���U����XΜ��-w����d��������:_�"#�H�@�?�x�����uG/,����rkƬ�ځ�K��T,������p�>��g����̽�$塋hO�%�/]#�υZ��i���ڊ5e;$���OՐ�u� T�o�Xs�)0���������,�)P�>�<nI����SbȰΚѴN��{��� �VM�Pyjo��"~;���[��6��b�p�,��'���`�DT���{\}��S�d�k@��C� @|����aim<���B!��mq֖�Z�%ǃ�o��{)κ"��`1di�����x?P#�O�=��4ئ��E��������k���,ި��|%�H�ϼqO��T��\?���$$?�w��BI�������szI��\��Qt6Q�z�%�&�Y�ʑm<`�w�@m���h���v��:���Wͯ;.+PM:"9�E��5ծsK��}Ġ�Jt\__�T��zÀ��^�_Y:�9pf��I�V����$2Sp�<�l�0HIT�"��½��,��\,����5 +GR����dB��t�%��J۫C[.��o�C��@*�^w$� �P�nv�qB��Jxq�� M��V��6����<�I��1��hT�è���O" [-��m��,!\ ������zp.�-��s�k���X�c��'(l|���hJ'_�Ӄ�L� {&L�6��/��ڕg�!'C|�@�UfCiS����$�=P� ���k�#�M�(��\�_���hI L.�u��厤���|�*Vmmd�&�nX�J��U������֒M�+�>$���Wn�3�\Q���PX�W��?�L}�Ζ]z�[t������Lv$���S]#eB��]��8Iro)?�jp�B���)z�hw��{�{D@I�_�iU�ztb\仿۠Z�D�oإe{bl�*��r�i�?7���%���j)�+�; �W1.�n�5��?��爔�9N� oヽ���_��IM>�"v�^~SF�1�J�Pd#�Oaq0I�G9��r��#�>�@-�w*�N��S��?���M��A2V�������P���~x��<:�e�����Q`5FnO�9�62|$�r���r��*�<*_߿�eM��������<�:�e���9�ȃ?�f�$2�J$�d}���${)1@��ڀ�����j�KQ>� ���fK7i�XD�@uV� 0��w�y�e�)�DKx��(����s��@�����'7=e��|� D�l���/\����w� ��}ʡx!c�5�YބW!���� �Ie!@b���앫�u��)ɺ�e<�3\����* s��i~�X����C�j��.L%<�N(IWi�㳔˜̏� ��Wu�t���3�<�ݍ���d3Y���|e�v6J�mzj�'@q2o��{�v����ٗ`m|��N�2q�e۟ʮ_.G�� �% ��>���~��1�HC�.��:�9.۬�v�I�g� ���xN��D��Lӓ[`�ҁ'�@ˑ�4��?!�0���uep��c?K���L@v��jc�Eq�|�pVWϛ�����������MV�a:���$���%���vg�Zv�9η٧�����vu��FJT�:VD(z���1�@�k'�bȶ�]�����B·�ݬ@�_�eXz==Ou�)����ئt��r�'��%>? c2�,O1�I�68�X0f�)\[W���l#*����S`$k�+���}�S#���������P��+.q�݉o6���s�����-jAb�1��m~���������uz_�^S@Sٛ�?N�suo�^{A�`�^%+���;+NU��j����g������1�q�8P�aJ���eJs�����V�u���g.X�_q�3���?� �=PLs�BV�Ax��gH� �}����|�6��t�Y�� �S0��f9{j2�"JbH���{����k�#N��k�I��C,��� 2��}y1�; �X������S�'y�5dBNB����Аn'�&k��J���x{[�Hz߾O�2e�� Yɩ����bL �%/\^�S�Ԋ�y�դw`�%c+����|�v�SSp�*ӣ"�^d������:u\-��eMUt= �8��U���/��3?R���y)����?(�5��6ƌ�7�GL�!H�F����� a �,6J~,@1xцv�� "s�8��f��)�^��D�bL�ˮ���k�� �X�[�*�o�xyw贮7�/�C6����ق���~�����aS_g͑V��f�(�Վ��tWG��Ꞥ�unF��.]6Cu �������r.�o �������V 7����j`��>n���h� Q�:��4�/HlS�y�ߋy�|�;���G��s���+$������]x��V$�J�-��k7��A|]8qzty;rs���xb10��Z�k��A���۳ZT>���� �X|�K��?9#�*��|6�x��}��EK!�` c'V�ģ��G���7Ɍo<[-ɢ,��� �f��w�dDP�3�.Hx�ٕ(,ޗ�Ի;P���cf��S��F6e����j����n�@����mS�H��f,�M�{-V�]oX��O1�s%�\�YCBI@R�&��+[�L') �a&�͈�ׄ�%��2 �B%��8��6,[h�E vޫE�%f���W�͏��������4Oa������C���Dϣi����54�^��!�5N7Y�^t��"�*ݴ��Uԝ�JӦ����V&����l�>��o���߀c����������h n�U�|�o,�-�2{��j.���J����=�DED���"'+�&3���a�UƓ��vq]�a��At��e$�}�7Hu�~Ѕ]�������kTh#^���Bo����@K"H����?�@�������<�T�:O��S����@�y侖B��o����,j6�D�-EV�����V����{���%{�ЄA�n�'��.1y��h��D3t~ �����]��Q`�3ّ�|���|���Se�$�O,-�t�"�>�q\T�V7�M pB w����`)P0���X���;5_U���!(fl�������WX�����_��tV䘳e�]��P���j��[�C9�+ F�LkJl[��O�?�w��jct�v� �
Static task
static1
Behavioral task
behavioral1
Sample
653021ec8acf4e2cd7679db0538594900316296efe3881e52cb7f860d5e3142d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
653021ec8acf4e2cd7679db0538594900316296efe3881e52cb7f860d5e3142d.exe
Resource
win10v2004-20231222-en
General
-
Target
653021ec8acf4e2cd7679db0538594900316296efe3881e52cb7f860d5e3142d
-
Size
4.1MB
-
MD5
ade4770bec37b57460887f3f96d87321
-
SHA1
2b3d2be4c9e5cfa7f0e20b5f40e33d07ebaaee96
-
SHA256
653021ec8acf4e2cd7679db0538594900316296efe3881e52cb7f860d5e3142d
-
SHA512
8d772ac091e09bd9ffd8d94e1dfdeabf543fcdae57ce2d7b22bdddc16ff1658e24debeb00568419f9f73c1de50760bec465f566cedee314e4d880954fb51f655
-
SSDEEP
98304:9pjuTcWOXrM4PsbrfhrO1MWJ3AM5z3JFiVvdqRtavl1DaLuK:H7MOsbrflORRZziVvdqRtSLuuK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 653021ec8acf4e2cd7679db0538594900316296efe3881e52cb7f860d5e3142d
Files
-
653021ec8acf4e2cd7679db0538594900316296efe3881e52cb7f860d5e3142d.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 272KB - Virtual size: 728KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 43KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.5MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE