���r|�8�bG�)�ÏR� 꽈3P���Hp_`=Я������=Kb�ݿ�DY��p��?Q��7��@`zo]n��J=_j�n6#�], �8�4��g��� �1�E=a> y�[��cy}Tۯd�W�����L&���k�d��v<9݇�=N�|>��2�f�E+�h�fw�M- ��0���i�4�x�:m2pބ$|��6G4Q/�W�23����U)Ư ��_����ѷ�OMʧ:�۵@_5��B��A���� ��P�ek`�,5�RBԸ�k�"L�/C�.P��`h�Q�?���zzM����j���f0�f�n�6#�/-����O<���=�Uٍ��[��ߊg��uO��G��A��Dm�os���НG;ΈHq�|�)����=�-���m��!b��� ����f�e7��Fv�[�5�B�o�n7����Px�PoWJ�7G�C�m�7�w�n�L|S���`3RU�v��j�5��s�G���?��=���-�s�����������3�d�J���8����� ڊe��dT�ݯ���U'�uZ��O����n���ߘ=����d��G��ҍkl������(a�E���Z�~+I���AJقeś��?���mz���ACB\��72f�+�����C�� ߭�]��͎��Qy��q�����w���Oː{ʁR�"j|3Mu�8��>�DI�����ݬo�@e�{e�9�>O�s��=&%���֧m����P@�ŧͦ�����s�q�N��Aa�E�&��:f�+Ċ��C��BK����z<x�&�pkHx����z��C���K��n �[�8����@{���zq�V4��[�j`���*FJ�.J�O�y�GN��dBѫ;P䠴���y�d� �LTL����r�����Y/��o�+�1�*i'Iլ���� f*=<����a6�R��a���>vV�x5z�(KUnO��蕠������� ���o��h����{$`dr��,�]�V�L�2| *�=w���H���T�+1\��/������}ɣRXT�=�+~O��ߒ��~�4��{�4l���o8 �1��5ՠ�e���H�N�Y=��"k���xb�Șu�L����ږ�Eڰ�^)>ڣ�,j�>�]�b�eݦc�@��/��Y�Gj���s��Z��7@6��?�Q��pd�h��9P����i%ݽQ��v2}N�"�0�m��2Pm��f>V��X��*���_�����(V���=�[ <]&{�Ԥ����H�2�ޞ�"W�p|M8�0 �T, ��?�(��N����J�o���:��r�(� ���@`�5����#��F��Zcf?Ɩ���fr ls��4�8}��^2B���� $~����}-���q��Q�C�jpA������yLG٬���X�-l�+[��>F*KQ����y��)ݡN�ZV�PPTz��wgD0�4��}�ς�{���d�?avI%�މ�'���zA��0f>����E��)�(����(�r�d���nĤ˧���� o�y�d@#�Bb� �$/��:i9��ہH�A]<D@��+�w��{K�2�S"%-�.�!��n�M����-��_�k-��R#T[��aH��" F�>�|F��Xd�R��(���+���,[�a��)����s��8�~b� ^^{��e��"�ú!�#�X������$7y�W(o�Az�Y!`���[����\|4W+~�m���I��$�p�{�wB���׀���z�77F�!S�[����>�O�:l�R�(��XZ暕���6��g�����>�����?���������`nj�{�BMR�Z7�h��Fo�r�����9z�����Ȋb���`��TТ��z ݛ2�^�r�ԩ�%YT��ξ�"��G����a��<�2���m>E:�g���X�֦�D�%������d���7�l��J���W��6=����lB/1�v�J�N���+s�1}�01��WM�et�s��ʬ,���Q�z�Y�>n�����=T�z��oM�XC��ƘҔ����ug���/p������L�i2�Xΐ�6�bQ�*Q�0}��K������Wz4�l��M�=T3�⽁��5oJ`��yNd������]�M4��#&�E�t�R呾��ۀ��.��a�C��V@bUv����\����U��ޞXvQ}͵�>�Xs��7������3�s2l�j��s ���l� �#,5� �X�[�ְϚX�5����¨��rc2T̆6ü�]�+Xw��H$�rŬ���Z���[e�'kyZ@�ѧ�Gߏ���b����7������jNw1�hz]J\6�o���-K��0��ňì��os�c�k���ޓ*?��c�!%�1���)��z6X2��c=�Cܧ!Os�]�ѯ�p�ڡ��쉆͘��`�����A���������:I� �ĭ���z�,.+�W�!d�`=r�A[6�����&�V���$��X�yӎ>j<�c����1�%� OL�A���'0�B ����/o���G�����MP��ϧCh��KD�/���kiw%l�� ��@s�H@A�������Qn;{�b[���+�a��]��Y�D� ��7 �7�K�v�j1��3(j9�e��=Җ�yബ-W��tb(�2�"{R$V��rf[1�F�|���C�g�'k�2q���1����z ��ۖ6� �{�{Њ=��#4ʵ�(D[� ��@%eF�{�,�k�ҵ�~���Ec�ESZ5@^�kUF1:K?���\��]~I뇠�-Z��+/6�'; ��ڷM� �Ӡ�f���h�{[�D�(B�&h�4���~���?�C�bzt�,�1��At��[�L�=���5���bJ;x;�4h��ҘW<is�*�3A�-W#�"=l�e�1`�3AI��e� c����Z=������ `d��ʫ��=ZU/��lV ]J�[�)��vUr������aY(��,��i�Te��i�ۤ��r �{��=��Ї[���P.��$�b�����K��n���0�ËZ��bG�F��K .E����:��1~��[��ԕ f���ݳ�/���%���������t��M ���Eh5�ip���5Hh���¿x�c�����d�Q���L$ ���h�~3�|0���"���o�e~t���iX�S)� B�� gwIN-�$f��ȴ�X���)������8&��ß�y��ieȜ��# q+�� *T�B�7�IP�h��VW�F������\�o,��8CE,�,�|#��(|��}�_p�Ь� wEx�k�a�݀�n c������~��Qo>�3��z����^=����#� �sħ��B��m� ֍��8� F�5�8զ��YM��S�.��lf�z������2���`��]�3�)ˏU_��C����
Static task
static1
Behavioral task
behavioral1
Sample
4bb849f4ce2b8b04bfa576f67b66efbd4ed19cfcc562a6c729efb1fa8a7e42b6.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4bb849f4ce2b8b04bfa576f67b66efbd4ed19cfcc562a6c729efb1fa8a7e42b6.exe
Resource
win10v2004-20231222-en
General
-
Target
4bb849f4ce2b8b04bfa576f67b66efbd4ed19cfcc562a6c729efb1fa8a7e42b6
-
Size
6.3MB
-
MD5
0efd4d63089678fb9bed212c5ef652e6
-
SHA1
174207f8ab11a404d2cb3c55b6511485f6197bb9
-
SHA256
4bb849f4ce2b8b04bfa576f67b66efbd4ed19cfcc562a6c729efb1fa8a7e42b6
-
SHA512
01db7dce2252dc8f93e24abe1396d75a95cf96209cd498773ec3d060805dd18b3d0c88a1e9e0e40c7cfedf973886ebf85fc07649a1cf2a0660072650b18864c2
-
SSDEEP
98304:IyjA30k64BW4emkMcN/huGkq6N5jvY86egryo9bgerdK0pJDnQAL8xd8AAy0++i4:NjEXBPLcvkfM80HhhCAmp233t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4bb849f4ce2b8b04bfa576f67b66efbd4ed19cfcc562a6c729efb1fa8a7e42b6
Files
-
4bb849f4ce2b8b04bfa576f67b66efbd4ed19cfcc562a6c729efb1fa8a7e42b6.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 1.6MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 387KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 927KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 11KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE