���V����#�4�+<�����A���5J�K<d�m4�kpl���c���=���v i뱿q�l�ܞ�dh[�td�H�q(� C6j�`���0�̂M��cJ�@��!yG0��\Ե'̈}I,aaX?�ߓq��»yE� mW7t������uIPA�#���/���mR���t���&���"���u�ԟk;/W5�����:%%�����}\�ī�4Fxƪ��|(�ٯ����d�.��ܔC>R���g¢��A�Gy�Ě��1� 2�� X�/��R����� ;�#{�4B�;�5�E��?�w}_s�"��ə� ?6�^e�IK:@�˟w�ѿ�|a�y�,6������K��U�ת] ,b���p��q�0lR= Qo�)��+P[��3�� /���X��ǥ^tt[�93_j^q&�?��iN B4�,�09�>Fɒ�veĂ��9/C� 0�"L=YX��h&�V���Ѩ��Rt�(���eH��ѝX��1Gi��$����z��K�̳x��!�����L}w��L��.�__�,U���-���a9<��?���n ����X�5˪؊�>��Ss睅�]���٨=¶i�X>�r� Q�F<#���W���)7�ݳ�W�M�+Y^��k�ŗ�{x1��.���x���e�x&�Zc�ޢʙ%H�2R�`�7f[8��ρ���Ʉtv���YZh� �B*�n�܉ ϥt��;D�.�-v�8���3�nXj�-��a���j;Ԛ�9�d�>�j0SK5��/�����%dWI����Rk�Y ����T�le_oL̯T���M�c-�,`gN6^��&���B"px�����\�N�_$' n�K=��Z���v2�+��w� (=����m�b�̫�l�����ĕ��k��P��,�����ѧ)�c"�2+�؝��U������XA����4}�T�0MѸ�(v��2������1<��{ d֗�`��ot�?�z5{�Gx.�����M*��HNL �B�6���Z��҄�A�+���Ջ�s�����А���/~����T87�}���="�Mv�"e�Q�v<���$�Ax��=&�>J2���|� 4����!��_zT��J��vH����Z�}ᚆ��(�.��p�sj��L`!��<��c����a�M>X�ΨgvB@idnF�>�n�a˘o���ׂ˲fQ0tPK��'۹��RI%j��ݯ5&���,�W,����k�Y#2D1�e�z�'��%�!�ਂ�_'VgMM��'� �d��5nG��kP����2v�+]r�$�(��N�:d�����/����>l_'��CEQ��qX��<�j� y�Y���q��e�Q ���4�F�1)�8M2ĵ�::P���m1��C��D������_��ۥN�Ԧ��`�W��*?��³�f�P��}LmEVl��qq��$��8���p�-2��&�M[% ��%�e��[�Z����uA�;�80f�"�I��Z��������[58��m��w��[sgU3���R�,�yH��?e[YQ� ����l����+���RdV����9����ڙ�"��vM�L�m�0k�;�������S=Rh;La�d5����?��c0<����z��u��vr%�H��e�6B�����4��a�ab�pժM�"�"�]�t��x���3���go�o� s2��Ɖi.�����#�-�9��\wɒ�7�����=�Q�;�2����k�� ��A�v$R�4��?r�LRI���o`!������/<�O���\}'.Wqj�q�7SAa�|�?-VA��ީ�H�;'�:B*W���n�e��26��aYS;����K����U��`�-��k��5���gW��$�Wv�&��+��|��� �����XӍsٷ�u�v>��aԿW#�T��ՙ�O��>���hӫ��I����YUA�.e!�0MJ1"�K7����ـ\�ԴH�����At_�F�<�ta*�@o��/Pi@q�Or�.Ѣr��GCAO����'*j2@1�Nu����T�H4��%i��|N�;����aiU4��/����0] V��U�i��a���i9GSˡ��Y �'��!�����q��!�$_S��Vy/\ �`�x8�{��A5����?����fCr2�'%37��)��X��*�( w����!rg&]pĶC��T��[.��g叶b3� Ɯ��N6Ϩ2�zh}^�l����N^����1��^߬�_ �8�'�DE��"-h�������E�H��b37JX��Tb����<�Q�j����%Ҿ���8J�Q��0A�R�twܵͥlՋ����&f�V��w%�I&j1�x0���I�W��78E�m�~~�� /�m���Q��8��� ����1�����0�'��7<�EӍ?%M�I���!�ƃA� A��*L�*�%Q/��~�<�j�ăO�����9��KKJ���zoz�&c۲] �x��Q{t��Lʢ����ʯ�P��֣S^p=B�]um��2�ƗL�C�g>bT�?yLH����� ��,�a��u&��@;a�1X�Yu;K��Y��W��ȱT�U����e�AD 6��-�aJh�ծ~N��P���)�5őD����"q��`>h�!`=J�mb� �A�; � ��m���~�C� �P��~�F�U�|���l�t�0�$PI�c� #�!uRX=un�M�n7�o��@5�]�����)�20��*���˛oC��1����0���U`\�ѢdϦ��P�Rd�4%Eϕb=d/6�t�f�f�$����i=�O����g����AH�>_��N0�k�2�>��"��&=����3k�r��L��xAe�m����<<���"���!)��i��Kb@e�!X$�9q��A(s�ʼnqx|%6j��a�6��K.Vc�n��h������l���c�KR.��ͺ"�l�H�>��%������O��.�M"������Vx祛~�>#�y�ݴ�ۡ�Bң�:�k4Y�,�B��o��6�$/�6z���d��s����|{�~i�"%���9a�$�O�(+z�z����y���g�"�_�XHu;�`�.���2%ա����o�߉ă�_�i��{�0Av|�(�1�����$Wy*��!C�Ն�f�s���>Ly���6kyƜX9�9�@���L����B[A��⺶�� k\ݭ9�e��pW�� L��������<�缔��ӡ��n�4.��[���?��(l�0�(�]���]�P������9�<u!,@�y��C)9��U��A��c�/�u �Gjd�+�pP���1����0�I[�ΐU2ӌ�B=��_%�!}�~צ���;P�~���H�SA�1�%��?�����o��U1V�0 ���%-q)@~u���b���-'�o��0*.�ղ�]J��*���&����S3%Zh�����9i�3��,}F���m�� ����;�>�k�f���`����EL� ͷ�>ӫE�cMG>�p�x�-�!�)]�@���Xv�{��� �;*���( Ju�.m[�pO�3�aS sv�S���Q8y`#���¬���F@C?Cz�SS�n�� ]��ħ���ҏ�2)AM��Q=0L�m@�MB���[#_:*������y�����^�ZD%[��z�������~��� 5���S���w�p�mM� L,��|�W�5��W�(>kꪕ��!�c�|����j�
Static task
static1
Behavioral task
behavioral1
Sample
3bbdf288a09973d5a8a3d3a5fcd769a5b7c77745d1e98286de82808ea7ca0644.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3bbdf288a09973d5a8a3d3a5fcd769a5b7c77745d1e98286de82808ea7ca0644.exe
Resource
win10v2004-20231215-en
General
-
Target
3bbdf288a09973d5a8a3d3a5fcd769a5b7c77745d1e98286de82808ea7ca0644
-
Size
3.7MB
-
MD5
39b1f4f16bdf2ad8070fcca56ac8a746
-
SHA1
1e89036b5e31ad93c50b9154291d602d9448ed04
-
SHA256
3bbdf288a09973d5a8a3d3a5fcd769a5b7c77745d1e98286de82808ea7ca0644
-
SHA512
f8fc19a941ab58b9e9dd61ed5d9614321c924d64b41be9a2f9b0164d5dc50ed80b46f2cc1c3763df0c68405b75ce4591f7a5af48f47c52799bf33ebd247f3f6c
-
SSDEEP
98304:LmWSEoASieNhb5C9ZJk2V3Xga8b2EVCxIk3X:6WxoZiwp5uhn0CBn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3bbdf288a09973d5a8a3d3a5fcd769a5b7c77745d1e98286de82808ea7ca0644
Files
-
3bbdf288a09973d5a8a3d3a5fcd769a5b7c77745d1e98286de82808ea7ca0644.exe windows:5 windows x64 arch:x64
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 431KB - Virtual size: 888KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 49KB - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 14KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 106KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE