��u�9�(�/,���!�Ơ|�g�k��ƫ�����"&��a�-���V͵�cMp�W����pک|.�ܢ��-3���勞#�ě��Ad5gj�+�ȵЄ�Vr�bt�$��`@��V?�t��k4��,��!m��P�D͐�Y��OdSxKC ��*�Ju0���$M���u�p�:���k�XN�: ߚ��j�o������7�H�ԯ�Ji��Y��s�B�k*��h�P���1'R�&�}Ս����(����SR��6�� � ^��ѣ��){m�<�䢿�ݡ^�B��ao!�/�.��� �IX�X8܄��Z0���g)�AR9�AB�Q�X����(�m�i�k�)�{�p�z����" �q�b��h�����Ǫ�%Ý�v�VB�N��I��\k��lt]��T�y ���������i�;��=��E$���m��WC�S��$w%�n�{|�h�A=K�WfݘG%�?\dN_����5'�m<z�G"ND4��N^I���m��;�xS�WϾQ��c-���!���f,U���ϼg��|��æm�B�3F'�t�� Y|F�G��P��A9�b(�y�J�jS\�ǿ�}!K:_h��{��Bŀ^>��Őŀ�X9��Ļ����@A).ME"���q�c�A��H:�Fw���nS���Z��O&�Ƶ��M�%J.���g� ��f������L�Meep�*ͭ�} 0����1%N+1�F"�z8��M�\�3]��Phj%���M�3���~7�����u%��� 2�aw���(i�x��6B�v��(�Q�����0���}�H� ��.̫X����h�"7��9����iȷ3Ĩ�`/��ͼ�<)-�i��8Х&���A�#0����T-���l������$c;[���"�3�XU�oh��P���X�y=b�i �q�Α��2h��HtIA�L)���R��Ӏ{R��9��d�\��A��~�C���p`Mg�&��[6r���3��N91����8#���+jn���ı�g����%�w�'���X|1�Lrsȣ= R��g�Iua�V}�����Mk�Q�z:��� P+���,�A����ƣ5,G��"�T���r� �}���X|�c�'QY�N´�=�E��BL�ĩ��n.ޗj3{s����.��<M��&QFNf:����;���Y��vI¯ ��M��5���{x)��!������g?��`�_�)�c�(r!_d+9ݭ��������L�B%3S2���Wēb�&���:�d-&�?��+����� Wƀb�FA�o�}:��ޠ���l�y��O��'*'��$eF7oT���.��%Ztd�O���n����� �&�b�i�v���PE�c�d��m��9'k�~�����]����Jl�ܘh>!�n=�L��z>��s�)c�5�ᛩ ��@Tj��9�d(=�%�?�Y�rO���zl5dw�u��BSt5�㭧�:��}� 6�m����H�W�'������y�#�����֨�D4���O$�/���Y� ���Rw��� M��"��vҒB�%si��������7�ꮐ��HI�?���p����� +��S�=��/n+"-!�1�zNՅ!�y&��3��$Ʃ��x�|"I��R�B����E�/�A_�ð4�����W��ƜUĦ�zr6^����T#]�](luUi��@�[(�Z�i7չ;6'\n{�{*����O>�w���7��*:{� T�I�\���<Q���=�_�lH�� ���;㡑+��t�kL�ӽ�qm,smNg8y]�1�E��q�g�n��b�7L���Fjl�_}��v��G�eT��z��>��0��������f��`�\�k�$R��,�Q^�Er��)6�����[���v��<��KU�k�����a�Y[��Xī��ṳF���m��h�gs��B��!�/B��d/4LL�F�u%&�#n����vw�8�J���ڈxgۭ������]2�$�����(����<��(�2�!Oi&*}\|���\���b��+�ގA��Ý�xT���Q��~���R����[�'սY0��0��r�t(C!s8PĔ��S"�kVK ˰���cV� �VÒsӯ�f9M��M����o���nƜ�e��+���X@�g��%{���BӶTվ�c+I�w�hbN��;�:���JN ��q;��T �]�LQ %7��X��c}B�X�F&u=c��0���$�!(�-�>�����Jt��Ę��L�?ɞ����/��jh`���!��T :�=q��ѫzN��3���(4Y����<� ��'����ܬ2@o������碚���H ��$��r+J״=�줗IC~&�� �����!ԭp����7@�]�{�M]��pƕ`L���Gn�3ּԂ���XV�j;�(�'>t��)�b�Z:\.V�&V�٥�x^�&��/�2I4��k����iIq������5��.� ��������W���d�s�o<�����`�{��`+����g.*����)W&>��%�*K�(��Y��*����`�t=�(�S[�d�N� ��x@Ȗρ�v� ��F���e��Y�u�:�O&K�����E�����sD�~1���㲩�c$�vi����䳩[�lဠ���5 E�1x���N�`�G�V8s�r�$��a�iz���g�,�͡�c����<g@�]� ���xP��Y:5ʥ5 o8�5�z5C��eE;�)|5�{K#.�F��a�s�0�eM@��u�sQx.�_ h��Y%҈����ˆ�dF�{�2�)�mW��M|�"הg�Wܐusq�&�Q����?V��cM��/��7>��H����=��m�+��V5�3i(7�}��� W�{�UB0���8�oڄN�z=��_a6����jaG *���M��_m#���[� � �toS���*��۔�$�m�5�[�r�A�%�Q�4ʀ ���q��AAH���h�W)��H�F��nF ���Mʞ���!�F�]3��d:�%��̤S�dvު*2Ҁ�u��ɱblA�6�O�Td_��K �ݽ�ʈ����2̡���>ͬ�V-K����4W��Ȝt;�.Z�^m��\!���/ڝz`}C�W�X6�y����SV���L�E\����{���}��]�9�C����6� ���&�v��n$��!��x"�t.�����T:n�Y�~`��9�,�M�s2v�����}JW���`��j�e�����S�� f�/���`��JZ�tfX`�E����2�x:��"��{>u�3�,D)�Q�����ug��s��ow:W�%�rP�P����L*J�H??'9�ǭ�w�����~/�n�_S�]ȣV��e�Q�
Static task
static1
Behavioral task
behavioral1
Sample
111fa3368ec9a7aecc43795f4f90aa50094c5ccc06b30d39c4a37e05c2b39fe3.exe
Resource
win7-20231129-en
General
-
Target
111fa3368ec9a7aecc43795f4f90aa50094c5ccc06b30d39c4a37e05c2b39fe3
-
Size
3.0MB
-
MD5
e2da2ca6bc28ea48c2d36d1b3d039d3f
-
SHA1
1e6bb841b2b78d768b2dbf7669876fc9d04c60cd
-
SHA256
111fa3368ec9a7aecc43795f4f90aa50094c5ccc06b30d39c4a37e05c2b39fe3
-
SHA512
cf2353791a3a003d6e39657757dd4341b016ac2677db5310e0cb3f2f74b35ccc3998bc4c10e890995b0cc5c734dfc7622a2f95153c36f42ff853965a9a4f8d85
-
SSDEEP
49152:bmXhlkMRv/m3YxaV69v3PJLVxrZJjmklUqTUTNV5qu:bm3kaHmoxE69vhLVxVBmk345X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 111fa3368ec9a7aecc43795f4f90aa50094c5ccc06b30d39c4a37e05c2b39fe3
Files
-
111fa3368ec9a7aecc43795f4f90aa50094c5ccc06b30d39c4a37e05c2b39fe3.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 462KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE