?рb}N��M̒/x��O��f�u���;m�G��� ,@�ʨ�jl��f����ǎ�s�u����f�#܌��\=rF!�=�d��h��V��߆���K�ܔԭݍ�KV� BMf�K!L��h((5���t��t"Ŗ A��G��[p2M�1���O���V�.�o�����5�0� �4#Ps�;�ȟ�CzŧXT�;����FЉ �����\�������"��6��ڝ��)D"����%��ں!W��{���~İ<&�P� �߅4m� O��L��zٜ��O������1b�V��zfm�im�X�E%�� �����z��AM�^]1zk�7����8�v���R������V�HǺ�k�"��5O�����S�o�*�D2��K�4��$OT�����|�����-�����W���+�N�1�ܛW 9����<ӧ;p�gI\�&l��xY���6�o�:,�����#�ڱ�柅�v⭄d�"o~>�6l��=M�N�}���cO�FdJsS�I�76ɔ�#i$��kA�fr�Bibv6�A��x�&G��Q�L�������U�|kB $ @[{<B ���=��xyai��tkeY����64y��Z�C�'m��_5�&��*u�����.]�5�so����ӐG��uG����Hu���4��}{M�֞G�FvR���^��>�a�U�m�� ������Mڤ��V=�T��#?犯��.N��`� Y�r�r� ��~g�+'<܊I�� v�*�3�c�������KO��tS��f�D�|����H��V4�kgD��-Y[a��v�1>��F{�2w��X�5$|���P�]C9������/���}G�`b��I�g���.�di �F^��x���J~��:_d��N-���m~j��� �9�1S�t�+/�����u�;~(>��� 1��]2�~N��\��/��������&��C2�f��iG��ع���e�z��HIJ�3�S��ח�~A�(ơK��D;�V�uV�re�>0�������g���Q�5��LE����1͔4Z�,��H����������]\�,,?�#"�x�z?��:���Z�����V&Hh ڠ��;( �Q�p ֛?s�zt7�o4��\����� #x�qd)R�?r9�},���j}:7*��_[S.�I~���~T�EE"u/8�O[�����Ҳ_b�E�,M�ړ6��q��1S�k�]Ev�5z�9�]��9�e�_c�o>����}�#�}(ё{���y���9M�`Fu�\�0�X�.�3Lkі����G=�V�*M�P�5��qش<��L~��)W�����A&��o����\r�Ev�, �����^R�)��: �i�yxW��b٣�>00b�V���K��<�h!��Q�2���h��hм��X�{cx�c��Y' ����S���&D2�"lu�qb(�F/V�X����$��H"��Z�tm�4s�x҂�Z���i�LY�����i���^ì�y1�����:�@����cM�,���wXO���#د�(��Nm���B�E�CÐGfh�v���R�a�΄�7Ċ�d��%]S��8�4Įߐ��b�/'H/��FAZ���f c�g��;�� �c�`�x�>9�q�J����W��Y�t ��E�aa�G�Z�OVR�R�@��t9����{/��rHt�Vp��~k�,�/��WSA����+D�^�ӅIpb:ti`I���D��v�w���᪽לl��{��Q"r���7�"�=�g,���������>v��G�?i]��j�R�ml��Qً~��m����hR}�w/� �Q#o�b��Ԃyj�UI�%[�o�E#v�+����z���Hm� ��vI��2jr��$÷=y9��?u� �nv��ෲ4�J'��BoYPq�����|��fZ*��!�>�p���qg!�yq�n�H��:Đ�5S= �t3�t+�C��J ��!LD=vm�) ��U�op���_��ہ�;�T��5�(XaD���+�:�#�������/ہǀw#�frfa�0Z��b�)���ng�a� ����Y��G�X9E1���},p�t���8l�!���¶��d>�і�������D��h��F���;PQB��b��?�-�㯭�Ι�9'�N$���D�5�$�=dq�?3(��:I�D ��%�v ,�u�"�lwP�D����^$`���#XM=4w�+@������jI ���J������P()�]�����m����}~d2UH�ӡ���$p���i��!��Hu�����&5�LGZ�A@`�o�f}3�}rI���(#�����bFD���ð���A;vu������D���j}�0��2��#��M�h���: �nD�%�H��#,�����ֳKൈ�_QA1`��ePK��{��������ͧ�r^����xA���� ���KT p��6'#�¤[���O�~�Ɍ=ήA�ĘPx�׃���Dx[4 QF��"�����٤?V�8N Cw��}4�I�ý�|���Jލb\�孮�pJ�A�'�?v ��I`�?�at]�#Y|����C��Ύ�t�k�[86������#m>�e�t0@�;���/�Q<f�*���'�m�W�͇�M6��Dt���6I=�@�~F�y��oXSkcK���T���l�V�u��� ����+�"�R�>(��\4��Gѷt� +�7X𮝤�9��#��Ձ�X�0�5��X9/#��\k �Hkq���jDv���M͂��צS�w �v�,:oq#_ǀZ=<T����¦ Rԓ�H~��5x� ��V�Pk6�B5gH(�������r���Tw}�FE�8M�Y��L ��t��V���+t��|/DFK������tp����h�k�{ U&9��+`Ap�=6*���~������_��@D*�Q��"jA�C�?)���?L�)K��tS�Â�r<��w������] �(E�4c"�,18��GÊ�]�����g�������SId� ԈL���o=�I����J��r�`��n^� 2��� ���T����|̻���'wj��9� �P�1�!��)d��s���00F�,%�w���~�\�jH�0�~�<ͮ��JU��8+m�y�& V+7�\�6h�1�ځ�xW� K8�>�N Q�ݖV����,� ��eR���P�oSh�l|����b�QR��M���{��� ա;�E�݅8�x(q�fe��}�H3IK�u)�z@,n��e���{U��lx���D��F�}���9
Static task
static1
Behavioral task
behavioral1
Sample
18a18ed915a0e903ec4b78ab6d0e685c29017cd10cd57f059ef85cb242e2b3f8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
18a18ed915a0e903ec4b78ab6d0e685c29017cd10cd57f059ef85cb242e2b3f8.exe
Resource
win10v2004-20231215-en
General
-
Target
18a18ed915a0e903ec4b78ab6d0e685c29017cd10cd57f059ef85cb242e2b3f8
-
Size
6.2MB
-
MD5
36780ae39027a286f5126ca21b635bf8
-
SHA1
d8f12ce21ad6e0d9e802653090a440d5b7bedad4
-
SHA256
18a18ed915a0e903ec4b78ab6d0e685c29017cd10cd57f059ef85cb242e2b3f8
-
SHA512
f737a2f51937160b2b5b9c532037d49faf649844d3df72269e5aa7142203ecac511bba89b29700abc3d4922d33dd313843c78af879391ffbbcac297c92cbfbf0
-
SSDEEP
98304:Xluyf8z0hJUerGcsTocU3q1EKOMHSrgYU0yMdZ4qyDRbsYFMbjH2J2aVJ7g:YyfEDcsEcAqvOXCG45DRxFM3l5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 18a18ed915a0e903ec4b78ab6d0e685c29017cd10cd57f059ef85cb242e2b3f8
Files
-
18a18ed915a0e903ec4b78ab6d0e685c29017cd10cd57f059ef85cb242e2b3f8.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 3.0MB - Virtual size: 8.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 342KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 65KB - Virtual size: 424KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 15KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 548KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 194KB - Virtual size: 7.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE