Ⓒ�s��Jfo�`��TNmܕ������� f�=L�Q��W�ť�3 �n�+� WBp~���{�(�Ƅ�0*A%�QՒ��bߜ^�Z�r�Gw��p"9r��Q%�EZ�)dV �k77B<o@ ��u���EM|�]�;����?��M�k�N�[eo�<t�������x�� ����g�ʞb\��^e�X�R��9������_�%e8�*������H�/d��h %���>u�7^$���f���0,y�Ob����N=�Ɯ�ޝ��:��5�8j�7va�{��@���}L$[n�F���*�� I�_bB���@:Dk��RI~_�68΄�r�,��1�$�����y�H�TQB��ѳ�(�}�6�$����Ԥ(m�>���� ��Y��0`���;��mL�;�0g϶�A�7v�7�����Q�a�t�^�ګx'��h.(��^��;�L�^�5ܭ�?�%��yk�؊w|m���6G��y�No����m:y0������Z�Q᎔�G�K'yA�Tm����'�����*W�*�����^�NXi�����3C�5j�0`����bH��e;�Q���H�b�rEX��܃̖�^�)b&��Z���E��O��g�8�Sp�� �٬�����Y�ѹ���$��=C�1�j'�����//�y�d�УF�(V���T2f�?�6�Ȼ�����"�Β�f╦$DP�\2Lz�c.�l�)": �&�B~�1f�w�����Ǝ���=�8�"���1ɛd�I��a������6�RdV���������A;�`R�T%���#�k�܃w(`�BHW�m���ɉ5�2y��� 4X�1cT�p�v��a����r��6|Ym���@()����\��aO����K����x�.p��!"�w<'s���NJ�i��;����WM�#Q39q=A��؏���ܗ���_.�!ӅE��t��!��|+NB�����a ���T()�����O����![��JV�^��Ф϶�;�ӴDp��߅,ܹ�A��c��=OO�;cϔ�j-G���C1�vٙ6B���D|?��V���YO��4Ҥ����EH n�SMv��j�.a��9)h�s�I`����@��������Mb��k��F��/�d~�� ���� +���6�і��ٸ����L'���S�ʛ�E��aV��i�f�k�e�/"o�[)�:b*}��8�)����u7e�w����˭�~�<Y~����i<��#��>����& ���2el�@r�����:\g&<r�P+ +#���Kg���X�c�y�Q��5L&O�dyլ�q1ҵ�����\�f!��h�1�9 �&�� �嚰�-��0��@ {J��Ɨ���8Er~NP �V��vo�bҾ��T�P������"�)��}3����z��Oj v�գ� �G�4 9J�K��P�d�?�1�҂+U%!(��#O�y0�i�U��I��;z��v��v�_�����@2�[�edXH�V�"���ABJ}�.r�e�^9�^��.�����g���lR�|�ZXO�RX���92+�|!-9$��sR����*([�?j��RC�n(�'`;�ӻ��{*�t�����ځvP�����ѿWtK"Pd���>f��)�T�zUy�K��5�U�~�\>���M�j4X�Viz��?��n^�6K�^���C��NJ��w��굢�d�״�}Pt�Q�k9�C1�/��KƐe� ;Eh�\|#��"�"k��Z�Tof�1���ݬW�&d�6�RI^ݽR�,���G�M�"��;K�>�.Q��� ��T�Y���ZN>�5���Ss�hk�AX��sHC&u�[f��b��۾����s`��!�Y|�xEtJ�%&���Q���i��-�� �㦈{� A��b��ȶ𥊵�Ч�mz^;���!d������9�n9���S:s�'ᥬ[4P%�L�ٍ����N4J_@�9��kA�;���u��D��U�F�ѓC��Qo�����Y^�O��&�_F�,%����e��u�i��.}]���C.��X3'��i��(���C�$����+B>(Lkb���KvsZY�����c�h�H+_�"������E�=����4x�>�ڿ~/#��Or߈��s�A9�D�?�#��3Ez���XoJQQ��5H}�6�S� ��8u�f5�{ Iua���͇#-���'������Q����U4�$yV��������Q%`-�Uξ�W,Ԓ`(��M����kvt��$)~�e/ֈHý麁�H. �lsLaC��������喉�l~,s�0��M�$����ᯖ^����������S���|�t��(鎄:)X&,#��D���bc��Ty���ٯ3y�.�SS�:MNb�dB��R��U2`P{�4C/3���-e&#������["QZZk��I�q���``j�4�#��/���;�����nu2������1jBK�;��/��nO=�'�r���,B�z������fކ^�Ê�����G<n�9�f=�p`c_��;��w��L��U1�[ ��4�;�`�%��.�dZ�";�(B�_�'����Xnkg1���_4嘆�{����!ޙ��_��n�;X$���Ŵ�k����3ns���r��>��]n�@\E��ˇl��[u H2�a{D�o�M`tZ^cꟊL�\��\j�v�XS ��\���,h���칵x��b�T�=�:��(��" ���݅�;�N�7+AzU�c!��X���I�^��m��$�n�X��b��)�^Tv��e\p(��7|r��N����ea��������npj�N* ��>.��Z ��z�Be�]�������Y]� i����pM�y�as�u�1�'�FWP3��qD��e����w�������+JL�@��i6����H � � 4D��Y���4�[�\Y���0F��.`7n�o��63U3�|�p!�Y��̩ ��DQ(����-�a��Ce��:;�y�;�mfʓ�W���Ld��5��P�?����G$�)���#FyDK��z8<V�p M�;�U�o§�Ă��V�<ό���V�́?��3��V�r�2���
Static task
static1
Behavioral task
behavioral1
Sample
044dbdcd5d949ad463304e3768d5df7b11c90b9e63fb119b90d8171420125b6d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
044dbdcd5d949ad463304e3768d5df7b11c90b9e63fb119b90d8171420125b6d.exe
Resource
win10v2004-20231215-en
General
-
Target
044dbdcd5d949ad463304e3768d5df7b11c90b9e63fb119b90d8171420125b6d
-
Size
3.2MB
-
MD5
45383238fdefcaba17d707c60863a970
-
SHA1
b7333a2878d16fe0816efe5d5977bd11dc50973a
-
SHA256
044dbdcd5d949ad463304e3768d5df7b11c90b9e63fb119b90d8171420125b6d
-
SHA512
6767021f09a193101ee8c4c94804a207c97c0a104d4d9a327205badad9b5f3d94cbec5368caa0cb0d80bbfee5cb7950d653ef15da5b29782841aa5ccc4e55d74
-
SSDEEP
98304:GXbNXhbKzlpiQhlvGtVZYped8ufg/XETDb5ML:8bJhb2AaE10ufWXETv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 044dbdcd5d949ad463304e3768d5df7b11c90b9e63fb119b90d8171420125b6d
Files
-
044dbdcd5d949ad463304e3768d5df7b11c90b9e63fb119b90d8171420125b6d.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 43KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 18KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 46KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE