ϖ[����n��&`|���싽�$6sV�����[���'\�=!���ti*�|s�TLf���pu�����EO��.0�ӽz��yͪc t������g�b�6�Lz��X ��HC��W�X��3v��5\���<A�&����co�pp�xW)6��΄*�[ڷU��3��L�q%;�L��*e�^�d0(]x�w�Uh%'��p� ��� ���U��Д�)��t�.[5q�-��O� ����<SS���4O�^{f��m�LZ����90�'K��K��B�e^��"���u{�5{�N�1�H��Sjԧ���/ �[�D�&w��W� hRN�92�1ܕ��B�������;�E��9'fy���V�.'��5�����;�w(M��o�=~z0��aRњ��vqa�Ͽ�?�䰈Nbr.t����s� �f:��0���d�3����&ϴ>$�ů��uRI��� ���[�b9�5��)��@h>�CĖ\�� ��-Z�_!ez��x�7���}v|���m��׳9w����N0�S1���ȌD���Qr��&L���@rwgA]��.b��p��F�3v?>8Y�=����C�0R�^�)xhyu�����lӰ��2\�..��4G�Q^�D1�+��\LR8N���٪q_7r�q���P�a�>�XVѯw�Sv�̸�����F<�_'`�%��A���W@���"�����[d��1�H��S%r��4���Q��Eh�'I����g���� DU�pkz��2�a~|c�mdy9�zO�@Xx_�`0�C��;Xx�G��}ux�&Ar�jf�n�8�y��Hi�����g��y><W��� b���șQV�XI;���m��6#*�η���.�$�h~i�v2�����>Z S��=�i��#�o��cAF�i�W5"�T�V�8�n JYcWlt��}M:lZ�C�V��v����I���=f<XG*�O�O~�ql�ޮ���v���H�$��B�PnH�<u~I�]y&�����q0@�pBO (���_�ͅd�X��Nq�~!��A�Ћ�ۗ��=�������W�>ǘ�b��5�s\�=& F^�{�ϗ �s�jT(�h�Z(S�x"q'�I�<(�5aU�F*;�Gms쥎uT��Έ������3�/3^�|��R����7���".���ܾr���d"�3oA���J<�,�|��:��HZ�Pvq���mzU�迭#8��W�B�.�0E N*�|�,���r��������V4@����~!(��Tv$fA����P�ѭ���j� 5�[��o�����6/�īz�͋"�e���ӘB��^�YL�ڛ-c�a�o��d�%��]ч���* ��Mo���_}U-5�P��:��r�^y<Ƌv���7�h�Z�#��������ud�eVw�bNPq�3�N���R1�8, �aFFi��aed����(y�N�s�kx�y�Xi>��n#�`1����;k:X9�wRմdѻ��2�t�`hh0����n� ʮ�9�oh%h�wT�v�D���ı¹��'�F���d��KG� �k'�������(|d2S���౭Q����U"����S[&0���g0��ye�d�n�B�����73�TZ>Q�S�(mTsg�b��>?o)����� ���'���Dz� ���mDiad����,�ij1��ݸr!�`Z³>����t��.����ީP;��/��CC��;�"�m)O�И�x�����m���(�LEm�3-�q�n�\��\C�\�47�$�ʮXَ��|&�2'C��`rZ |��a4� h��ޔa>l�mQ��-�{@����t6B.;����)�<�w$�b|��~ ���8�/=+I+O"oS��ǎ.�fpZY#��$l�ka v1��iC�_�aa�K�k����1i���3gj���rX �2U�¯�Z�ʳ-��W�[�����yz8�Z]c=�� ����9[]�x�O9�-}��r��Ƨ�CF��9�����J�&if������(�Mi㞵�jWsr�]��ۮ�P�zFW��N��c�k+ o���7Y����aI�d+_��x��WjR�{�W��3�{��+�kcfܒ�8A�`��U���9� )�O�"{$-7��rڀU�Cu ����I��z��>�nA����9�.�p Z�Y��dO�!�%^�]����ۉ�ٌI������+)"�A� NA~���w�̆��S�x�`�3>�r�S�x���Ȣ�r$!��8�6J�)�f�%�+7��+̄+��� �90l w\n@�d�w�Y�@���֓7I׃4���&wRhԕNY�����I��s�����2:l�v�����6�ڵ{6[�D����P�\LҘ��N(����'{;E�`����fB|zc\xuo��⣞T���#�=6M.����R�G�ԟM�ԳD:�2��لO�4�����[,p��E��a'��`�!�p@�mA����3\�h�w����I�aU{�DА�t!�!��3b�-&��]��P#�������y`�Bx�EBrg������rX�L�:<(3�˴[ ���ܵa��d���� �a��@�b���������f��M!�/M8^�(�DTo��n�W�2%�s�/��IՌ�/�o����eچi�6ˑB�o��r��������+m%�nF����FP��w.H�a�LJ��ť2����V��$�d��F����w�w���Q�#��2N2�G2{m���n ��u M_ȳ��I�p����l��ױ�����"���I�kqlL8$M�_9ʣQE��n%� 'y�"W�,��s+m*�i_�� �K u�+�=�B��F�>�\������ �<� �4P����1���9�|(�� ��H�6lF�Ҏ�` o��':�.�y)]��ڰ�a�����bu*"��HKg�m�jZ���ۈ%��#�PD�����p�{�@Dm# ^Qf ǜ��<e�r�����5�?A�`f@�ORH�qYA��"���g�[��q�}!���/wڢ��g\�AJ���8�g��0�xi�!��/㒀�[�u�h��;O����)(�SJB&uV̇@f�2z��1���b�b��g����hc���)��r�~�����C���2:A�b]�ܳ����B�gf�uw]J�\�����������:��~������ֆq��I��Nߙl��_A)`̬9���@0�?F�#3��ZY�n*hIA�j�5B������@N�G�x���TI^���F���8���! ���wǭ=q0����N��KXpG�)I��ug���<�P��_]��tQhO��4uF�$a�@�Kb��x�cs��[�3B�.�s�����A�GH��H���lo��lQ�Bi:�ϹI���ʔ� �����~����k;���OQ�5y^_�qSҧ]B���]/�4�x��kUj#y��Spw&:�'u��u�������%�k��{��O㛽���A��� ���P���;~EL�� ��s�Yd��c~����P�k��2)�K(e���q��
Static task
static1
Behavioral task
behavioral1
Sample
05aef2221ea6cc47def254618a61d437.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
05aef2221ea6cc47def254618a61d437.exe
Resource
win10v2004-20231215-en
General
-
Target
05aef2221ea6cc47def254618a61d437.exe
-
Size
2.5MB
-
MD5
05aef2221ea6cc47def254618a61d437
-
SHA1
2d9e79b680ab3e570761d337857e674280f8c64f
-
SHA256
9da4c067d4be2414c6dd9a7dc7ee89faa4ad19b474b55e73605c707405a71339
-
SHA512
ae233a76fac1d7b7d9a9fabecd1c6c1178a1a5fe6be8e6f8325f579773806c0333a9081381f63a79af1e19dfba2f4708ca0ba1db431a927c3ae3ef7aff104f3e
-
SSDEEP
49152:cm128kaMpHwMko1d19tPkgN0D6ofCrzEVdnLddvOM:cCTTMk21fN05MAVlLfvO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 05aef2221ea6cc47def254618a61d437.exe
Files
-
05aef2221ea6cc47def254618a61d437.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 141KB - Virtual size: 312KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 26KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 15KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE