�`�F1�>l���{b�6l�~Yʇ�P��E���� ����_@ŦO �|Z9|�qR��\H�?�5�����!X0S�o����h�Կ�W_�9'm��8^�R<?ё�'+�(x� }��5n�m��z�G5�T4A� ��M8����Z���4Ş�Dz��{E,�n3���T�!� %�X1�2d�<��ƚ4�����ޛ�J3~~�cq|�bv=�H����K�d!Y�]�M1���9*C��N�2��f�"KF/��B)ؙ� b=ދ�n 2��z��F�.PȞ�x��d:��k�=�]�Ҥ �x6�F�TFj�+J���y}��ۡ��=F���w6�@���8�9(2uw��CD�O�Q����:aAx"��I!���Op��$�U��������gn�&^A+SfԮ��E��v���3� {���#dk��v���l'g����a�U��{�]�z�O;������o����5���Hy��BTi�z�,`��^y���N ��HR���A���2 s�9 �h�jv$&�'C%��^S�'���9yT�i5�V��P�� �\�u�j)��ZN3B��5�B�ZƳY�U�و�=o�[��Ax]�+�j����f7����t���̹�Q�HRG�ٳR�������l�:� d>��(�5ʈm���jz8.*n*lK+��u��_}I�4g���p���%�~�I>Óy����ŏƬPz>���~ѱ2�/�VEzX5��> �Ƽ��s��_��6$]bx�?2�Ą��6!�}"^_j���.�l$\z��K?���K�Z͘���n���O�ՄY� ����]>������Q��G(1� �-���D����ZM���J��e��U&H�9����0�p����ʺ��Q���k� Ȁ�����;r�=<�9����h+`�7�ap��L<�#a���̮���'͉�<=�����O_0a ���16�O���Ջ.�w�=��G�n��|�?�[��Q$��:v��� �$���;Uw!�n/)��0NO�������D��Xȁ\Q�;ż,':&��� +5���a�mZ�+ �3�f|�C��M�:��<��"d����B�<`&5,�7ۑSὔ�o�F۽�O�����_�Vm�Ι�L|��4H_v����"o3�����꣠��?l}��%[�PZ��� l얂�S�g�F��Ğ�[������."����.����٬�Q�����+]�<V�才�i|s����q���-H�n���3�&9{Rɉ�0:>�[q�mC����������I0�I^ AG��ݑ{%HҰX.u�ΐ(~�bqÎ���g�z���NbY4އD�靨��;8~H<���1L�M~��̏f:��A=�X����)��N�6bo�x��c����H�<��������sz���l�$aՂAs0��I���۴!7P�*����ê����9� ?���H����.x^ְL�t� ��+t�cX\��x�S�G��T��6�P= ��M���[Z��v���=��]N�Ni�퍺j�8nB�:U;ϴ(�� H�XmWe"U2�<�����h�}��E��y�_#���%�~�3�-E������b3}Y?]|A��]9��P��*��01�f�������j�?#�^�N���{K��mCI�������������e�����PT�������~ՀĽ�L�j���.UY ����٧���O�b�||X�����՛���e�@���Sй�HIC2���~ɕ� �!����|I���}��#�Wĸ~��E��6�U�.�QaKu�Z��H������y�N��7�P ����Aa���J8=`K^,�]�V����Cq��0,z8WP�S��t��%2ĀO���My����ʯ}j0�B�����\��� ���*���c�f�Y��,#Az��Z��y�a�Ṧ�7W�Gv�@�����(�*>��H�k��(=�~�rxc�Ȉڐ��LX���"�C�.S�+LB�đ��oQY�J5��5�Ts]��T��d ��'z�}�$ב�A�L�&�E&��R�SпY�^���m6�1�7jU�6N���6������J�cXE���M��*a����h��ʨ�#��!�]O��8�X�膿$�Z�B�v��yD��5�pm��ְq�w�W�yذj:m��@/�����62��N;-��m@|Ch�J�<)� ]c?�-�# O�;U�ދ7OϬ�g�W�E�O�r�=l�C+Ԯ�}p��W(��%���,B;���hMg<�~������b�u���(5Gy�u��҅��2ǥ��H,�!�I������!'�#��,pg}�����v����C�����Q^e��.9��jT�߆�$'���]xm�5V9��6ō���'����P&Uw:����.�7*nϳ�]��{�c'x�jB�b�kv�Ҁ|HB���l&��-��=�*VE"jJC�Hx�n��N{��C��٦��Q�y���诙Z��~F-�K��~d&������-3��1��s%�C`��4#L A���U��5�����K��Z6x0��A���kgJ�L��Rnwi:�H�.�@ɑ�:bpy����������� ���5�9�3�����,h"�S�;(��Y��V�S��u��j7�P����D�&��r���p�S��gHY"����!N�K�gv�rz\g+�z����v��@)���upR�@D.�����fF�$�H�hH�}B��Շ�����R\�H�O:����~C,�N���������ji�F�����ڊR��{Rrԭ�spk�����8R&��\�?>�5 -_���md�b�gB����{q����������b�P��s�<¥��B���A�S�H,�������K���C��ồϫ��I�E�bFA�����p7��/�Y)L����{�ط@Z���ہ�x ��/�lU�������1�L�����F '���ޥ�Sk:$�)M1��8�^�}j�'����@ ��,x.�p�bWn�`�o#Y�����T,�F]m��8|}ZNS���Ap�a�2Ie"Ni�̿��3�=]��s( E�;�_��w�zE!��l��MXUߖO�<E�&��/1aE�@p!��BZD��L���MPD���|g�����OZꭲ����(��w��oI`�:J�������ձyNgb�r�t\��6���I���j�[�g5q����:>[FG/��u;���5w���l�Z2ͦ�|��p2h��D��L8 � Ap�I�=0m����H�KH���o�rd�����],My�&��P����]qDe���f�%��P���~�fӻxi�eu&���i\vW�p����i��Z���C3�낞&�1bj���>?d���7XaV�ͼZ�"�<S�lXa����[�K:h�вWE���2q ���ҝĊ���A�(z���k�hZ���ӑ��U�c�4 B�[���V�X�MS��i�������Ƀ��F�-��#��z�C��/vi0/IÌ��Wo���wÝ�Y8��Cf�Ҫ`�o;��-�cf�������)?;�Sqؙb�BE7@��*"6Z�Ec&&��ՕE����u�5$��\��w�\�Q�pZ39i[\XT�w�|�q���Z��P���+ҹ>MzGlD������4��s�x�j�K��+�L��Z/�m�a�#(�U˦cp��*_v���hD����`��6k��` �i�:#�#��J��F��]f$a��H�0>d ���)b�-E���IE���
Static task
static1
Behavioral task
behavioral1
Sample
be52449b37d9f43dc7c98c174a1b68d1d97c9fd5a3f653d82d892df896fbfc94.exe
Resource
win7-20231215-en
General
-
Target
be52449b37d9f43dc7c98c174a1b68d1d97c9fd5a3f653d82d892df896fbfc94
-
Size
3.0MB
-
MD5
70df632d2bf711bd8f8dd5f10638ee84
-
SHA1
6c6874bfeb94d645ff8ae15d6434f004353f8b9a
-
SHA256
be52449b37d9f43dc7c98c174a1b68d1d97c9fd5a3f653d82d892df896fbfc94
-
SHA512
02312865a0d7470f8740fb66dced22c769c8f294de24dbb02f81a0d58e35b9863c0e5e96489b9071343bab1a110a7c274a0dc70c549030e973bfad3eeede0be3
-
SSDEEP
49152:SK/p4ztNFcqcgTN4DnTkVFhMKBXibDjIYEJSYE8POgh1FVdCqNUlBD:Sep4ztNFcqci2DnChMkib3IYEJSoPOAO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource be52449b37d9f43dc7c98c174a1b68d1d97c9fd5a3f653d82d892df896fbfc94
Files
-
be52449b37d9f43dc7c98c174a1b68d1d97c9fd5a3f653d82d892df896fbfc94.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 462KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE