"����D�(�� 2vܺ��Q�ʬq�3���m�(�"#`h�)��9��a�n�Ut2O�����|�{�Ns�i�IP5���w�F^��Aǔ�5u3~�-u*�+�������;`��sD4���|ҟ�":���߉��1R毧t�B$G��X�����VI������ ���\���Θ>k�j��6h��]x0I��0����$R$��xmlC���,&��Cl0c(9��Է9x��p3��\zL�:���e�:�ڌB� k ��A���٦���N3�m �|b7�Gw��`3���E��?t�Y^�LRx�3]ȁQ�HmFE�ѵE�!�]\����xx���aK��Cv�e�p�PJ��*�{ >E!O�����n/�B <1&q��� 煙,[A����5϶�AÓK�g�����w�X����A6�/q3g~a����Ї�R{L�k�l�ň"�F|�k�\�)�v�j\#����1���� �;y^*#&�_I�PE��I��!5"]*�wĞ�G+lIL�{���:����o{?x��d g���w�[���J�~T�s�ߐ*��?�Q����jUw�����nC������NTr�ʧ6��;t�d.27C�=WX��2��I%����L]͏���A� ��K=q�mz�_�\?tٳ|?��p�"'��.�pqu�ǡ���ֶJ,���Uټ������*����浄��2�� �.Ә�F��S��v��� l���&������f�*��%D2��D��#�}#OD� ���B48A�|o��;�Wb���?���(#Hp6Z0F�@O5��[� ��J��v V��su�O?�c9D���k̹�?b/B��ßR���6� Rs��@Y��06���b�Z�gY#5�� f�Q'J�78�W�4I�B��� ��ß���D7��)爒]+�"�N��@�-/�[33@N3���0q(��k�+��{��̶�o�������y�x�EϽh)�8�ޓm���^����F,I�������7���Ie�>��~�U' (6�ي���)��K��[�w�c[������k��@m��B�����җ ��Wx�}wr��&���ǧ�"C����x�jz�{t�#�l)*��(��e����蕷g�Bp���0�uw��1) �R�/�Í[W[�i�WF�,�<��Tz"�_K^w� ,W.S�m�P��/��d���zk�2L��x��H�ԫ�����Ɛ{>�:�^��;�AB�s��A��ձ q$/��أ;�7 h�*���z~�e1������n�F;1Տ캍�t��Ϳ\�R�N���C�(@�&f�%���1CA�k ���D�3T%���~L�={ �'2�{�V��c�`Qbc�H���;�1b���Z����d�f<������(N�$�1TBS9�ph�r�Ru�9j���uj��.����OkF0<:���3��[�T� <�\S��H =6N8�-#�ɂ�]�h�}1&F8p�uM�{���J?������b��K(_�����%1�ؤ��@]-�Wԅ%A��d�����9ߴ;���E/s�3/� ��eF���������Z�ES�Y8�~WJ��X�ә\z�uI�*ˍJ�iP�h�N�@�Dm���;o�����=����v���B��bS���JT��mxM!]�8��=�Ն�Q������9R'1ǼL����������o����@V��>8�:���쌘���Tqv�D�V1�XI1n���P"ꤱ�y_�Yم��CБ� �N�9]������l�59�Y�q���vS\x��^�>#�Hۤ��]�Z��oRߩE�^�l���@����&^�����o�"���l �0���ibo���j�QZjF�!l��pVQ0k�B�Z��'U�+۱�`�X��Q��ɲUt���Ӷ��V*H?S3ryadP��F����?�S7B�D�������I�zֈh��j��Aw��Z��`�:!~rؑ�����_m��[)3���4ؚ��M����L�Y�=�)�M���?��rC�?���w\�6ɇ�iU��S�h�H��E��>��:�g��V��ٓ�o���dJ�Lk���>�[��I�\9G��g�����]��4L�D�h �F�|2�����"�>�L<��_�܍Ko���+���T_ź�,t����Qp�v���v-8�=v;�W��.�[�ma�fXV�y��� 4}]�{ /���>��Q@�̚�:v�3O����B��+��r'cv��.�??F�W|jiz�K��m94��ɻ�����$�'� X�"E��ԓR!Y�1kQ�V�bN ��2H�k��R�o1�}��4���'�P�6R���_j8������##�#g8ܷ�aP�|u�IJ���p��Dd���d�v"诰�G�Ǫn&�(���fk}D��z)h�TS���n"���ʳ���07w>[Ӵ:#�����[p�ܒ��)g����qt{Nv,��� 7y���XO����)�ыn����&�7�1ޠe�l��@vu*��r��o��Ej'��=H����:l�t�x�� x��P0�t�0�ֵ�1��f��E�+ei���,v�#п�d�`��rw�Q���T/x��Õ���u�6҂���S�q3����o����M㶊�w�5���Ц�QE�A�5�=���N����-�P�� ��(E�1�����OE���_�l��k�#9��;B��UB��h�q���x����%k����q�A������{��7���QW������,V��&t�Z��CW������~�FG��@ҟS����cp�onj`Ny�1SZ��Kuoe��w������ u[oII_�|-�a��B2ׅD�]Nf�D/�rFZ�e����:r{��/:C�����7��)�3{Yx���ְ�;:N
Static task
static1
Behavioral task
behavioral1
Sample
811d36afcf73d1d80ab85d6383a97822600ca6e3bd5b2755e7e11830475fe101.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
811d36afcf73d1d80ab85d6383a97822600ca6e3bd5b2755e7e11830475fe101.exe
Resource
win10v2004-20231215-en
General
-
Target
811d36afcf73d1d80ab85d6383a97822600ca6e3bd5b2755e7e11830475fe101
-
Size
2.8MB
-
MD5
4d69d45e8183fff9ec0b7e1360951c8f
-
SHA1
f552b4bc33275072fad9bed1f9cfcd0846e7519d
-
SHA256
811d36afcf73d1d80ab85d6383a97822600ca6e3bd5b2755e7e11830475fe101
-
SHA512
36b0c0af5b172b0aee0f669a157c9c8cb445500656e139e11f8ba272f2c573710c6f5177ec4a40ffc714e3625933078934d24cb609eaaa7037e7173bea4c5732
-
SSDEEP
49152:0CcXNtLGfBxmAyQ/uzAeYBB8c1ODJNRF7LBTK/pW/0NNmYChr:0CQnExcQ/1Or7LBK/tNNmDr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 811d36afcf73d1d80ab85d6383a97822600ca6e3bd5b2755e7e11830475fe101
Files
-
811d36afcf73d1d80ab85d6383a97822600ca6e3bd5b2755e7e11830475fe101.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 324KB - Virtual size: 680KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 188KB - Virtual size: 252KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 28KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE