�>��ӻV8w4ϫ1z�"A匞![�y�k�`^p?� ���^��۔d˽Px�����w�-n�&��F�V���,Yi!�9�H�%T���Ǜ�;��\��9�nA*���Q����1�Ҩ�]E�F��2��(nDOrs�j�Oc<���q�ɮI�B��`��_10תܡ �:�b; �/���0������7����E+%�U���@�b����Vl�Wpt�A倎�����[/x��]�h34�K�75��c��A�>'�����w��-�g�`L"/d`K�hl�i=�rt�d)�����p �������#�Bn.HK�H�$����U\{72P��J|w��Mg��c�K�2\b�b)_�k3��Ŵ R눐���|�_֑1���[ſ�K��!G0!A�g*=���n9\١�����x�΄����v�"�G��!�!�K���� ��R��� ���ó�5����N��@����cR8�ԖG,B�c@!�.N��>���c|�^�k�l���\�j*Ҳ�2Sf�q���0CK�H\����9� �e$<5���E��KcO����:�ZĂ ������kjq2c�LB��̶�G2�ߎ�,��m�Y6�lc�Y3Hd�9 �T f���~���,l[;F� \p,���7��.]�Zx*�>����S��4#�J�5< >��<����Pj�q��s�w��k����(�����,傭]�ʮj��Q����N���R8l�����c�0�:�8asӔ�(0��3v��+����B"^^*������q�e��M_��'(} ��']����B�Z)H4훕���d���˂PÈ5� ���&�{�V\�>�yۏ2-���.�,��M�cޚ͈9B��8�`���������]�m�F�U*{�^R�4%e� /a�?����Zڦf��#�W��9o�D~Do�#�����҂ ����x_M�%��2� gG$c�?q�O�s;$��M@<)/^#?�ۥ#�_]'�t�iT@Rҹ�H��ehy.8�����2�����v@�wh3w"YJ9���:c�m�є�*)O>ފCc�@ �i�j%��r.x1������Vp%��}͠��Tm}[5�W�ٵ�2qڻ7�( �&���P��^��7:)�e�o�}m��Y�����#�k'�$���,� (KAHXQ�4���(�1}�Ζ�-���G4���L����%<3��t��P�Z�/0�m��&���A,#�>❼5�i�D2 ����r�I߄��G�ra7��'�h���`���C�_q Z�t������~]_V8/����6F0n������9r�-�v�w;�V����c�3h�o�|oo�B�����yH�X� d�ҳ|���4�U��,�$�G㦈C� ��Q<�FS�h���-�]߮�@'Lu2��W|wj$�C�W��5¸�];�lI�Dgfʍ�b³�� ��4�z��"�j��]�y3ъ��ͤ_�d���Z���(|�P���Af$�i�Q��N?m�����FL���A�ڭ�ɳz�_��uĩ�>��E�a���P���� �� t4��B%�J��Ơ;Cf�����of�n��$���6���B,���Jgvh2\��}.MS~�T�Bk�<ɬ����l���&����^#��.�k+.W� ��f�(�V� 7W�ځ��=�E�7��?��M�y�Ȓ~��o4�|��Y����F8l M�����Q� ��A᠖@M�;p��αg��x�RY+�}l`ևS��])u �� "Z70��z��N����&af��S�%I��Fĝ%P��ʄa��t��vδ)��Y��nˆ5s ?�u�}*П/�~���U�����vDW3 E�K�Q�)gݍԇ,c���C���GWź({f��] +�w=�@/���I����ѧ���E�(�ĎoO�0��ǚo;����H,y+&�$��s�����M^� �� �A��I���c���5�(%�c z;>vaյO��g���7~��`�d��z�W�ڒ��L�&w =��HM��y`��k��Ļ\���9�B����p4+x�X����~3�/�w�?U����dT���QѰ�d�+E6n���f��9|���:�b�꽇�2��p�����მ ��k]q����V(���X�u��/U���q�H��۹' #���f��ٶ@I�M�\��?��Mo���ƀ!�-r��[�Ż��)��)̛Y��⥑;f��C���*T �Ƃ�%/YݵAh�{��P_'J�O����W��/�:<��5�p�(�8��>T�e���2G��Of,c��a����"�4M�4m�0N� �[�&��)ȯ�y���1��ӫǏr����Xl|�:E�u��|���9�%�n�!�����y�u� A�����]�����#2i�W��?=��+ߘ�����P���܋���Mt����̎@3%��T�ʡ�Y�[��Ԝg 1�rq��I�����n�&�sjz�H��3Y@=���P�@tr9�������k<��n��I�+�Ʀ)-2���ü���]������06֥����y�1[+��sR� c�1I�'�%���o�/C72�-`J%��26���3����r%�;�19rr���52��^!����nv�Բ��u!`*a����d� �=�T�DN�O��} \������:���Z�����4���J��g��#�"��wUe�FP�xe ,d�',�h�/��I������� ݦ���eiJ Zn� �: �"<�����.|<��w�����@�0����U��ج�R���Й�~���I2�`��nA�Z�췜���e�/��N��$��Y��U�x�#f�5M�{rI��>R�R��i��U�8�Z�h�17M!m>3UQ����y�Pni�ź���DDi@Auv�E�n1L���2����cR5I0���N�Z̲��wht#�����6�1&���(mȞɩ7�lp��M|�,���ĂF!�����t=�X�0����b��4��?V�:��ˀ���)Z��0��L����Zא����}tv��{���"��ߧ��w])m�jf&��/패Y�R�JFʿe�3�BA@G��d�K�Hy8�FB��]�����)'��=���Ԡ)�\���lMA.]���;3В���I���b[�aN^5��/����`�Q�ID�iSrv��ZXm�����Ӯ����4���6�[ ��J}��\���LF�=�������J�wv��<�d��������d���.���ET��g#24!��^k:7�7�B�� !8g7� viב�w�T���̏&Q�n�j�%T�uH0Mk��(��k�Ye\�%J�:V?�)ΆAĠ=�*��h�����L��z���k��q��3���y~�o��{]$�0C��3d�|�tUHjK��S K��,h"�_�r<�.�^���hZM�E���l�-(t}P�<2��g���W�V���NMOQ�n�t6�Q�'��Rg��g��� ���c���Q!���W�!�d3����)�@5��~����JN,�a���:�ݘTs�̸�r�GyH' |�&���O�D9�-�w�$V������Xw3dFԥ�F=�x���cr'q1t|V�,�Q=�(������ҍ6в9t�W�ߢ$�@���!� ����pY���!>�n��S_�<�U^o,�3��b�
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231215-en
General
-
Target
file
-
Size
2.5MB
-
MD5
2cacce0bad26aa9301f32a1a7e2dda39
-
SHA1
fc2bd435311933fcf7f8bf4227c8a65a42073db9
-
SHA256
8111d1cf423d5496e7c48e6177cae3ed3d83aae6097ef206f55b870de951933a
-
SHA512
3362274a6e20f1e3c084ce043a597f23e39f0e7baf69be63fb7f8e03bc2b653a4ba9c3ce5e6c207f28ca8955ab47357ca6ef80b3ed032d561cae646b01b565cb
-
SSDEEP
49152:9ioXepeo1dkXT83VgxJOIGX0Nktj5LHyYbppORoHKZQCytZck8y6qRV2hCU:lOM6SYCXM0NSFmYNWoHKVytWk89hC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file
Files
-
file.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 141KB - Virtual size: 312KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 26KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 15KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE