I���u�WP``��]�T C�����q#K�*;�l���!K��-pB�{���||�Hm},��Ź)\ �U��ុ S��w�E����ΫZ�+�y�Ų�u.��L�U4w�t�O��(2�*��Dɉ��2t ��"��Sq�~7Z��!�mq��T�<R�Ag��j-�X!�g�����uv�lȈ��v:b���vA�j2�w�jLC3ĥ�+�"�/H~���)�P��֍w/���ؠ����&;VٝubTZ�2��/����E3[@Ua�-�����[�6��pʴ5�Lo��9�H�$��!2;~�*�̝����lz{ߔ��*���(D\�Q��f!{DL�^"�������ocE�K#X��~���y����jR5����9d>��Ō��v0،^�6!��e��fAvl���[��y�] ����I:e|g���J����QQ�F��"�,��n�v��mހ��:�2�dC1�hk�F��'�M@��\!���Z�eI�OT�'k-���<���Pax}��+�>�C4��J���2? ���o�ƌ��l�0 8�za�/?���V$�)����<hʞsE�Rq+q�P+j#1͆ѸG����av'������ߟy��婿�������_盼s�0����(1Ͳ�_wC^ w�,nNy4�/ٵ�8���0@���&���\� ���X!ǀ�D��ϝ�O��f(��W�o��B q�4���Շdb���¨j~T�+��넜���o��҉*^oB��p{�,�e��~8yzgB�{rbk�|L&��*��#b͟�!}� Σ?J3�Fc�/0P�b�s���'6K�.�YI���^���y����^�IO�I��L��f��ƛS����~=��'UQ�]��RqS���h4���m��iIp{_X���&m3������A��o�,_�����LS �)@|�lm�`��=)�C���tWxrͥ�܇���U�t�ʔѤ%��v�G�o�\*��-a�dR�]����Y��i���X���||�|��q��#�$2ؔpYl��b��/h�����<[.J�C�͡��M�.��$���JYE��S4ۼ��DEN���~<5�c�`!1�UR;g�9��!�ۏ�3�н� A�u�s����@�v�3���ָmOw)y����,z?CL��n�J��R���i�4���9�%�gC�V�W�$$&�� ����|o���v8�0i��j�Ӧ�6��Vs��=F�x�#��X��*n������^�Li�ov�e��|����F\�L��ʠE�) ���;.7�L+�goi���3�ʲ�f]�h�ɻR� �a74�����������d4���/)�(69\T��sn�g���N�k�_<�n��=��OYE�ei�&���p�/��Q K�x; �5f�t��@�������e����j�A:�$���iZ��՝�%��'3� 0��}٦�2�eֆY�ut$�{;:���c�?.�X�ܴ�DB^�p��?I4�<| �Ì>�l^��!�u�p���f2��g��H�:��nڞF���[(+�쮴<C��Æ��[2L� �P��L��eLVhЋ '�HL3~��t��!�6��)z�r_�Dø���s���,jMW-�lS�J\�\�x)�p���?�;���0�}t� ;��A�K�S[c 82bsǼ�g�� @�w��9�� wo)�5�*���u;�+�[�/$=TyO��t�d`*F�l����6�"a��̥�D��3g)���^oУ>�~ӥc��Y`} �Dz�}�����*|X)�XE� ��D�� ����;����ް`���-��K�9�T�PG�����EF�*n�0�8w}�K������lRK�cF0�p����. �]�����L��� �:����e�1#�W�e�&iٙ�`6��{���P�N�ά�y���?~��;��}-�j�� :H�3�&�4�<�����L�F�i���F�)O�+|�y-���ǂv�^������qh�o�dž�NN=/�M}nq黨/f��gH����99[���_�`������~Iݦˤ���K�2�s- (<�j���k��.F�=�Ӑe��Iam�aS�����;D�__(�q/�FW��?���:�u��]�,�D�zuV�?� ,��]������h2�6�����:����\�@�u�Ƙ!�I�����f���I m`{���h_J�����'aKn��r���A`����dt�y��B@�I�QP����y6��{ܚ�[)�{0V�-G��j�����#�8��u<T?,Z<CDp������vkr��y�E���(��_zpô�ޚQG���_��]�^ޯ�X3o���m߶����A�=�,��JU���Y���!g�yB�NCRL9.�O��OG��74�5}5�V8 +l@kC[~�d�RO�)��3$��;wd����.��eGi����[EH���[�?�l#��z?�9��.y]��Ӭ�!M)�L�����&�P&�K(�0g&�Ϛ�_���y�L�Uʴ�H�Y�����mm� L��G�8T��S��3h"��Kn���6g������dN*���uL�v�y� �n>q��s�����&�F=(~����T�,�*fAfO����[r�`�Y��=�0����`�ˁ��� ��Z����~ ���y�bݑ���>�,P������ �&��R ɟH�������+�}�/�C�7@��p���]]?����WFeo���]��掹�����%/�bQ���z �z�c�@b�I</�M8�����aq�M=>�G�06E#�_3XPƆGs�3>pm����(����3̶ن;F�����f�����S��pK��C��d���"�� ��s�6E��X�q�Z�s�������k���0��"����������sh&H� �z��M2����,��\:��|� �bmY��2���A����+��;���\zP����B3ۡ���cO�_���� ; o=:���"��+�,����Ԯ���S@���E�����A�]ZۗԘ�ra��q$8I��a�Q/�yHi�xl���эY\5�17:����(7��O�/?c�����N?ˮ�~<�Ո��㈈:(���}5��劉�M/C|o♑�d�oz��?`.t��+������+�BI>�#���%�+�����p�T|�>�Ÿ�?��cS�M"����j>�p��SIa���r#��h�,�'�g����� �o�� }�8�G����r��M6E�����Z�F�A�ΑH����V�CND#W��##i]�Kܸ��jg�d}��� mr���t�/���eE�2��������:)�@�{-����
Static task
static1
Behavioral task
behavioral1
Sample
73454311df89d5d2a5e1a10495e38c62.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
73454311df89d5d2a5e1a10495e38c62.exe
Resource
win10v2004-20231215-en
General
-
Target
73454311df89d5d2a5e1a10495e38c62
-
Size
12.6MB
-
MD5
73454311df89d5d2a5e1a10495e38c62
-
SHA1
12955d3dfff7dbe4a6ff91eb4f2772d19757aa6f
-
SHA256
cde73f394ec6e7ac0454dbae70845d891a8d0f10fe68404c27ab0733b5e97a2e
-
SHA512
87b6d6b9dddc69e94d4164a0bfd9448bddd538e06ec5b75cf8335a1d048cbe274845197961b4d98293383f11715c0b03a09805171008176e6bf0d99fd2d876b6
-
SSDEEP
393216:SFksBgG8sPNnMsU2k+LdLelGq/YKEDd/ceSihWiAQ6PJlDZ/:SFZB1P+NyYxAKC0eSiD1Q/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 73454311df89d5d2a5e1a10495e38c62
Files
-
73454311df89d5d2a5e1a10495e38c62.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 10.3MB - Virtual size: 12.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 105KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE