,_Y����0�?�]��T��˘;A�!���lv��FߥS�f�Y�L�G��Y�\.HL�Vi�T��J��{W]��/b=:^���du̜�\������ XKe�KWnjptI%w,��BU�`��1ڎ�ApN:7>1e���:��[�k@�[�a�hC�3J�k+�\"zuR5N2 �߭��n���br>��c\�V�T�=i/���UU���L�ˤ��Wɏ�W���k�����x�q�81���$&�6��?��"��ؐ�u0�k�+6C��o�������x��������L%���W�羋���*��}�O̢/.��O�AT'�p�5Њ����/yA��N��蟯g���j���A=������jM��G��O�Y\�쁲�<��*j��rBΜ�8�����tȳ�_&���)�XgEr>��ҎU����|荽�j�Z")��<��\�����3Q��o\ŁT�{�S�����mګ'��f"~�4ff�\�?eP�������"��/.Eȃ�u��%�����ĭQ�'td�EMz�;ȟ���B &<�c��m|k��U��Q0�Aq��tz}�%��[�l .��??A�l�h+'[�e��;�������|k�����Z�a�8G�b��5�"q$��o\�<Ƅ �Y\R��O�w}�&2dnw�鸕����d�4%M�p��N)�Ən��_e�HU�Q ^����pt�����eYK�Q}��OG��zwA&g�H�^�Q��tR���!��.��&��[bA h��+k:���=�/^���?\�^Pg��A��o�?y����n���n@~�))R�[�INEN���?=��)��~i}��ر�8�|�+����%r҆X��?���� �`ރ�F"�|� a��#!���o���hۚ1�j��_F�s�O� u�늳=p��bW�]8��A���i�ѡ0�Z �=�>�����JB1�>�i��/�p N�i+}v��9Y����8�g��镯e�%�h��9^����2��d[>� ���r[��I�n�ԙXd�ٙp�%��7W��#z�x8[�������OJ��X�2���Wg�l{���t}9V�i����*}������� ��$�Ħ��϶�F���J����C����������+m�8o,��<���n�)297ז���G����,���F����m�h`T*^&*�[#3����u��lѩ��m��ĵm_m��[��j-vt��݈�3��a��ر����Ύ���oɦHk)j�&FFlǃO@o;�����]�!?�� �"�n�I������Ԩ���|�� L��ɪ$t`�z��v�U��9�ԁ7e�tl1�z����Tl �V���]�e��T� 3�1U4+��l�3�f����e�������:<O˾��^�E$���w�q��q�nŴw3T���k��Z�63U��T8�,P�JE�����5*1�]9��DP丕��l����H@ŏz�9M�-����h;�[���t��qMuUc����4���6��hS*jB%�rK�Y���ub��b��G�z>�<v,�K�@u����ٸ���ߢ.�S �z�T���5g�ACȦ���⏶�I�J��+���O�u���ͷK&�+T<�ֶTC�@�'o`�`�`�̠9J�r������*��wu�P< ��&��Y5��������) b��:[�lw=��K^ q9�x)u�1�훱��x<@Lv��9n�ei/B�[�����ѝ,�� ��5��ƶ8���㜭��5�*+��|���<t�^P�edڹ����ql$�ߺ�w����G�@=��^�`��쭍���Q���Z�v�x����3���-Wʦ�<+��kU�[rw�^ŹF7/4�B��*2���Q��*D�s��`#E�n�Uo\�awYbӡ�B;��DaE(ڳ2o�êh@_�$Ӡ�~9<�Pũ�5]�+їL�����/AO�Pg�3�g=�� �7�0�C% �IA!�t���%|o�|�!�Ѕz�ߧ�@}d��é?*������#�c��d3�Xd���7*�O�'���g���Z/��F�t W���~�C��n%�����"�~Fi���g����)���2�eL�R�c��%��^5����A:�X���#a���?@^����g͓Ў�$��$(�C��~�1������VסI�=df��ɴ��)[����K.��rd̕oqΦQ� ����n�}�T�M��N,����N�EK�����2QC�y!���7��C�ӂcv<,����4� �;���v[�V�M����R.�:O�����\Ʋ���r+�|%�]FiJfUD���P�4��e�[d���D��S��h��=�zב�̄Y 't�� !N!����J#��|�Jz��3$g�·X��R����U���w�#���EU��*:}D*cBM��@H˜D������3�э+��?��[ �O��2�q �?��M7�8[��g-����*��t�k�w�����Ll�����y�E������g�A���P�8pd�P�)�<}X$��<3 �+p�KΒ6�uӧo�RɆ�mb����t/�);ҵ69��C����� #�j�v!!����0DJ���64�c��)i�;3����F��5uLj� ��B�~��>G��D��h��Cl��0�(_>�Y��`pw��p� �~��n�^OU�K�C�FGȶ� �i�M_ W��4{; k��E@$�\�������THZ�n�g�$B6�U�ޯ�V�q?i�����d�;��M�KFmd9�9��l�������G[�ha8���o�EU_K`�[�����J��5,W���_O_��ڻ��ݭdqPE�h|͏�6s���t���K4;<zD����������YHz��L5�<]N7�'Q������K�V���7���Β<�%�#�i�db��^c�h��KZ�)f�Km�m�ga�i�t�i�Tdcp�e��N0F�� ���{I�3� �mv��ĔUC��l�F2��W���lp�s��w��8�s[~�>g"��e��H���{�@���?�U��SY.��8Qa�I�T��e����%�~]�8��LZ����z�c J�a�4;ݸ�vz6�[����M�=}��> �.��2�����iD�z��Ҁ-}(����<�:b'��cr�/7Z~~HՇ�@�W�w�U�Wy?�W����r�}ۺ�ƀ����pr�.��\�
Static task
static1
Behavioral task
behavioral1
Sample
14f629aebb73e61348018cc10933f58128dfdf25cb9c3103cb1569dca4eb0d36.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
14f629aebb73e61348018cc10933f58128dfdf25cb9c3103cb1569dca4eb0d36.exe
Resource
win10v2004-20231215-en
General
-
Target
302f94c41a79a8178b1ed9c09df89635.bin
-
Size
5.3MB
-
MD5
22fb153b0afce2ffdff685981055574d
-
SHA1
380e57fd88fa96d097db381f5cdc79e62b2166f0
-
SHA256
305611d9e37b1b8a26d40127dbc460d065923fc1aa90ab1dd4e5d122f68e2521
-
SHA512
75cd9d75256f92e34983e1cbeeb78ca2f7d53290111c88b62f9727c92779654e524586d9297cbbe32f52442a8a792522334e159af504b1eabe36a3492092c16d
-
SSDEEP
98304:1ujeGOL02sdSSXNbDnvTXSFC0rKeIbveeNGQ+EdiNubXAByqqmQJ0kLaL3vv5xxz:1uj1OQzdSSXNn7XEC0rKeIbvrNGnudja
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/14f629aebb73e61348018cc10933f58128dfdf25cb9c3103cb1569dca4eb0d36.exe
Files
-
302f94c41a79a8178b1ed9c09df89635.bin.zip
Password: infected
-
14f629aebb73e61348018cc10933f58128dfdf25cb9c3103cb1569dca4eb0d36.exe.exe windows:4 windows x86 arch:x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 84KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 19.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE