�$!��ӫ��o.���2ʕ���Y �u�t������y�e�5rh��VV����t�����ns���U���߇�0g|12d��?�V���䈙0d�Z8X�XxNoVF5��<}����(,]�Uܚ�6�������.���ړxd/�K��{x����ԙ\�]y�-�g���66z������p����}��>�<=�8ݘ�<����Kĩ�@}�4�����*2��E ��2 ��S�i���ʐ��:�x뽮7mA�,�ӳ�E���}�@��G&]�Kt2�J�r�g,x�N�D�^)A�t�S�r;�z� *�Ձ50�&+c���)�e�%�J���������uc��,(�9��c��8q�Yl�t�~ǻ7�!��D�5ƈ:^{��m2��1��Ŭ �|4���������*����[���f(�e-�0��!6$��q�.�*q�Q��M�}B���"|F$��a�3�}g��̔����j;Z/b �9k�T��&� ���VKRtq#+����嚄^e���e��>��q��g��g|vT�P�9�H��[U���*=u[iP8�t\�L��V1&�}o�[��<)����τB�A�rsJ/��`rX��s�b��y�A�"��RQ��C�F�%���l�����!6�۬�/;F�3����^v���TT3����E?q?����SvL�� ;X���r��Du)����J3`��f�ĸ�%�H�, � �Ǻ1'�ݴ����gvt��Gʁc�{����J"����O���ԏ�y����U�z(���*��(p��u������(Kk�@!n]�=W�&� ���Z̭�uK��Ņ���s�/��Ky��]�����ϑ�������r��98J�We;���m��^�� �̬D\�Q=��!����K&1��RD ~I�������r�0,�hԻY��te�5?n��6X�6�2z�lV2+�a��k�M?��-����c���?Ri&=8r����>O���SΙ�y�y����z,o�|�c�l���W������6~�iM&����n��*��s�z��f���T�l|�J��������ȳ4(i)+���O�`�^�Y}�_B��7e�p���D(���TzK?� ��j�xЉ�a�iY�A���!c�Y�o�I��_��/�5��]�� z��q���L^�Kt�[��)x ����ڻ�����IAH�P��*�����%o� Nee��E$�q��r��p=I��]�}h�$��2�RL��}Q�|>�@�M��S� ���?��U��f��ږ)Óтe�c`�BPLx{4�{� �T<"vX��� =��3&m�еYC�J�"9M}���j �p�����r=��K�� =V2� �ɤ<ՙ+������ϸ�7�� &��}m~��% ��r���ÀF�KD��}�D�DtӉ�xѝ1�3��0�bdd�x�Ҭevn��뜵u�]�M���'�5W�9����s��z��@���9��V��r�z�G�#͊iI5v ���ms�?�ث�duo�%���R�E�3��͔�u�b��խ= �?F]x#��k`����=�5U�M� ��O���qhz�tj��� ���`�|Z�<�|�G|���E]è����w�*�{;&$ږCiRmz5��V��`N=BI�A�1R�^6$�d��ď�9�+��-22cPِP[�aZv�4�-D��,�YBi��i/-�z[��w���܈t��p�m/� &�4 ��@T���_�����d����,�|�����b�m�;�{��H�!��ٙ�@�`p=ҭ.��'-E��������M�g��=fI~�nt�xf��<��Z,��C���X��������#F[�$�*���r���.�'t��q�{��n��W��c:�ԙ�pD���i�}pW-IN��g�jx�gCz��-��$������������u�K�r��K��㷸䋖�D�T�p&�"�i�/��#URk�۽��$�7�ҹ�C}W Z�G!t,�+m N�e����`�� �%�C��8���1�n��[~E���,���A-g��K�wiZ�ybZ��dYi��#�RxX-�ȧ'��Q� ��HlJ c�m�M)�,�%�}j��������_B���R�?5�P�/I�9����2�����:M=��9����B��������¬�%;���H� �)��N�"��jsB/z�X̞ �R]�;4�����[�i�ؽ��� <���-�I�t'��d����,`m/3Џ����ym{���^�8�����>k��cSmV���՟3��*��Ο�S�����"�?�`9z��-�=���a�8m�,�m&l����N�C���ۉ��N�X�F��!����5���B������>�reS�A^6l�͑l�$��v`y�N3&r��uۦ�t?��o��nm++�7��ejq�!:V>��̋Ypg�~��eh.A�n/@�����ʤ����5p)��CwxvQ��cH�R�I���q8Ƕp���8�lw�qR�����}p�ą�}�p ӫ�����;ӰJ�$}=���Q�#�b Zʅ/��Fh�mH��0�C@�>KJ��Ō||2#H�,�w��5�I�!��������5r�g�EҜ|f%BEáL >�Z�QN���߀�=�}Ogs3y�<7am���?�3{̹zW$�<�a'F�y�j�Ԁ#Mf�v��2ʂ��[���GϿ�ΊR[F�ʣ>%�[Ņ%��3������%���� X�R��Aݾ�7H+�#��ë�����f?��ܧ'>n���&��K�������qd�·Y���Ԧ5���h�9��l�Z��Sk2�}����� �W��D� W}�Dig$-h 30u���~RȆ�-"�a!�GS��������5�����G���M��K+:�W ��cڔ���HP�C�g+��_��k�D��/��-l���6�K(� α�����C���>ؐɘ���A�ە�%O�礣����,g'U�lWl��k��}���MZ� ��u��d�#�����g���j�f�\�9��M�u&�i����d��F��q���hdd�o��lȷGo]����I%t cg�m��&�^��}l2�l^����"��(���>_.nW���I[H�L�E)��}�&j���D#��V�轡ϡF�Cv%@�7���X�/��i��Тs�i@��(_(�l�/f�a��4�C�3����J�ҭ/rsW��:���%�R~�3[���K��6o�d�p֘�S:Q �P74PT�3BB)��[t"��3Z3ϒ䇚�@D.n@� Gl�~�=���q�qt^3VZ}���1��c-�Iy������KM�-�}��Lx�C��"��x�p���C Wo��/DA1�nkf!�D��2�%bUG�S*�O�� H������3&$���7�B>�_�����m�7��J�3�`u����؉����
Static task
static1
Behavioral task
behavioral1
Sample
cea0b23a140d04baefb5141e54b55815d4765700bd6c146d48ab85e5f570e566.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
cea0b23a140d04baefb5141e54b55815d4765700bd6c146d48ab85e5f570e566.exe
Resource
win10v2004-20231222-en
General
-
Target
cea0b23a140d04baefb5141e54b55815d4765700bd6c146d48ab85e5f570e566
-
Size
3.2MB
-
MD5
a5f2e384913ee284118565df53a9dd21
-
SHA1
2b1548bb9acfd3aa8130023d0c6642a8d79df3f5
-
SHA256
cea0b23a140d04baefb5141e54b55815d4765700bd6c146d48ab85e5f570e566
-
SHA512
27816ad9f2b435cd2b3edb2352e2ac8dc444d03fe6b54b5a6f04ea41d7d826f77136a9cf35fdfdeb16f0446bec9619ba37affa394ec75fb7428473bada316ab0
-
SSDEEP
98304:i8LFWUHbJCyg2O3+giq2VwyaMwv3By5Tygh:i8xPHVO2a2VwjMwPI5TNh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cea0b23a140d04baefb5141e54b55815d4765700bd6c146d48ab85e5f570e566
Files
-
cea0b23a140d04baefb5141e54b55815d4765700bd6c146d48ab85e5f570e566.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 43KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 18KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 46KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE