��wOJ��#�:i�%���۰{;a�R/��W���-f�\�hܱ^y"J��o�bnh�mr��c�Į�V����OH�}����p�5�p��l�\��Wඇ\\�:Ʒrr��#z�i<� =�9e������ٛ&Gh{h `q��:��#}�sI�y��1;1��R���n��E����h ��y9�i�ҸC���S���-is9�^*��|T!ϼ�:c~!U��#l��W�2��"Z5R ���r�GK>���+ò�M���ǜd���)����E:j6�(렂p�x�<~(__�L]�|c�K-�M��xht��##�N?����\c��$jQ���^��±�`����k3��u�3��e����R��p�$LQvu�j]D��#C/s��6��x�]��ϒ�ǯY��Xd�������(ijE!A%4���?h�������2�s��rf�ë�?cfg8X�*C$��h=K~��}EK��T�@N�`O1&'�GO����ێ� ���Fw;[�q�� w2��n����Ww2���`iU#�)y%5}�j�mc�!���pY#bZ�,���i��ĺ%ƞ�4A]�&� ���IQ�[!h�Ƽ�]�楺o40M +R~ �,:~V��^%%\���W�;0({��@t��n�&\jp(Z,�sZ��K�}�ݑW����89uW��Z�}��{��|.)^����h��@�ga:^^^�}Ծ����V��-�Y4cuE�;0����P�y���QI�偀R0[�c��&�2����е�� �Me�X\�����7�6(2�VN�8m�.�)�v���qd����4Gi�x�8�S�O,�M��l �ˍ�M�y�3/�ԆK�hYI�)2�#�Q�JU�M�`�� �Y�\ ����u��3�TɀHɌ����e�{���-� ��>�:���ba�䁒I�����*���q������g?�R^4��%�l��I����4�s��)�p�;�{X�1)[s>����x�Mw��l��a�.pB��w�U���LK��U� ��KP$�ӥ��&�BT¼�bk2E��)���ɓS ����Q:�r���z����&>�tp+���^�(i[Yo�2C�a�.Y�ҧ��`lC�kn��k�gɘggD�k������� ��*3�o|�a�k-$����ǚ��R?|y����\�_���j����S��kS�,��m2 �4a8q_g`h�]<h�E:s�U���^�uE��L-:"'�������͎G�]��-8��6;���S"�u� �����13�]��$4ªw���N�G"ʾ�S<@����_*�h����+ɓ�-v�r�Dߪ��8�"�M�߅���ZibR�|o���r2�F�N�D]���\�);̐����A����m3�"y����d�k����p�\YTI�a���%q���]��V�a|-]�r�iو�e�c �Ox���$;��0�����Ï3,�[���b��0��]�q�����~�}Vl�Z��B���{Q��O tC`����� p�"\.�}����S�%����r���Q��QC�Bۃ�}0>S�~;�cB?���2�����즁��11�ycH��� ����KCV�Ny�݈��se.b�������^Lo��� ���O��y� a�;��#&��N^'�{���Oz�e��/�;+A�) ��{��̶��y�څ[� ��������$^���/m�����yaE�x!�?B~ ٯ��(��m���v�O��������ۇ�����͌����tl��g����o��Ϋ����Z˃�JK���<������Z�i����/͊V���/�:?��@�K���:�/�Th��vc[R���4��������oE�� n��8��ŏT��Y@ �l&rlݻ^ �f`���@��yL�`��z�5&f�e�3k���z%3<=�r��eG��1�<����'�U_V���`��|I��=WCg:����H��Rxp&���0%F}sv��nl1�ڡ�I��*�ue�I9���kԍb�����9�⋪⺄s:��Pב�dg�P�M�ԫ���ĩc�#h�H�-Bfp7��|�����n(�v��-��A�!�m����mV�G��7c\��yz,�v��E��J,��Τ���8Z�m���:�t�ˑ��գ��%��7۬���(�{��S)��X�Ɂި����`¤��ܹu㾑@��1c�Z�����VK���ڟ��U^K)nYAa&�DZ����t4NNv�7~¦AЂX�k��ߺ�U�?s���]}����%Q�y��P�kp���wK�w��a� w���Q�YӖ��9v^x �?r����e�G���+��`C<뤑�9l~��E��隬DО�P1H[� �?%�4iAe]t�ı߹]%Î#��ש$6��%¨� DP��E1,��&.^�����析7��o��j"�}�W�~���-�H)"��+Dy�����D��8�!�F*�d�g^8'c�`�:.ϗ\�QQ�j8�A��i��ګ�R9]<���,��_�����r,��MY�*��2;�] J�G� TDY^�vYH���Z~�Y�?E�M����X|F_�C���N����'���2;�Z{����S�r�7��r펫zdB�@5F�'�j�}�2���͞��{�|��7������2K(�n_=���*�Z�Kj�0�;%�Ь_�b=�������n,��K~���]������E���}��^�!�?-�aD��if�� ���V�ի)M ���k��)\[�Gs��'ڑ�����O�r�%�G)1����ĥ�g�+�o�a�o�����"!c�O��G��[���]���FlL��db 7�T3�&4��P�.���"�beW��x%�f��Ӹ�sYd�!c"�f����L�h9I�|���`Gqދ�z/��kH������F���r-@�{Yp�a���3|~f���9x̭� �Gb�[5i<�����W�q�`ܙ���|��qZ�1���>=7G��H�B�<hy��ζ�{���]����&,���9M�g�a1�/�AVew��5Zڏc}�hr�/�l�?^��ɻ��ϗ���.@�Eq_�b����B�蔋�l}A�M��� bxٛ�ߠƅ��������@���:�w�͊B��0�S�&N�X"[kp��TL%.ï�IAQxf�rgYn��g�[iMd�CDȹ��8����(�0��m�\����� |��tHݹ�[�>Y�,��Ίw�M-eJ?��gum�a��x�DqN�C�S�@�zT�MN7)K��~��� U���b���#��'G��ά�y�i�?�+N��J�� {��va�Օ�x5�g�Z��(mpW� vvR�����F�;@�p���c�� �?�!�u���78;����l6_?��!�ш���N�i ���X]L�a��y�$;ǷQW���5��b�OW��0 ��O�gKa��$t��l�UX�;�)Ewp���ՇG!�C��Z8ve�g_�Rr�F+����W��P6����mZj%x��@��.��+N��i>� m��>ZĦxIsVEv��3~������oA�#,L���y2=�\������/�-������6���.�����]�*s���:�OR r��c���"g�G�1A� �̗e�%!��M��n.�C"���<��#��f�B�D;��[#�O�fv�e��A�����9$���"��K?��{�ߴ#ZT��? �w�J?&e�#E��?�{ՒW
Static task
static1
Behavioral task
behavioral1
Sample
大华2C-1230授权文件.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
大华2C-1230授权文件.exe
Resource
win10v2004-20231222-en
General
-
Target
大华2C-1230授权文件.exe
-
Size
2.8MB
-
MD5
78054ab793714c3cab77e78dd4eb3261
-
SHA1
6ba18dcbcaddf6e00ad92bbda33426675c762335
-
SHA256
a22a90b8b961ea1f2a146e3b1aef9fec227299f9d4b8dffe1c8dfd1d125dbc08
-
SHA512
5962e171753294302f37e9e5b371981bfd87a44a54ca6966afa515a730845722871dcae292010697787624e25c205b6ea6d625abcc83f51767c53d4caaa8cb5b
-
SSDEEP
49152:cvjfCl0cLSDwQZenKvhvCYoThAx9NTu/7DbAJot/5267C7aO97ND4FnNHGbiF5Ie:cvjfPDww0KvhvC9T//7D8JqF7UaEGnm6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 大华2C-1230授权文件.exe
Files
-
大华2C-1230授权文件.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 360KB - Virtual size: 764KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 36KB - Virtual size: 348KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 12KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE