��L�p*P��xu�ͨ���&l�,��FzS����WOi�4�uo�8�Y>�R�\b�4��m}�9��=3y �[Z�����9z9�Ռ�t��=i=V�����&��0��FC-Sq��,w*�d��B"D#_�����^Ie��:Z2�q����PN��OOg���� #�U���M9Y��Q���d�3{�p;iv��p�/;�����9>�Z�E���c_1���"ϙ�`\_�t�ʔ�����Yb9�1v�-\�p�H�M�D�Kw���!�$�QE���uM�͒>>��w}gC�������Et&�K_̚h.�����Y&I�l�*W� �Q1ҍ�2 9���l��b��A��m��% �% �v�"R��"M�"e�|�=H=<09�����j0�{3o8 ����a��2:Ϯ��u4I$`8�-�qk��m�["�ߟ��a�@� Ǵ�cl��f��b%�-O*��e�OP����E�mR��p��gI��mһ���y��-�����ď�foc�^֔̏B S��a��t�Ŏ�V{�A�� ��~�I{�ɹx~����D�g����?G�=�0H�f����8~0�P7�E=12�=�J�J�h ��}M8���%��p3r�vJR�v����h��M�w� ��y6�I�?�h��3XG&��*z�=��N0p:�}/!���wP���s�1 t���J*� ����v)�?��c�L��es��:�Zwdž��M����zqW4�ʹ#p�wq�U,�dž�.-$.�� #ti�RC���=9�#����s�U�c7���.o�ɥF�F�b2�?�|�}�f=?@�;�Y�'�p$qA��c;��pT�3g6D��FmB�����)z=��묛�T-و�������$� �L���;, ���V�E��h �1���ފW�=�j��:�S�la/��C��4\F9���{��3C�`�����M�z�E:>/���u@�/���K�� _������&�}�IE� �c�s|V��r�D'������OE���?���e�j@C���[����˿������7���o0x���v� E����r�e�*�8d�Є���멄r��ݶ}�B�s���y�N{���J�̥�I�]���J?q�r:��8��$O<� T+T�VS\�����B�6���mzĨh��KѺ{&����"ҁ��jM ��CT��yֻ-��b�H�_FA��ق!6�E��������k����՞vA /�Щ�ۜ4��@��<�B��\���[�m���7�&�X�Y�93��#�V���RD�d���31�qw�#M��/�s���$=�����[<F��8;'*{5�N�QBլ�h��ͻȼ7(�=��W�͵@��T5�o ;����y�l.��������,�T̀m>�aŜ��aK��[���� kʁ���6x8�2�Rk˷������4��e[ЗQ<�&~@�Z��'��w���BP��� ��C��$��5t���q[aӑ�b�sM�s͡h=0~����s�◮�/����O�B�� *N}�a���"U4\"�&x�K� � lP.�捱<5_i����C^c*Y���T��-rP��[+��X�5���y�r��őh���!����_�w�$qA0"�Z�B�Щ }��j�͘&l_"0�5��m5�am��n���+ŧ ��N�8�v���7����l�'֭Wȩ�!Ӣ�v(�G�� �ƹb��O�cy~B<����7Z���P_�3��r��I2�iF��H-��Z�ᓒ�v��pQ/u����l�/��J���f{��nh�;�Ԋ�!��h�+W����*�/mߓ�B�n�ìj2 �wi�2�㧱��u��mʗ�j;~���~� �b̵䭠P�=J\���c �}��(��%���|3f���䓫�hB��ڨ�-��H|N&���=2ϪmAp�5�).��<�so^�#�[�P���@v9G�a��:�Oyʏ��v������YcK������מ�fDٔ�g��G�/�B��+�yvy�,�=�����U������%Ƹ�̀eN�U}�1~[�,ʥ�l!G)4��Zc5�Cљ��\��;ڹ;���/q��'���-��ѣ��}�v���ke�Z�����3�$z�a���*��0���LnL {�~>���7�C#��j�Q��G�WiE�^&8 PȞ��0�rd{t+�*���� E��q`�� ���I .�� ����Ze���CIR�v��hbH���箄�l��_a � 4��ć����4������uR�7d�=[� ��G��H|N 0$������~fbݵiJ�vM��yP��y}��Zd� �ܼ024$�ƨ)���;�8�ɔO�hOGBz����W~Y噒�� �F�j�XW����7d��t��5GZ��������ў��|�:�yG��F��d���`& ;�y߽������7����$�!��)ߘ�^f4Q!zF�$���Ǫ���}�# ��l�nd�W� @t��ӐoZT���>#��쇿S-lN��� ����:^�'���ȝR+\Gn�����ghI���-�V���<͎z��D`)��\��J{pS����U��.��b���$��s���D$o�4���֗�0�?1�6��r�*�<^���0Gi����5�Bc� ��R���{;X+P������JĽ�g�#Tng�IA�Ԉ��Q���ڡ/�6>�(��#<u ����"�g9˷�˚���<��3����P��Et���:8�7>ΌT�����1�-�]�։���*n���L:��L�{���T�B��ǟ�g����7F� FB�`~0���aD�ǧB�vt����l�R�Ƿ�#�UH�Kȑ�uGn�F��/$�V�]� +ܔ�9n���4�܍���%+��[RL{!����E��O� W�K�TlD���n��QT�m6�r�S���ދ��O���S83z���؛�|��+:��� ��O_�y����4��=���N��Nܳ��X"Y�Gt�U�F�8'�4ơע�����=&�I!Lu�#�?�/��r�#��&�A6CL˔��3�� �x����,�������p���`h�W��4������~�� h���P��� �Jeg�yD����,�@�W*�9�J��bg-a�G�X,�^C\��\բI� uC2�h��u�R��b���Zc�usqәQ��Ego��C����Vm������Y�����z���P $��W��m�;������ �Nc�f�3�7:�cv{��R[/M��HoW��H1p�|�$y% ^�Mn�+[������FG���r��M��!�!�ӫ��%����$����}����"��� K��qEt����3�Z�̯b��#�����e� �.u �Q�껂Ho�k3��!��^`��y�Ra�m~ʟs�n?�ܥ�$t�fJ������A��<1����cPn�)0���ǔ����K-E,uݔ�8Z���= ^����{��~�`s)6����{.���A1֝`2�V�!��v�T���5[P��^���6�<oN�kf�1m���P�+����'=r�g�����U������s�3�V��O��"��;�7�܊�����@�����#Wo��YMC4i��D4�B���*u���hqoM�DaP�b����%.&� �Ŧ����JTQ��Y�%�Z�%M�msw
Static task
static1
Behavioral task
behavioral1
Sample
7f7001cd30b796bfdcb525929cffb3c8.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7f7001cd30b796bfdcb525929cffb3c8.exe
Resource
win10v2004-20231215-en
General
-
Target
7f7001cd30b796bfdcb525929cffb3c8
-
Size
4.3MB
-
MD5
7f7001cd30b796bfdcb525929cffb3c8
-
SHA1
278439c8d6ad27d4f69a20c9955846681a1ec6d4
-
SHA256
9f53a845aaa4c0c019eff35c00dc265cdea0eeae363708947bf525c16b6ecdf6
-
SHA512
cdfe0d9ba6268736edd5d1f2527aeed4098b6d416f582bd51796546318ef69976c7951a9a5888538020dfb9396ede56bae6eabaa3e29ee2d3ccc12c91ffa5b17
-
SSDEEP
98304:4D2o4lBAxzRsxFp7hei1unB9dbNnn1USKXsMemu3yVgN1+Hejn5f2ymL:o2odNsnn71M9dBUXsMyCLY5fBm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7f7001cd30b796bfdcb525929cffb3c8
Files
-
7f7001cd30b796bfdcb525929cffb3c8.exe .ps1 windows:5 windows x86 arch:x86 polyglot
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 295KB - Virtual size: 568KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 55KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.2MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 23KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 250KB - Virtual size: 252KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 418KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.FarFar Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE