����֝�;�~5�Q��L�*�Bk���Y�K��a�)ō��\�v6q����<�r��Ь�o�E�ˉ����>��Zu�nac+ �/���>F����J�/��j�8���>��o߮_��2$�|�&M$�e#s��f����C8V�9*7ЈY+-X��ȅ�n!���Ȗ�+�'A��"T�̽��3�T���]�X"�h�Z3�4��uj�/*�3����`��2^cZp?s��!�I��:�ĥ ��j�ݳY�OE G�����W�����vܸ쉆h����W�vTI�~tg�G�Q<�6zayc��_�*5�8�Q��l���H�mۚ�f�5ngnvO��-s��H��~@����mh�ti(3�mu�iBQ�]ĕ���:-ZeRx bQY�c%`-�S�u��O���%�ڌ��\���^ kq�r��v���X�V�L�-�cx����ULǶ�'����$��n;��VKp�L�ɴ��-�ىM+��ϫ�!Ӌ mS"G�ڣ���o+���Q�� ���(�纡o��kPr_�t[������01����|U�^�c�5C�2�\R�=��l�� Ă+[4�BS���<�7�cг�v?�c=�ټi�:@��� �G�a +�מY��m0Em� Iii�9l��������KA������W�xWw�8����y�X�2��AY��Q<�m�p�����b�3UI��r���Ӧ��D�8D���8�J���7x(�'3.iR�q�� Ҫ֙�����Qړ�_��;��J_�0n6Cm|Άs������ �}�5AoN�$ƥ�ۼ���)pp�9�V��j�+��!���þ�1�Tzw�=�e�ק���bmQ(�PJ�J����C[���b��#��������hy ���F_��ũMs ��b���^2��ieBӳ.H]�e�S{����d(7�p��onŞ�p�4���IN��t���4 ���\4�G��/��&��8-�^S+Gyؒ0LT�ن]`��T�K5�;����oaYu�/a�A��l�,�q官��� l2:Xw��O�Z��2?���M�L9%�������~��E臟�W�C7W1�[ ��Ԡ�X�&�>J�7t{OM��ၯ�9����J}����c���z�l���z���B}���y�U�]Y�^Ry"S��^@� ku�C�рP�?!�q�����m�pZ��� d{6C��[�����5h�/�+��U]���?pe�VȎ�^��뷐͏�$8r�����A*bd�#��'/7� �O�$.I[BcQ�Tq���&�������t*����Լ�M&PK&����/ԭ�آ�i2��2�ب���w�EV Ϧ�%o#����Y���oi�"7�{Y�cu7�ο�!��;��'5a�R�W����XS"R;������xX�����גt�Ƙ�ݑl���*�'{�� �A�X��2=Ϫ(�7����{�:��b�D3E̔�A�p{��2�L/N�5ͱ`����ן 28?I��;�bR��bH{ ĿQ��Z�U���a �e������3C���������>~g~O�϶��{$��udqi)` 3)u��ϑ@��C�� v&����c��xfnə�@T����)�E����z�:��0��`t1:�����c���p���Ka��~1�v�[�g����qx��*x!^�7�Ҳ�#ȡ�KB��d�$���1E�a��+�� ud�A++����f��0�pS��}#1��љ$�QW�0H�3��c5��CB�Sm���/�~��~�b�l�Ã�E���Vh����>�0�{��%DJ�jN�@�5%D3,��5��Q���ɢ8��M ����;��0�3����U?��ۅO������(�и�rH���NfA�οt�ۄ��̘�Z���QĐ����o����6��/���J�Yx�Y�"����$�B��Ġ���2T%�ľyG]�,�Tl�U)nN��֠1Dj�?�Ý�P�$������ �[ԓr�݃6�����"�o���;����t�N����$��ZC�3!;�5^ Q9'��?�vJ���Yꌘ&X�$�Ïa�eKo/T��R�S�8�N�픝m��"�G1�6��t*�QVE�4%��?]��߱��Q �K��GݓК�N�+wD���<e8.�#2��`�݊����C1��]j[M�x���a>��Ք��_����|����"��ROr����x���������,8O�\��� 8m��3U����;�&g4D�P���4?�cW�;����-�4R��%��c�Gm-Ӕ�Q,�AF M �������a�;H*o�ZD�p��� �i"?��4uA�-D���0�ON�um4�=RR���{h5,Y2d��Rd1E8.�������Y������ �_Wj�Z39i-OlR����#`�j��r� �%�F�N��_B:Bv������.'5��E� oN�q�q_�� �����(�n�n�L��{�O�X�ۆ`H|b>B�j� �(�o�!�G�,O҆ �� 㙇"� )cU�HN� ��3�=��71m_.a$F��7h�G�'o ��o&�HMV:�x�u����;�Kf���J!��$~<nr���X�|�[h�:���]����(�ݮ��� XA�"�¯���[����`.��L�D0���D�5_ܗ�� g��%�uN�Hq�,�/�y��W��".�)���(�i;��)�L�E�_5��En�B˥��ލ�uZ9���?cԏ�CLV^�z��b7>}H�Չ]o29V�8sf�������u�b~�Y�|�̙/�����-�W4��r���=.2����%W�r�(H����ڄP�̤̑}�m:�4�v���k�C��i�ȳ��"3N 菶�? �v<c��M��7&j-� ����l�5ɸ$�7�k`����jf�f�`�����(v�>m�~i����L��r��8����Q�?�U`�Ֆ|᯼�*Pb�Ns<ҡvL�t(�����3����2���"op������`iY\`ʪ���_����eL�$A�Fg�N��Q����������ͅ�!pi@����b��W$G�u�qO�vR�n�HH1 �b���$eL�����Y<R���@v�H:ǻ���74���Z͚��Į���R���9L�q�P��V����m�\k��W�d@���T-W��L(�%v�:���Oیv�Z���Q�?��;b�˽�H�*P0�wb���l��aS8%�?�jPt�$'V�n5��]*Z����-}����9cK�+Rdpj���ӕ��41q�z����B�ѡ�!�zɈ'��M�}S�w��hq�o������eӥ���j��ƛ|k�qV�/^Ӑ��!�$P�(Ɨ�Ӝ� h Tqu�R� �<G��Y>�����F+�?�����Ɩ�ͧ�@�R�we���4�O����f��%�'��ŕ\'�{�9C4���,�{Ըc��ա�� ���?x��ۛ�P�y.�|VP���Ȟ������b\�2�܈��D�7L��m���D��?6�u�_���,>6�Ei#��<���01w��Y�|��E*5���-�*����~F6��ַUPG]飜|��
Static task
static1
Behavioral task
behavioral1
Sample
f5583f23e429e7587b8ea4a367564b50be79e598c46c0545fe5a5b32dc58d6d0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f5583f23e429e7587b8ea4a367564b50be79e598c46c0545fe5a5b32dc58d6d0.exe
Resource
win10v2004-20231215-en
General
-
Target
624aa4bc280b063e028b4066dc35fbfc.bin
-
Size
5.4MB
-
MD5
9f89371ba02c53373f70068ce5b503a1
-
SHA1
dfca100c4bb7ad81f6d6777bea1f19789e5661dc
-
SHA256
041ebf3eb3e8a48085f7d5fe691e9c15a85c77c627b6a5f686b34be4ae2be6dd
-
SHA512
a5b83c3875e843957a2a829ef39cb8f935263b796c4f0935503133c00dcbac689a65edf07ca1f113e28249be07c7a862282562fae3238216c616a6e8e38a3e2c
-
SSDEEP
98304:IShNOO5uvxZRLgdTYM77hfiEjSA0amUoDv/w550FyxRjMiIFs:1hNF5cxDqYO7hfiMZ5m55iI+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/f5583f23e429e7587b8ea4a367564b50be79e598c46c0545fe5a5b32dc58d6d0.exe
Files
-
624aa4bc280b063e028b4066dc35fbfc.bin.zip
Password: infected
-
f5583f23e429e7587b8ea4a367564b50be79e598c46c0545fe5a5b32dc58d6d0.exe.exe windows:4 windows x86 arch:x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 79KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 19.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE