漘[6~�6����+�إY�B�y�P���W�Nm��(k�9 ��?T��ްA��}��!�2Pd����=���<����]��h���Y�tv_�p���{���X���<��^��e�&�+�a�+Ф_r��L��N��&����kG��Hi��X�ivȄߨK�2g^(&sEt�{Bs�������l��Ѹ���YY���X�߳�q�������m&)�����������mƙ!5hD����΄�Cd��C��2q��������B&��g��໓ᖡ��V:r]TtJY�������ɢUك�h:���d�%cQ���yѬ���C SwTo)����@�8��(�Z��г��P9>��F��������@K������ee��H���h;P��`�AO��[��}�YBax�Ʈ���ē�w�x(�����w,N�Uwv&I)���c$; -��C�����Q��&h��>���IX����n������[�����+��A�������8��*�]���⨘xXң>/ y+N.8i�l~R4�mmKۑ?TU}���_x+���5O���,%]�w��O���E���������6�~.����O�dnC��TB,nU��a�,t�X �?��̗ԧ���z�}#��{S�Ā+��LC$�:M�d��觼D�/��9]#�i���k���S�Q;�Y�\L��x��93�(\e�H�U?^� ��'-ƵtJ�C��Zk��Z����q��������N[9�B�t�5m��ݽ��8����.^���վH#�P!�]B�]4���b��Ӝ�q�ED�q#U �P�L�3L9�c\���`���V\���4v�2��[�8u�կq���F-��q��m�m�+�|������BJ���B��h�2�����P,��aͳ�e<�b��7�3�!e;`)&U��g�ε�i- V��=�`]Ī�bJM��H]���:^����+��7�R a8%ޔ���+16��ѣ���؋x������I���w��]�'��*ʆ���DY~���K��7 d�� >���-��۵�5QF?�:������a#)b(\H�L�k��w���[��{��z#�т�xr����+F��u���{���O��3����\ǝJ�#�ɡΕ�,b��F!�����Is�&��?(=�7K2�ԉ��`����S8��7z�k��{�9I��$*Ї�%{X$��Ez����sg��(���nS҅G������Qr���$:hj��q��ɲt��ä������t��^�"�7nu��mʧ��Ј�y��ڳ|��&��b��:�3I_h)!|\NY���e:`L����9�w�����T�,���=K�m�� F(-�*�{f��6��$E����rW�pa�>�Wr��VJ���hg�����@U�R����慾�8)����C�?H��g�N �/H$ P'�θ�@)�Ч��%�$7�Ь6/����|H��~^ۮע@��27 k[Ѱ��(� a�p� �'�Ȫ��_��1#�^��q�.��Ko�����8��&S����IQ$F�+|���.w�5ͭlJg帔8g�Q-�eQ�P��ͮ�V��)�c`41a�l����A̤)QL��SZf$W��nA�N������Hپ2�T��B�f��]�Tʦ�߾����M�����i�f��u�zwy#(�Qt����?MX�9X�Y��?�c���Pȑ{���s�8��t[u"V���v��h���R�w��%�6��Nq���0�q�OB��C��z��6��of�X^l ���{�<�G��<os(��k�L��s�t�ʙ���P�>2�B-J|���nP�`�_8ܛ(�Ԗ(�H�QL���N �+���ٺ1*ʃ/����5���?��R��A4��B�\N�����b���˗����>\u�����p�Й>IR}mE��Ւ�ڏD�NG��5n�^���#�avl�>ٗ}dԻNC���=k(8��0���mNnRz�Ǐ��5 Q�ζ��9�:�⠱�e�ƚ+��a|�/�q�*�,�@h��w_�M,�,#�L&���z�`�]�>>M��\������(>�� ���P����b kZ���T�Q-y�͟y"��^�R��e��1����is���?� ��<�W�j���~�q苢�~����ZQ�zqAw|�{��p��'Phؔ�J�\3 ����\�}�(�0����MHjZ~"|�Ր��x���o��ĵ�r��{q�]����k\A�hǦ�:O}�q�55��N &L��eҠnK���L@E ��pY��ҩC������B"&pj�2�� =�sC6D����4�Խ���ڐ�Ȥ�Ƈ�u�C<��Sj�<�J�A�C�b9�>ٮ,���l�����7N��%T���������`�SC��̯���dɯ����WQm�IjN��Ҡ_$O-����11��{ ͽn@i�'���r�����^�0x<+A���4�ts�e�2[Y)�A<SG��Pc �GK��bx�~�3eȘ���� ǒ��҄��\�_*�:�UȲ�#�F!�h�^�&H���N����]a��J1���y+����s�]����$� W�;N�+N��F�E�&if�\��.<exr]���� �E��<���qK! �-EI$�݀g>ju��Wu�����x�k3P�>�x0P�ƾ,�Zd�g�JO|��;���#��jnu,U@Mm}k����M���3i��ݥکT֕�8�&R�� ��] )�~���m�(&��#s܃iJT͚��H�w��Z$F�2����9)�� ��hlP"��Zk-o�I؊[6x���|.g�h �n��CZ�jJ��U�ԫ��शH8��p����P�7s�Se��R0��h����>~�_�u��pJԪ��F�h�y1xf�M�D��߽$�y�$���_�UO_��A��,�;�M�e3��r�����=���(���Ie� ��b��vd��`���U �<I&!����?�1��ُ 9��y��4&Wv~,R�m� �TwנᨔYE|$]��FG��ZVO�.�������|��ⶓE���؛T@#ȡ"���,l��.i��T��?�pU���3qjϮ�7>�$�z#�u�"����w4�r6ً8(��0�ɭk��2k�M���5D���/��\�y�!
Static task
static1
Behavioral task
behavioral1
Sample
e2672049df27e9eb17aa8b6dae9c0ff3c2974751dc677f1d52a5b9e14190a23a.exe
Resource
win7-20231215-en
General
-
Target
e2672049df27e9eb17aa8b6dae9c0ff3c2974751dc677f1d52a5b9e14190a23a
-
Size
3.0MB
-
MD5
a1034fab45e92706adab1df639c831cb
-
SHA1
e85506507338f57fbe1008027bfe38c39d31c600
-
SHA256
e2672049df27e9eb17aa8b6dae9c0ff3c2974751dc677f1d52a5b9e14190a23a
-
SHA512
3de5519abcc95c7a301b24f4e634f6e5b3f037f311e2f3adf8825a4284c9d829908c023c79c68ac55aebd9407f4cfc4a0c0284e4f81b740dbacbd924ed9a6254
-
SSDEEP
49152:HJTI3JFHfxgQfvCsq3ShvnasSDEe8UpQi+BQHKvps2SggpI8kkM4Ut5mY/fkILIX:HG3HHfxD6sJPw/2/ZvRSC4Ut5mYnk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e2672049df27e9eb17aa8b6dae9c0ff3c2974751dc677f1d52a5b9e14190a23a
Files
-
e2672049df27e9eb17aa8b6dae9c0ff3c2974751dc677f1d52a5b9e14190a23a.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 462KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE