c�mϚ 6��7���� ���@��m���!�_4�m,��fsEdGп���-�N�� ����4���n�UÆBa��yK���d8� G����ǽH���ܔa����C����.�6wNY�9�L�{f�v�y&0��)�\,�*⑭��'�f�h)���y;R��e�J�MT����q�����A����^e3%p'��E�w�$io��|��M�^���b�iv>]����R��!�o�}.\�P=�w�"������c��c/�����玸��/���}u]��t4�8���I��qO ��΄މ'w�_8��#�뿇g�r[˘�C��ݔ�?Pz����u�hQv?5fGTq�A0X|�%3��a��25:=�T�=��f �>��{(� z'E�j�y �ۈ�����ϥWt������x��)kwh9I�ݐ@����8��g,>(Z����F�x����Pӆ}����h���5��7�A�H���^�t�����W9�e�������v�D���EF��_�Ȯ���?�ssm�R��Ƣ7dh�۩��2?=ji"�R8VŮ��6���b~c����C/��{`���Noc���� `��0 ��ad� |�\�/�(fԕ�q�~v�xG�pظ��'�G����)l�����^x���p��:GE�l6���R�y�%�Ů�����9�g�����X�Ȣ�5��;�0cM�2#Os�d9�J5IJQ�p�>bǎ��kɜ|]!�._�4���f���\�J[Y![HM��R�� �����G�D:r�4����:���Gk���PW�R�b���۱-�_uIh� ����1>���ЀM�(,�EY�����)����(��a�pv���T�gD��idP�NW� �x/��:8����Uu�Gh�����i��/`��t8U���i������@ay�l����L[ v����`?������j��C>��^#�\<�)��\�h[K��UR�:A���ZٝXa�>V�(���_�_���m~��@|��x~W5�kn7V�满N!i{6��<��_}<_������-໑�8 ��8lГ�d���+�}�?iˣ;��t���y�4�s�����k)i֝Qd���:u����e�,��XUe,�����M�N�oj�4���)���.��� �����C����h2d�t@Qni�&0n��[ڢ��$�0(�w�J��n��t̺x�pyf����x荭�+����ʝ&� �n�W��r��h� ����=�P�5M�)����o$�vT�V ��᳇�ʕM�q5����P��/u���o�kO�����M �g�%�d�d��~�\�s��͝1����1�����'N�tG���6����;�ӈ��t�L��E��������i�Z�P�GK-l|��.����5��%�;هa.d�8~f��9�*��:���:�3�U��Y.<��83M��N��@3��9|����O�9s�����{g�������+i /�m��Q��K �͒j���9B2�6 A<��hrW�w��;K1�҃]O���\.96V���H��ขxB�\�<�E�����0}+��i�ȚE��;���j!�m��������� ����P�.j�몗Ȁ�s2�]�p�a�(C��Ey^hpg���!618۵s���r�.5(�C'�DC�x ������a���@ck{CYONX%c{�����͉�3P���b�\����,�"��Pa>���X@3`�Ί��4�Ê���.�}@���߉O���2�IP&D��c���RH�_��IRf�5a��u@�|�<cX�ۨ37Q@�BO8X�>������d:_/�x:���l�l�� 㡻+�+C������$�h}�2�l�� T�$I��4Jԇ�׳�[��}���x��Qv,����E�R\��nH�'םZHY�:OWMrV�>�qp�Zɗ������#XЃ�Ǫܲ#̐���I}�8�N��VVZ� ��F��"?D&w�{-��q=���{v@0�,�k��ɋ�C��8�.6�a�>���4��Ew��zp||3^(9@��*ģ��#���lU#����Qa��f��Z��i{�����َ�!����SE��d���mٵ���i϶�� �6�%�<�.^���-ʾn�8M7�Ʊ���*tpі� 2���Eo�愞�gb������Y���d�B�^NԢ��\���:/["E�er:zk��G�\� �n�=zB%�T�~�P>�F9 ��e� dKc� ��]F��;����l2� �~;{�z:�L+\�U1g6Ԝ������������"�ݪ<�`�i��`�@���dP��ձߎ$��Q�}ӴQ2ˑ<�rY6��17�tC_�"�Q;� �W����2&������QMNT�Y��/�t��8��V#uuz���Q�/ �x^�Q�!��}�����}�,JKAQ��2�Ϸ,'Q�~� ���t��~ ܨ�GE�㊽�w$J�JKQ������䫤t��? \;ZH�/z�^@v�@�����v8����hg������nWk��@��;��%Ė<�H&f��; ^���?��ږꡘ���@�*[!�f^�%xEQ�7H�;�z�O��Hr�#n�.�J��'A�_L��2ƘH^;x�W���Н��ݢ��E���}���)Ww@1���X`�O��2�$h�(���$��,�4�ˇ(�غClo?;�� �?6���Q�$Fą�;��~q˸����e�o����Q,m7���Ӷ�F#:Y����KP%6�>J7��g%���V�lң ��m�0���z��V�I�1��:=_��;�+X(����v���6M�D�B�=�����O�DDʛ�$��b�`9����r�}�#�P� /�e�<�����'T����!��x�$�hi���'�%}�E��Zk�M����IQ�0��VZLt��\�q-�XFʁ'�ЩS!��M�1��-�� �%���`�,U���(�26�K{~<����'���!�~�L9渖a�6:o��?��pq{M���^��:�A6T�T�J�����}ͥ�2�*Ϟ�ƅ�\����2x>H ��}?;I�>[�X�~� JЩuM� ���6�d���2Mm̂w7��<Rn���S:�{cLz�28�Lbs�������Ͳ���8��3FAld( .&�xՒ'H�96��r�1��s���5�Ăoؑca(�����JTW��0�9c������ށ���PX@�����'�� T���@[������uL��a�l����A<�Fad��e����m�41��U��Ti�(鷣- D��3��{ �~Q����[?G1�H�~�5�v��H@p�`���eT�/b"w퓶��PLj�8�f5`�@�k���I/�Hw��N�0�qdZ��C�i��a�fP�tЂ~Ҙ�O�T�Cd��q��mRh�lbr������cϚj5y���%��S%���09��('3(��f�x�͍!w�AI���Q��� �X0���xm��_%5����N�`�>8f�P�`&^D9���k��])�¯ m�hp���ܒ*O�n�G *�X�Bje
Behavioral task
behavioral1
Sample
70dc5cc682cd868017824c16bb570685.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
70dc5cc682cd868017824c16bb570685.exe
Resource
win10v2004-20231222-en
General
-
Target
70dc5cc682cd868017824c16bb570685
-
Size
11.2MB
-
MD5
70dc5cc682cd868017824c16bb570685
-
SHA1
390936f08249998f82fba1e9a5e2aa8ae29349cc
-
SHA256
62b45b2f521704337ed929e7ca0f80df88a34aa44c19182927267e59e3c4b2c1
-
SHA512
1858f952e2cd6b32311751fce7ce1641b40ee956e33759e8decb7704ff3b09a8f29e0b182caaf93ff60d537dc8a6f94baeb0736c8c9a05554773d76d5eb39394
-
SSDEEP
196608:5YnhlG5SrIzIQYs1hmvnKTfpltjQac29uGAgyc2apjCREy/1U+0F6puA5KR:AhgIIX7ryKTfvtjQD27As2aRqMGNE
Malware Config
Signatures
-
Detects Pyinstaller 1 IoCs
resource yara_rule sample pyinstaller -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 70dc5cc682cd868017824c16bb570685
Files
-
70dc5cc682cd868017824c16bb570685.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 71KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 19.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
hi.pyc