:�C�������% ����v{x�#��/G�}(0-��� u<nK���ZA�,I\P��j�nyx�����ѹ���J^��u(/�����'[� �B��'g�@�$��Ԯ��Se��V�ʭg�C3dI�"kWC�V^�u�)�yj�A�ə��ZwÁ��t������y�r ]���b� rRg��I���3�>�tR7��u��2Z��������H\&+Î6�ꡞD1��m�UN--�g2��Lϣ��v@;�g+�4����z��X���/v2�J|�~H��E�뵄V���4��[p<�@==_;1b�嶯�K��x�pv\�o��i��8�z�e6��8�z�������Q�o��{�$֟Kh�`]!�!{����s���i�3ή�����Zm�1�S���j�Z�a�+�X���������]��(����'���c�8�����_f�o8Xmw�;�Dy@�lm��!��?\�M�Ӱ�ɀ�LK%Ru:3>�����g�>���kԦ�f��E����z����8ԣ(ZQ9���D�T����!�o���vda̍/�\�����9_ͧ]�#�좔��3��x�-�Z�V����>��|O6���f�>0�� ���-��I�?o��4�aĿ�>�8��ij�����1q� J���*��@�!7��쁆>���"rݒ}l���2��-�y��=N�ƏoT�O}Aܷ���t��F��л`�d�Q��O���r|�-أ��X����u�R&+���ͳ3����ִPw�`}�:������,�A*��y/n����4c�%�hI�2���VνUii=���ۯUTS�XDWprс"�@���,��9���F}h�1�ϾQ��lA�p�[��p����!��X�8ch��I�6r$z�c'>�R5��V����rnx.��2�qS9 {�g�x��bzb��(���«-��W�x:�����p1YBq���.YQ�(L�lH��Z�VI����}x�\ [#�w�'8Ն\���#]��`��7�4���M5���$,`~)�g}�ٞ 4�S�iߕ��Mf�֧AF�����B����ü4��5�������#�Q\{j �_����o\���h���ힷ^�c��C!4�i,Y�1ph�o����� �h*�P���f5�ڇ1��^�X:ܪ��7��h˺>�����8R�p跧���/�&;����fG��։gn$�r��\ ytt{���g1\�����^�M����l"R��Ií��]P�*P�ʛ.�D�1�V12Z��U��(M��˲��*�/*»J�x�Zt[P������φ�M=��}l�$vZ�?�G���^�&�_/����U|Z�d��]�4�)!�����U�uH�%2��*T�S����ZJ�T_z��r(������w>�L��_��8>��m-J��=*����ܯV(G�4�6zJ[N��V�5���"���n��mڳ%-�c�#?�84������[�Мh����)��rO�S�=H�����l��pU��V��gSU�Ͷۡ$��BUu��&$V���+ +%z���1���1���J~���^t/����Cʹ*�r�� e9Q���3{�I:x2���H�P d��t�3���5A�(��e����w�2�ձ�8���Isn��T��L:��&���F��|���D��B-s����0�}�OC:�ЊnR�:0�ڏk�k Iډ��ͬ#��'��f�!�Өk��:B�D#R;���g .��Z�����"!}+�K��� }U��|,+>&�оv���g&i�9����.D��A_���?��������/���f#���#PB�b9��xp>O�6��8�C��8C-��QE(��R� �el���ͮঽ���Ǻ�>��7����4���bf����C�CV��y��0}{�q �++.��.q(�)���l�m=�Ѫ��YTON1F���m�e� �j�m����SNJo��>�u���ax�8X��{�R�$L��e3?�MB�w��~N��x/�� �9�{��iǟ��_E���!<�nX����t�7�����_}�h��j&V�~ӑE~ܟ�U��f��X�I#�"��&1{Q��Dz���T\�Up�� T�d��i&C�; ����@Pp��:�8��D��mZS�� �O���bw�fm�4�ҫ��ظV24�ҹ JH�K��' 3�����_ߚ��}�>�Q�5�ք��٠%⛳ �2 |a��˭xz�0J����ut�lM�7��v�`���V%�ko|7�yV<U��i ���+����-�)�%����Ч�`��_�2��B�R �ʁ����u�Y�b�a5w��)L���w~|��6m��� ���{i˙��'f�^�L\-g;)T.�IPI<�����1��*�K8L���MIzʋ*�'s!Ь&�&+�z����bR��S����l>����( ·�\�=t�����3�̸:wv*��I��9>�CC��,n��6f�-����v���ۨu�q!�2�"���K��4�@�>M�08s7��rL~)د��Gǭ�E�P�r��C��3�r`�����~a=���h1����l���ԡ<la�'�;N��발��pm��+|�z�.R�L�/4���ދ|��R6i�����x'*�ӭ�`��g&������>L���O��w�~�J�C��^��%4�I6��:9N퍷X�%��q���K����.��}��/��V�D�*����,dZl��>�rC�(ۓ�@g��J���=�E�aʽ�"����\c�Z$�o�3�u���U��dD�j ��|�I��vjA�Ե{�@�3T���S�����������&یсv�$�𱗭�M���U���Q��ܕNU�pg�������F��QS-Kz���;���a�u���z�>���u!�kۡ�{�����s��E�qm����wТ��a�w@�'���a����,0������~�����R�5�ܫ��-�v����G�?�:��%���Q��M83X��� |�W&݉W�}�7:��Ӽ�;�8��M�=[T�8�צh��g�'��cr{q��X%�R jY$i��︑0B�=�����s^"�����[ۿ�{�`�C����`���J��ƽ�����`Z�U�p����7����{� �H��|�B� �5��=��9,��LVtt��K=��7=���mt�N�`���Z�H>�!�!�k�bA�}U�&ms\�rս;]g&�̖R�y�`��$�k{w>ec�����H�^�{�����-�����7>x:#]c�7��*���]�L� �`� �y��R3ѽ���л\+*}Xz�FI�&=���$~�=�a��B���� Z�\� �D_� ��8l'��3@��=�A�q�k?Y�]m:���f�� x� L�,�Lp+������9�����E�˻�Sc�3�-�U��c���װ��y�W���ȑ�8j���]��X��∕O|X���{���=��z-3��̎��]��l]�k(��%M���i���Д��}ulKn�Ԑ�_����4k`-�4� F�Z�Fn�z��盻s����HK�IT����u�djJ����;v�0������?@�+�ٸqD��]���R����0G������������9�0O8���H��|�.������JbqiO�u�C�\g�9��Ta��CZn����f*&f�5��X51���]����N[�|��L6�MT�kP��w$LGH��� n-x�ܥ^<� ���r�2��X������Z����ܮ#'��\.�-�Q y �[�C��qa��'w����7�1@0��X
Static task
static1
Behavioral task
behavioral1
Sample
ae1c3d61bcb43afdf3763e7c47ffc5427331406566362fe07c5a6fd8ef6c6585.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ae1c3d61bcb43afdf3763e7c47ffc5427331406566362fe07c5a6fd8ef6c6585.exe
Resource
win10v2004-20231215-en
General
-
Target
ae1c3d61bcb43afdf3763e7c47ffc5427331406566362fe07c5a6fd8ef6c6585
-
Size
3.6MB
-
MD5
655584f3b5ea863c3b0b07be5d1ebb02
-
SHA1
e587a64b8e06c59ee635e31e1267721196499cb4
-
SHA256
ae1c3d61bcb43afdf3763e7c47ffc5427331406566362fe07c5a6fd8ef6c6585
-
SHA512
b2fd7597c2dcad312b07d895ae24cf86dd20488596360301a1bf238f129451f3481fe754ed8541dad2905c235c3a454ba2cc04d954094b17215c6e73ab897632
-
SSDEEP
98304:56TiI4t3eNSpZjLadxaHCRBF2gE8ZgwIZhK4T4iPdDYaZe:56TNw3eopZjLa1BI8ZgFZhK4T4iez
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ae1c3d61bcb43afdf3763e7c47ffc5427331406566362fe07c5a6fd8ef6c6585
Files
-
ae1c3d61bcb43afdf3763e7c47ffc5427331406566362fe07c5a6fd8ef6c6585.exe windows:5 windows x64 arch:x64
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 431KB - Virtual size: 888KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 49KB - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 14KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 106KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE