�K��h*g�O-��>G� �%ϙٞ�$L�"w\�Ȅ*i�5l��Y<|]g"3�0�� �DC0c��@^�K8�=��tD�"��TW�����gx����$�(P��@�eA��H��(�]��~˥y˃�2�Q�<��N:�'���A!G`���������b���>�nS�݃��� ˀ�!�!mQHGF��*OP�=z�w��Z}v.X���;�f__=��iw��:��� 6U@��w��� ���e�P1�vO��Nr"�Hpr�P-`�~n��.?�*�U����z��v{�����ʙ9�1����\|�K��<��xޘN�Qլ�IT�F����"a`o{��!�&qҖ��e6���l�ٛ0q�R��b�aC��v�{�����cDΚԸG�� ��HE���[��Z��TK���H�(~8�>��'o�]ַ �BT����[�I�E#�.<���-���H5����l�DҔ;�f�>�����&�a��2NQX����NB�Q��A�j�N���<��g��Nj�"K��,p3|��N��W1Ȅ���d���p7l?1���PB�d�ۘɻ�nwM�a|��Rk�QT�����혌?�S��WV����;���pQj���O^�c��U"��Y����s9�x�n0�k.@�qa�������� � �)C�ZZ��G @��s���i�Y]�!�g8�6��-!X��o���~#��:�C����p��7,��.B3�(�]� q��G@�|[U�������������W�v�����b����[�B:G�\���fr���r�:8=�腎eұ`�{�u�/צ����d��]*�Q����G���װw{o��ԻZ�h����+wh��:\��+һ�X�w҄|�m�!2n¦ <�Nb�UM%�p�?U����j�ȕ��5��4I\�t��][�C-l�{f��*�����(;���]�������5u4/$w�,]������QS�H<N(�3��]``�l� �&oz!��?=Y����s�TA?�-��C����VXj��Ud�>��)��%.���_�ׯ�&���<��E�5HAᾩY���?�vA��!��U�+{@w�� c�����h� �V9��ʼn-ze�2�ؚܺJ��Z��B���߭)-=�Cl�@��������r�����4O/*�덙7�?X��R�*��TXb�sa� �;VL�]k�nK��{�j��܁�@M��QA3Ǿ1$˰�q���O ����mu`Xn����W��*D��Bwb_QC\X���ѫ��å���b�%|y�k*�b4��6u�g�8pLˀ����1`Xc��2^��uҮ��V LVo�b���/`�<�|#Ms������K� 6�U �4T�4��%rb��淐���&�bR/����@X ��Lk=H�5~9*��-�I����wi⊉s��-X��afx�k;\}pC��_��ʷn�fr�8���dխL�d^�n`&\[j�h+ ��������n~����Լ*W|:�����M�/��~<IR����^�<�ň¼�ঠ2�ZXি�<���q�����v�)��+�0��o�ECyw�oU+y7r`}�੯n�/���̾�vay����K$�_�EmوS����Ut��N/�����ܓ�R;["S�:#�תm /s�NO ��1��^\�3�Yt����I��kip�W�75]=���E@�����Z�Z{ mɔY����L�����N��@/X�,'C���-�h`J���&0��2l�����8ߥ�f:}c�zMĦ��/X�V����%��8������G�]n��-���Y��#L-ʣc��|�m9�V{f1_;m��<* ��DB<?��3��)s:��X|,�:� �X��E'�~C��n�T�s#��bBW�(t��i)�� �����W��5N0� �H���(�Z�宱��]4�̭90k�7�TY�� �D�F�+���cA�{��pA�t��Gj7c"�V�@�x:�<� y�tp]�^w#sp�6�7 ��句�G)4�)��_x���x<������k`��_�/�"�S���+h�$O�ڢ�яn�i@����K"9���-�x�!��H2�b73�]��.�� y«��gP���0��I��kN����Qb}�||��,�����,��ڋ��:i2�ϕ���2�~��8��j|X3�zA0d��\t���2�����X�.P��h�!MC�RydZa�rgf_��-Ƌz �͕%��B���E��eyR+��85!nP���������(��HI�O�%�����=�6�kx���PP�<Z7�ɬ� ��E�ɑ���Y��k�Q{H�IN*��\��@�瑅Ay��o4~�W4�)��^�iP�-�P��`1��4�}�#����}����!���d���or|��͇����+#����$��#Dr����'T��UPtL��c*�k���ME?x�� � ^8I@������j`�?�#KѲ���H�>{�NnAZ�D��̈e�;�Jؼb�Eu��^���=�e�G�2�̼]�ga4S���A�l#�� 1�B���gR"xmJT�/46�r6�{�4�N2�K�,��憓;|ξ���*�5g���ע� S���^�4�c: �U����>�x�E���������W���qI��9����J�������0�2S�����`����-��G�d��� ��L��\����W5�A�6���Fz;M�G�s�a����7����~#Qo���X7�:xy�����M�_!�]���No<�"^<+�2�\u;�@`�i��.�%J2�D��8kR��b6�q����t�A�L>���*<&�1�FIx�]e�c,���� ń�<f���4��P2Ǜ��5\!�D0�Ӆ��4�G�!$R'l '���Xq����)�� �u�;���ʠ�����'��{���N>�9_�O�����(�5�F�:#�C>���&j$��]��免�*4�Ј��G p�Q'�D��Č��}[���"���K~���V�'�M���\Gx��.��0��,�H~:J��������J!�"}w{�0
Static task
static1
Behavioral task
behavioral1
Sample
English.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
English.exe
Resource
win10v2004-20231215-en
General
-
Target
English.exe
-
Size
9.0MB
-
MD5
d024b77cc50bd3335253f13f422d388a
-
SHA1
cb5dd920d0d6ea559136e677165f68ef94ee6b42
-
SHA256
657bad949ef9927205a9b94b5764e64e39b935f68286b58804abb37c487f6582
-
SHA512
6b41281451a048f1683de7f2652b932ddd490619fe1f87ac42c171cb625397ee96ac2e0604b365e37bec566b503e0785998e7bf074c345142a7fb5f3a083f035
-
SSDEEP
196608:wMLGrjDtAjpnLljFrXXGYFgu6oRDagnouyXBda2JJ:tGrH4pnLPXXPg7TUsVz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource English.exe
Files
-
English.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 372KB - Virtual size: 760KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 213KB - Virtual size: 472KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 31.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7.0MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE