4�m��/ϗ(��kM��Aյ���.#��1GL��l)"�G&���F"������S�>˱��� 0�K�$C�&����e�F"d�'B܁=�������@�a��Փ�q�Ôe�I�X$�ExC;a-2���ףɀ<�\����!Գ���w��B����wp��j���0 �F[t���V ��g��H��H?��$k��Ә�omX�*N����������l����6�Ոsm���:'�0�y�1'�o%�� �Qk��[���s2�b���KDϻt��QNݛ����"��Ӄ+�������� ��~n�!�7Q����쯽nv�����C��}�zJ�P'@�c`��_K�å�*�̀��Us�#|b��<�r*�� �w����cAF[�(M|L�θ0�����w�q|��.#c�Z���y����(?_3�y �ݡ-"���s�[�ΥU83a�I��"dlfq1s�w�5�V�;f�w'.��i��%=uT4?���+��Z��N�G�uj��� ��ej/I��������6*[- �Y���������_����R�ȇ����uo~�g�(��Dv��Opo(���2�$�[�Y���G9cuc�!�I�d=9S�������>y�a�ߺ"䌄���qyI��Θr���0�����u�D0w+у?5+�o�n��G qD�b�g6�AE��^�T�s4�r��dJwR"��&Ah e%bRbEU��mZy���]b�JE������:��C^��@1i��&�iЈ��R`.Ͼ|�@�}M�����%L�ȫ�]f�2U�y6|f��T�cƚ�%����'e�\�����[���*�Bݼ#ْVn&�ʵ5C8�ugJ��a�������"���BnX:�Ҿ]��3�����Kd�6gE�y$'�Q����ժduvi�ZC^0ȻC�;k�_ȇ�a��?�� �b:3xKl�ͅ�Mn��~�#;�h�t)�qr;f-Bt���*s��Hjw{�����;NP�%�?�H�W�T#�/��`j�w%UTBL� b�;~�������\�a��F��$�J7_F��Tn3Z),��K�͆��YRY4x$sw '~�W1�$aN��G <p���=��5���oK����c.Я���|bc^�/�Ѿ^a:àP�9�������>�J{�ʴB�:�5��p ޞ���o��``y�@����ϸ��+�A��c2��Grh�9G��\�AP���5h{���)$?{v<��������JA����`^�k�<)A�6F �+�j"���T���{yU2\�JG1��*��W͚���W�k�>&V)t ����%�dz���G}8_�_���T��O��4���?�xM[�cԛ�F��/7�A�PNy{v��3@�7��r����v��h'�hL�ij�U�(�bp��1u�̽�-��EV�N�?VyH�h���[�i�Ў��;!@��o�d~���P�M�K)��h�Y)����L�/Y$��]�i��A�/`�to�i�70A����YU��5U�/!!�d+���)�cA�3h�b��W )�KҬI0�5p��1o`��T6\�-����v�\-�NB�=F�������ð���bVXe{��%��yvtD�������v�5���wh榢e�v���K�����p����j�e�rn��W�z #��4A_1��ԡ���8���EP�119�<�g1���5�k ��J�y;�Kn&m�V'sC����P-L�E6�Z&8��|j���M��ӭ82�� :��k'�� �U�7�p��bW��gU�5�����L�>%�s���t��W�z�Jؼ����e%>ma��Ϛ�7�i � j��qU����f���s�yY��D�����y}c�p��b�~�a�����+ �Д��WI`���z�Ԯ\����P<2�Yc&=���a�w�����K�u=�\�?S�4���e�@���W��Yxc�N#V��0��ş�c����J���h����#J�4{3��P���A�_7e,u+����@hk�q��BZ��fSآy5?��ܼ��p������)����uH����:�W(�p`�6��k�?̱���q��+�/-Nağ�U��/�Q���8�E��MX�<9�։KK~�DNrT��~�i�r���-,��Pz������ce�����x�/���tF����{�"�YxX��1W�%A�c%MB�_> Kr�t��"�i��k5I����w��9q� i��8M��Q1u��#���#��>�j�^Ǿ��M�]>ԕ\t6lD���ȉ ��rqg����i/�$B t7( y��:h��t�ccqqS�d�Ս:O^dl�����Of�)]u�q�Umh!��ضn��".��E"ar��W���dr; �}���V7OO�L�C�=��I�`����BͶ@6��r�/fN��r�4�6ūY�GYE�C=U<���x��?u-�2 �{#eIy �}іޒ,�ru��P��պ��I[Z4Ł��T�m�6�>r����'JyOH�a"��F�t��i,�<۫�o)�����y�)QdR�I;d���]J��Aϙ�����<�X���*/��5E�F��\]h:�-ɼ�l��=M#y2㻀N�2�o1�H�ʩ���W|�}��Uk���]�{n�P�a ЊM��S+��|�RL#��f��b��ʴ( ��8�=���J�������3�d��y���R�>,���o�p�5����u�&5���j:[�k�T�.=qPz5�,�;�xUv��G����g�`2�b��9}������H�y�`� =b��!���w�*D6�S�Ǥ�q&G��[��m��~�yR���ڤs���!]��.<�V}8mt�D ���o��P�[� J:����13z�"��4�$���;��@d�-_l'A�pD�!�JX�������������'����Ͽ���3P���x�aw��B#�����˄7.V!�u��1E�Y�\�c��{�M&�D�7�Jʫ��i� ���4������4uvRA�y����u�)�>n��c�����p�;Jq5�6�?����ci+�@-��o������YdO�;D�>��]_e��5#�\%�ح�.����� -G��o�+�ޑ9+BXe���:ʽ�>��鶧�f�0��M��bKJ���y��y�p>F��42.4ڝFD�d`c5z+��[d�]�y{��1EN�i��{����E '��CG]�1��4�\�5O���=99N��%�SwZ H�˼'\�p~�ֿ��n�;�����nӃ����� �X�������ĥOb���X�Ԡ�%���oA��e+K~� .�)q��K�x����d���z�aV^ �W��$?�]�����ⳓ�+o��I8���]Sܠ�h9��]��Y]�*�����.rUC&Dv����;ݦL��6i���?����Nd�ۜZ�4�8x���� �8�P*o����HV&hp� JS%k!(�E��X3�ק5 �d_b �g��C�^���YNL���c�|����Tm�v�I,��((��jw��P���WRE�$A/r�!Q�Ӥ��.�F���� UU�����Ew2�j/�d�:JG�k� #D9�4Al�5��a����A���BiE��zGL���u���6�i���~��F��H��c��{�'8#��w�U�!�����^KD��<�ژ���'P�����U�=#��F{� �J:�:�>��d @]�
Static task
static1
Behavioral task
behavioral1
Sample
32959065221f28d21fbd8c4e65fd5796532b705d72dfa04376e97507a5cc9662.exe
Resource
win7-20231129-en
General
-
Target
32959065221f28d21fbd8c4e65fd5796532b705d72dfa04376e97507a5cc9662
-
Size
3.0MB
-
MD5
a0a20679fdc6b25c96bb807917546e2f
-
SHA1
d396d231650ab4699bd1fb62bdcc49fd3e754052
-
SHA256
32959065221f28d21fbd8c4e65fd5796532b705d72dfa04376e97507a5cc9662
-
SHA512
bbfad4907060e0920ca830cde0179a2485581acd5c165f5ae0faa2abb1047418881599946572a62e0414e4f1ca93f5888cc176293e09cccb664b5b2eba5559cd
-
SSDEEP
49152:hLFLefeE7U6dS3I4L+Wd6n1DtMDMdgqpRM12K7JU/by9g5OjTwlE8/XCUjritN:hpebU6gYnkwOARMLC/22OQfCUjrij
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32959065221f28d21fbd8c4e65fd5796532b705d72dfa04376e97507a5cc9662
Files
-
32959065221f28d21fbd8c4e65fd5796532b705d72dfa04376e97507a5cc9662.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 462KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE