b��m���v�%!d�#���Ϙ~��'�=R D�l%=�U!;0W���qt�?��m]l�_�����o���A}`>���b�f»�8���-DuUHM�uX�@�I_��<��`��{�K�8Z"tQɈ�o� U�uS�.�6����֮�xs�ժ������U�J��emKFcUQ��f"oI)������A~�K��a��z�v�w��gg�ANV�,�lr�<f������2�Sgb~�e���ӌ[OM����H��~!�A|cEG�qf��M=�%����]���ڬ����� �&��b��,�'�8Ь��-�S�^��0����U���\����^�����L4��X���S������]DSؤFe�r���X<k-D3o�Ȃ�\�B�s��z�Շh�e&��Q25�h�/G�J���{������-��I���/p� �eF�~��� {X��Y_B��%���zsv�B��'O_l �b��$��� �H���1�k�=������8G':>U�3;,��#�:���u��R��+�ѥ�q_�7q_A�aS<N�YaN]�7� :=X�]�+�}ydd0�4��|���K J͓�A8���œ��D��KN��m�'{�IA�2d��S�Zu��o����¬ܐ�-#����U���WC��C���}���7}C���8�(�5���p�����O�C��s�U�-,z�3�Ī�t1Cj�k�샜�_���-͓�4�P�.���[5�;�l!���w>b�<��?��¼�K�<}Q�4҈]�!S}o�N����T�_I�I�k2�/hukU$RbsY,H�#� l�4)�y�LZ���p�OVM�[ԏg��v���o+�i, ���C�X[*�� ����nzf�\Oyc��J����±�E4�D˛����R�i�͕�Mʡ ����_���x�S1�(u9�S�p�i��)1,����Q��h��G��\��b��8X�5�qe�8Ѷ�y-1�d%[CL��BUG��%� Q�w+�V�W����/@�o�ES�0Xbye�Jѐ\ ��9�:B�!�h�`܃u08�F�)J��dO��%*�28s��#�6 �����Ǵ�qw��T�bxc��y���*���#�A6���6���$�j;-Lۈ��|����Ew0�%���=��V���i�r�8��ƨ�(�Y�#&:8����t�DNz��A�<����Q���hp/�T�b�)��] ��>Y�('�ll��0�0u2���yG���^�� �\�V( [�o6L��m5 �ݾFB�lg�Xg*����q��p5D�wgӞ� �Tp�dus���IF-��tYZ����p�Dxw/���B�Ѹ��pc"S��,{X'=����I�>����ڏ����i� H�_m*��g,�% {��J��S�%������5u�O����X1����O�X�V�.� A�,E!:�J�t�=W�Lft�-���_$n�"\����|$�cC��#�'�Vpֹ�a��$b�b�-�5�<ā$��Q�0���9l�������g����h��[����_�*�|}��n�����T��a>Rv�b� �ȭ�%�Q�{$�l����[�� v���Q��U������J�����<�� q#��F��օ�1|��pB��d���`��%��ʛd���LJH�:����ha1ޕ����� %G����I���_D�.C��;^ShW8�gU�3r��z�@�vs7�rnÉw��094���M��:�z����=c��Z��X-]L����-��ê��� ���������K������{C�\`Ƒ��4`�%�ͻ.���ޑsw9�3$^H��ج3'�*H��R>�29qq,�KE��o�݈$�A��L_����3�6�KFմ����YSR>ڥ�ʗo폜3O/9�O�կ�0������1��'꿧�-��P/������8N63�8P�XH�摿���IT���.�/2ܠf���LQ��G���ʴ�@A��ex|SČ����ĥ�4�߰un?�p�x�T�]��mH���M�yB���'�,���*� ��_�n�:�o&��+��q�N(?�ɸ�z���t1�}2u�f��@����ȍf��08B�]�iz-������������`&r����*k��ײ�G9�DFyhV���-mVqm�v�Eb����E��^�cP�]���u�>w��F�1�۴���3�R.�E���������瓂�:˒�/)�Ҡ�>QE���W셶�D��$Ta� �j7��#~�ֳC�����TI�!���������Ϋ���� ��Cy�"�J��z]O����2c��[�Jm�k=jv�2x��K2!�?uw[?��c~�����1"�[��G��{e��{�U����Qҁ?����0XO�W�EVo��꾐��}���["��H�u]��x��/�N��,�`�-��0����^��Y�7;����4��ޏ�ޤ˳ߙ7��*R�濷�t�����2�<�ۦ�y���e�ƣČW�8{�uD�@R��8H�0yv�X��(o�Q�ŪGT��gO��AX��WӌR���Ml�\۪= ��0�N�Q��x�X������d�V9L֗j�c�I�s�"�6��"�F���^�w[ƀ�~C4��2��(��^�Y$����H�(��#+KN@u�������=��26�s���Hm���MB�$7��,���@0�Ѳ�k�e��6U����uW��> IX+;����Ն���oP�=T��]�IK��ljd��v��Vv�d�ԇ=�:A��HON�jT����'o�� �"d�������,"$����� �2ph*�$l,cֆјXC6�����5����}[K���0T'C/O�A)��o=� +x"����J}#�-���*gMDod�������I��}����� r�=�a�W~��E����� o2��G� ��wm%� lL��vj���YO@� ���v������t�hS@ �J����BT U�#�j�n���_����U�(7#D�[Qj Io����n<wu�E��ux�$~?�*B�P�NF`iz������wju�Vp:T9�)������C>�g��35��17��aQ9lF9q��s��������F�)%z) ��P勅l��!/��֩�v��������s�e� ����b��k���^0v��$Λu>O���_�����n��So|I��������vl� �a��I,wE��@���!��e�w��dT�N�i�=�l��E~�����|������<x�Th�,q��`:�5s�#�I@a��y��q$C�[�X�>�&m)�a�-���'��K�eIp>���ɽǴC�-xZ�a�����!�*&o�*{�{y��:V��P��܈�$(��Z~���(�j'7�_qz��ҍ�`��H����T��9a��$y|����//"םq'�E�k
Static task
static1
Behavioral task
behavioral1
Sample
tt_livestream.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
tt_livestream.exe
Resource
win10v2004-20231222-en
General
-
Target
tt_livestream.exe
-
Size
6.2MB
-
MD5
402d2927e25ac49bd1d9f43ecb88997a
-
SHA1
433d3e4b3d2b068c353fe061df2f3fd400907091
-
SHA256
7e00759a6e803c86fd735de7e51a01624ab248941a2e06b3fa6298cbe1823922
-
SHA512
9955a09c335faa590a033d48c58d96239fb23a18bc00d190df3fab58c4beecf59c8a36513b9ab5b6b616751edbef9cb1d4b4b180a6d444cbe9b579011228a477
-
SSDEEP
98304:tCWCpDYgeXAS9QCu3L7y22FylBjUUx/k1OumbzTZU20U5Ezy+epHL:tiZ/JhCqyRFi1k1jm10Uyzy+SHL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tt_livestream.exe
Files
-
tt_livestream.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.7MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 102KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE