���`�S�g�YcH��L�����"��).����H��p��37qf�8�N|\�<5q��] ��Q/,^�R�k� � ��O`�b���eT��ry�n���W�WfuC�5U��ϒ�� ���H���S6Km�g���^���0id/�Σ���ъnX� ��/��JOk��'����qZ�YF,$Jx��\�i[�^d�h��TV"N�Cp �&F�JGs9�Br�.ᇴ��h���^���Ľ!Q�K�);0h��R&�#�ڿ����Sue��~�TB��{���v���]Eg���]>�t#��>)ʸ�R!�K��@�(ϯy�e�0a ��^!�_x�9>>����'{�����Z3���I� �����P��C�}5�Yz/2)�ݑOsL�'$��q����o.�������9s]I'����z�LquR�G�s��`���W��%�Z.������.WY�L�KQ��Fۏ5v�ޔt�M8驰��z��s��ޝ�S����p-t3(E�@/Y9�@�>� *�n\Sץ��W`#������v�7���i8��є��Iz��kD��!j=8P]��8L�i1z���x�T�z1��Qh�*1�y��쨚ƨE���PZ�,� 6�i�*\k-x?���w�kG \ͦ��p7��a��4��5zv[#W�ޞ���{��}I#�Lk�3���:j8y��4����e��a�����j=.�j({,�xz���G�B?��I/ k�0a*��븱 M9%u��V��çbPK�\��DzJﳶ 72z0յ]����t��?ф���|c������9�&W���8;�V1���詢��[a�M��D�5b^a����1��<��7/Fh�Ԫ�2��.�I䧹ر*(2+�����!tzoQ|��+��5�0�(�E�PO���5������g���|l)��jñ�md��jC������6�NG���z�SK��,�26:F��!�d�Exϣ�E��Uo�l~��K]�ʏj��Ó9AV�w pT=R���f|��p��:D4�L��"�I�kP&��G�&���$�s���:[�W��a7�_�α�ނ7��@��P�Ӷ��d�gB�&��8��"�L:Ao�3�C�k|| �q����q^��=��3�!�ݎ/Ǩ�����o���Oߩ� ڂ�<����>�7���� �װ^�뢖���3���v�}^K�%�Fmv����TSߞf 7�_�d~����B���{���������3�K_��(���A���߾�~1R (�ԉ��AH.�ٶ����n��A�B�9���i6�D��q�{|��% ��|�����������N<�ܼ��V6nM5�mLxc8��H6�8�[f�ѫ����9[E��C���Q�]| K���C<��{����d��֒�S�}Yx/M(�� �'�iO>�uV�s��t����=?r��-����#Y�:��A��k�������L1�u kZ�\�ܪ��4�α���b�`{.Vυ��%���w��V ���&�WY�_\�0�|���\�w�v{�S, @�-�C�V��b�|��h��ŷ�����)�� o���R'DR;� ���㽉�ΗŪIFR��r����LJ��X5O��~�W�b�vQ��g�L��'�Z@���m�ҿ9��,��ld��AS:�rQ7�;�n.�/-~Rxp�̞�>!eل�Rݕ]lm+!���+6V��]�HV!�;Y���`�m�Κ�KQ��8�9e������%�v���]�\ %����B��nhk(��"밶B���[��%�_?���s�>h���G��]�ǥ�k �43�����D8Q�������~���e��T�$x�w�;��ٟ��A�yW:Ω��?sq4P� � �!P�(���['�㏈�p��]�6��NWg����H�4%�=�%��\bM���ѽ���V���!��{��b����"��SѴ��_y'��-�D�X�pVY��R,9s����m�B���SQJ<��TW�X�>�I��歡A��dC��N rx�/#S�w]6�h�8��W�x�< ǜ�ӯ�/ʅ����y�J-���rX��MӾ#�kHs7m��S�g�Cʦ*��n��s}g��� =�*84���e/��I�c��lS4o��e����*�^����ոU���W�8@�P H�,��k�ڱ��|ۨG�y}�aKa/V�:r��$�_��o����7�A[8`E H�o|�.>��p��{��<�d(����):m� ^�K����\j�� ��:����_>�Bz��<ŏ}�I���;l�C���i!a�R�M��g���#�`0j��c�Gb�j'^��?���&f��������x��G�Tb�?`��2�f��n�� �h����)Lnߝ�3G�Y�]���Ե�<�s������~VlkrE#���l�����T��5)c^N6�4 Lf|q ��e��ESeo{�P�;c���� ���ߝ��5����U&� \�`�ȉ���e���F^0��S ��R[.0��%�X���&\������8Y7�6�\ r�t�����H��Z�s^~��y�e6��,�x< �S(�;ds�� �����7��g8�1����#d~��`B�fB[�� I �U�uX�ƈ��/*�:<��[���X�����l�^C�8�$��L��P�a�`�6���g��&,��{p*`�|�$Y� �v�֘JT.n7A����V��u��k�;��1%*Ҹ�[�R��Ea��k�K�j�k-۷6@���&v���4�N���glQ�$�Fz�9 ��O��x�O�G���uƯ��"��<��7%,]���� >�s9����S���2Z���+%�-�?�8ǗI���'e��F?����j�-�!�����N��n�@��?�Hn!R�V���Ih����|�����D��X�]�cV�+$D�5d8�����sST�b�q�7����{R߄Y5��YD��;����UD� �e�� `a֤�{ m�#�`�:y�s2SL�y�l� +@��� NUE�7@��}�����٠�rXstGļ#ؕ�-���{Az+�ȏk1�]y�(���Y��H��N��K�N[��t�Ի�=V�n��R�K�b�V<K�R cu�p�ʪv(S�a~���p�#pã6'�Tu��� )q}!c��R�4U��PW�?������)�|1���LB������tl� ��5E>f$@�_6������@�t��U���f�hY�N���?C�-�=[<��A�Z �G�/{(˳:h$�����zb�i��ߤ�AED_�~㍜����Af��.�zD,�%��W�nk\�
Static task
static1
Behavioral task
behavioral1
Sample
a0d9577ffcf5c76383a20653b4abd06385ccd6fe5a8e7c48ac2652cac249c881.exe
Resource
win7-20231215-en
General
-
Target
a0d9577ffcf5c76383a20653b4abd06385ccd6fe5a8e7c48ac2652cac249c881
-
Size
3.0MB
-
MD5
eaa9a6d2ba243567af4c323276bee334
-
SHA1
e36055a0d6bfb7ca4c8b6289d257cbadc7c3ac42
-
SHA256
a0d9577ffcf5c76383a20653b4abd06385ccd6fe5a8e7c48ac2652cac249c881
-
SHA512
c46a49ce909b74d53cf5dee749bb6d39ddf750cdf74ee70d1fd0df33860971c08b5f393781d997f16ebc94d389d0fce00f569a753e69c8a56f9ec3f1a5f0387e
-
SSDEEP
49152:FQQNqn9L3M56JX3Ualq5tIktd9JLzAsQ5b+Y5nS5gWh7kFHTaRRSJijaerJhYj:FQAIQ2nDItIk5Joow+ZiFccpeFe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a0d9577ffcf5c76383a20653b4abd06385ccd6fe5a8e7c48ac2652cac249c881
Files
-
a0d9577ffcf5c76383a20653b4abd06385ccd6fe5a8e7c48ac2652cac249c881.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 462KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE