_��� �`�b��}�vR��������]l�g�ޓ���K��}���� ���n���B���K{�����R��� �g�� 6�e_ G2�.<�0|�Q+����d�*��U p=��A��J:l�w����G6��V�T�UԸ �<f�2�Ϯ�MN"F��5����"����'����5��M��(�����~e�P����SC�m�e�PX���E{A�z,|�ut�Q��S �]���ZuP��l9:LHa))��J-lɬ�5��D���� ��c3��_ixdƧ���-5[,Z�����+���}�e�I�<W5^[��,�K�Kf#r/gg:J6�c�8�h��S�T�z(`!������B3nxX�� ��)|� &.?�z���ׁ)�9 �!��a �a+����N�QP�9P�X� 6���ݏAT���W���,����!�s�\*F�O��v�vE�"���-�~Ac���&���t�O�/�O�р��o��.��:�ZnÛЩ.q��wL-Y�qo��oS��FmKy���~��Vyy�.�7����]يO�>���y�n�r�<N��5�d�j�� 1��u�3���Y��X�M+���"BS\m��M����i���[�@���u��nK�ڰ�����I�D�06�:���5� �� ZH�ru��?��c�� ����i�t�bD�#&�����i��)?��@�o��ao����а��*�>¤20;�~;P^Տ��W�֥SjZ���;k0�\\cUk�<�穧ߛ.�!x����S\Z5^� 1���MF�R����H/�3Q��Pq�-���:���2�:m{w��i�0�������v9����'C�2���E����Nr �Z���T^�fVyK Q�]�a�q�����G�[1|1��<���k73x��YpZ�/R�ၾvq�_� �o���ӂ- L@��u��F�䓃h�)��A�����/Q=���u��B/�� ��>͊Ö*�����ybAҜ#��ok*��oޠ��˼����M&=+���#'� j"<cE7�?O�I��8�eX�T��0�X���t����x�C ����`��i�#\\(���6�i��K�~�WG��h����isy@�������D�i�Z8���ϐN�F�F��ydu�+IfĶ+��5�z��춆�A�C�6�CQ n��Q���E�8N ����"ۗ�)����4n\�n�G��5����'�,���X���i �o��U��tޮW����* Nmh����k�U|���)���l���G�t�� ������&\0e� x�U���`2�.�?�/̹DaP��7��'��¶�&8�YϔX&��aUW�����:M���a���ߺ�*�#JYT��.��E������j)�����]b���xrQ���WxmD�1l�w?3J��!���@놗�����;A� ���U��Ռ����ˎ�y���v2�]¤�;�y ~�F�D��{G#/����� Z$�An����^��OG�?��2LE�����<���YL��>w��A$xc̠թ��TQ���+և�h ]��h+Yί�ڲ�A(�u5�\��X�A��G��VQh�d}ki�7�0^m���v�` �;G�$�37��G��7��f����R���ˠ��9R“j�L�^��$�ϙ�,�ѵ@�?�/; fo��G]惲�>��R^Qe{������2K>^��|s\Y�1F���9��yWosXM�g:���I���@V�/��%4$k2�s�:zŰ�7�*�}���N3�� %�kx��h����7DÈh�J �=1(u�3��YD��g��;�JDq���^��˩Oj�0�>�<�XV�P,Qwi�$6�M'nO\s��OlN,��=�s��<ģKÈB�V����%/�e5�v2��&����>�]���,�S����gQ!�y��C������O��P�� >*t�}��T�t0�uG;��(=�~*����ԇ@6��8m����K ���FM����XXKiA0�˩љ2NP��\ڟ�6��v��9v����·����["�K��F�V* �~iJt|9�n<G�E��^�ӻg� pw�=@����B]y�������+�M8�15:�+}&[��p�i9/*�)sw����U�^lz�D�{Ի����� $q�!$�j$����d�gr��@7�k�m�G��]�~|s# �Iw-i�i���8�5�8����l�馽�-�1� ؓ��|�Ɂ�_�-�Kٯa-��s��~?�pTY�?����0����4]D�%��m��7�O1] ZwjܫRİ ��$�[�H���>z��&��z�A�z����<k�G+\�Dj�Yw|�=��AZ]�T=wx5�)��g$ސܢ�P�)�6���u&�Dp��O��2� {F �脛A���F/�3(�#�C�eE=l�=�;����A.��q����qc�n�!lJ���u������;��`7���M�p�J�_S*�eq}-]< ��ūͪp&p�������[1~�+�M\ �۪�����$t<Ȑ)w�(�X�cǩ�*nB7쀽�&�@�Ҿ�]����.~H�9 x�f'~���u�`' �1yZ���k�S�D���� m��9}5zM^�/��y��{_ XG��$$�yw���ᭌJ��_2d��v�8).��̋��K�R�sl��V�UqԷڰֵ?���x�\��:��2x���ر���#�:t�Z�.�zR�p@'D�㾋��)T)�;á#&*��+ϒ˒&�gE���z�":����)1�k�W����"�����mO���_�����bQ!�%�6�[@�a��3���lk���\���8<�d�U�A����dbYQ��1 o�֊��b�(j~�[���������GKl�a;Ŝ� �H=ھ���J�w�)!@��g���3����p��Jc�"Ǭ�uڻ0���G�H�9���s}�JZ�A����;��j������ے<:T�=���d&�ln���k;zC)W�������M���(&�v�P~���:,熗2����(S_�)���UK�Gp�L9�$�W�ɑ���+���О��hR�ɟ?�b�+����+w{�5����"�3]b9�Kҥ{���Hz���86,5q*�ֻ���ǎ���[4LZ�q��]�h�[!?���W�B��o���h���`k��:�a��x+hb ?�';�n�19+�^���?r��@< �W�5�c���7)-*)-_)п��0��A�����~K�(�6��攎��N/`�6��������Jw���5ۼ~�db�#Ο�.� w���1�?��&FS@�`�)�!?#Gdn�.�描���mXH��S��o�w�_8#��ږZw�ұG���"�٩�G��@��Db�'56�ŀ��)��>=r�W�'�j毶o�w�x��?!��s3DJ��%�_�.=n��τ!E��}�/� ��]�Q�b �'����W�p�hפ4��������KP���T}��5��u����G�Ee�G:� )�,G�E7�H�b�X ����呂�7J^h�W�gՕG�������j�G5��E�� FL�m�@�����~�����gY-�Z��5ݔ}�=#�����$��i�ƻ@۵� �3 �i�
Static task
static1
Behavioral task
behavioral1
Sample
27dc60c4e3b12328350a03e423f490ea5248b9b4470f472017efa53107565624.exe
Resource
win7-20231215-en
General
-
Target
27dc60c4e3b12328350a03e423f490ea5248b9b4470f472017efa53107565624
-
Size
3.0MB
-
MD5
4831c51503a066d786eff01934a313b0
-
SHA1
61e16fe30cfb1aa862a939818e2de7b5b7c578c3
-
SHA256
27dc60c4e3b12328350a03e423f490ea5248b9b4470f472017efa53107565624
-
SHA512
9e98c92aa644920d06e1a30e60d050e35315096a52171d22f40e9af292c1ab5c8828b217986a97bd9a5cd7c8d2f1586894ae4c7f703c8151f5a6de8f6c04cb22
-
SSDEEP
49152:/dA/ryEawkzW2M/473O6LwaxBXhbcbYWkmNOQAju3i0sS9vVaNoFknmZ8X5PF:eTyEaJ/E03rxUND393aNoFkmZ8X5PF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 27dc60c4e3b12328350a03e423f490ea5248b9b4470f472017efa53107565624
Files
-
27dc60c4e3b12328350a03e423f490ea5248b9b4470f472017efa53107565624.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 462KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE