B���5��-�+��f��?��ڇtB���j"�@lyUD�[GIB�V�3j/_!U�O7�F�X�E���W<�;6���g6�����7'��f��;��8�q#�;��*η�D=��,o0'�A�"T����/�B3x����7xX�MX�*.`>㺑F�+��A�`XH�lTL_Wk�*W �ӐlM�&��.�7*K�!�.E~ ��C����K!3AP�� e4�H�,#�~��ƻs> �1������IA#������Y��SHG��Td1 ���k����`�#(�{��LB�nLW�g�k�lI F����"��l��Z�p9Z�;��6_�>��?!kG��P��T��1�< It���^����RqU~U�!{ �Arw�O�.;Kdn��S�J=1�.%U�h&�-�����FXQ���U��X��]�1f�9����q����t[P�_�Pm�w�������ٻ.��-���F���9�" ����xٟ�]��^����V�V!��Z�=�L���+��i���r��~}�^}��-���TR�U���n��߳���3 Ί|����@��/�#m�����0�-g�/ʧ,ou����O�/���F:��ns����x�a�dƣ}Z���&�H����F#����5,bҺ���O,wK�u �Avi .b�)ۡt_��"�q��:t�φ"�,A|ڏ�jZF��q>I@49���d�H��AX�����l�x��,1��YL������̭Ջv��Kr����WΧ8v�a�REc��� �v�G���,�`���J P�|��(l`���a�;��LZ'r,V���7l��+�'ݪߖ֥z�=k���5K��^��F� P�������.I�"�C��ii)X������m��5YL\d;�r����d�i��ep�I�^���bC�r�ާ��^䶓�q�,sT��X�w��=C{��8S�N�0p>���$%�H�PR���gY��P8�`�R����Ԃ��?�_�ЯZ��|��i��A;f�r��sW÷��N���ҷ(C����P ��Q�=�>���L�O=�A(j~O�[��t��)�������Bm��������ќ��t��ON�{�P�o�,��to�3z��J`Zf/�N��(ǃ$�;���#װr�+C G�(�2ܱ&��Faj���ϛW�}q|�g�/ "�|?�g�{ڳDWRЙ���������_��Jw��j���AR{�|�H �,H�<|��I��Z1̢Ow�4�-�IOt?H"LRg܌]��nی� R(uAqB?���P�l`f�|���wТ*�m���6�2��ɊI�J汨e�o���⯣��s} ��P�E9���GWЈ�����l��OL�����z��*�n<��0����N�� $�����bin�����("Xz�d3ѭ3p�f{�����(Z�%\��`��� g�A�v�71 @�E�����A����7�Br �A'�F�7���|X��r��u^�o����K~�cN��K� {��1�aАՒ"D������H�����?��7!a�u�����`�&#����D��PB�x�ORr�|� �(-�0Aet�L� �/>�{Fo��Z�KZ��/LX�e�������y���T�������.�Q��~���7k]��Z��kuo<�[o�hII䯸��u����4�~rP�ΦC�� }�0=(D�D�}��vIx�ee��)�QD�4����Չ��ZzӴؠ�5X��A'+ܧ����>��xG'Π��;$�����9DB�M��a�W��0����\����2�j�;��g��|N)����^�wl����ym��O}��$��M�g7�u��l��N����ٷ � ��˔���[pE%u��ɎHLi�w�G�-������1Y�0��;��I��5����[o�� �j_3DD�ʌ�(N*������<2$�����O��z��3 ���d������?�ޟ� ��23"��x��!�"��{t�'�^O�Kz���8_o��G�!�gB� r���tD�t��#J��������T��K[$I�3�� �Ͱ���[v̜� 2 #+?6�LV�ǠǛ8��k�:<C�d�`�b�S|� ڇ�^=�Z���3��Y� ��d�����eo�T'l�I�Cg;�H<�dર���/��a�o�te�B)���mG#��l�t)U�_�eqs� �$ %.�dZ[Z���I2�vY��Jǝ?!M..V��,�_�L ��Xt�n� K���Y�[r�aV�ږ���7����c����䌯�B|Xs5!���<�/t9>���c&�s�*!����4���]B����Xᢹ~j��ts���e����Z�,g�^�Ɔ�z}'�L�.���)M��}�рX~����1B��:3�m�M��*��\Mei3�ͮ�Dӑ�D�:���dǵN��79I�5��൚�:]� ��m�W�,�@�v��j��<��F�J�S��]+���O[L�H� ��������1�(F֍����М)��������P����a?P�{$�^ռ�Fk*��/LS�F�1Q�߬;<ξ�[*�����,��z��9Зu-oA�Tu����J���棚_'���H�q],� �� TQ\ܞGi������/� ��|t�x������IQ����v)�O7���K2M^�Ҵ�^qezWLa�۪�v`�3�ue�X��k-W�^�\�6@<nk8��~_V�6�z^]�!~Tx�Dl g��BQ��-��xGeZ_����d!��Gd���U�M9�e;H�\2�%a�~{/�T�X4��w �H[������`���k(�Ҧxِ�Փr1^^9a�S�y������� �Q;G;<ݖ�s0��]��m�����v���PG� I)V}M:MA ��e�-�k����S�������d��e���BS���zIXɈ,�� T�JF�����8���s�:9�5Qc�����1W�Lg�q�!R �ReT*�Y���(BY��v ���t��j8�gX4���"�b3�N����L�z��0zV�i -\�iҺ�ka# q%�[#yT�CQ!O�GWز��z9~� �=p�`&�d*v��mL��\��U�r~,K�Zu9c�8�z^��j����8{ySH7k�����o�僦&�-?�^���q������X�u�a`����+kN�I��2�}U��]�<.��1�sH�E�mq���R����Ⓜ�˄�X����I�g-�L_��Wn�a8BΙB���e����"D�uG:�Y��C�g���v�:���}�S� y����K�^W��D߄w:���1��"���H@�(縙 ����9v���煫��!�����r���1C�Lj�9�� ����W�Z�r2��"��ӷw�>��=��܇Zt-m��ݞ!,��=�Y����w'듟Y=��t��FH��z�T����)�0e ݃4H�s�� \`L"�GӅ�����l/�*v5�;�Q3�<�����3cxW'� ���Z��Q��"Z%��9�j�,2�>3:Ꚏ��o�9��,�m��f���3���d�\*��.��ufe�S%83:���$}��lfH��a���M�r���=��E�9�/?#��x ��g�2��f�9r��U��O�ZE_�� !�+)�E�T̝W�\Cw�n ]�/������Z������ҵ�
Static task
static1
Behavioral task
behavioral1
Sample
ac47144658a0449eb135c2d7c12cad7fa452b5564c18cddff86a3df77a411c35.exe
Resource
win7-20231215-en
General
-
Target
ac47144658a0449eb135c2d7c12cad7fa452b5564c18cddff86a3df77a411c35
-
Size
3.0MB
-
MD5
58f9e42efa4ace27118e88010762cfaf
-
SHA1
30d3e7735058559ff7206007791d90e6704b231a
-
SHA256
ac47144658a0449eb135c2d7c12cad7fa452b5564c18cddff86a3df77a411c35
-
SHA512
e4e19f0b558063e6dd093c81888004ff6b50b3dd7ab73a593086548bf81f464d7e06307285a7ab7e06b299580ef753919524a28e5b1f0f240cbea09da27c8324
-
SSDEEP
49152:0EdDYRIGaLifYckOvFLUpwdLUWDdNNHvBoPtAP8ypoctA+7i62j34dZBou6QaAb:/eiGA1OdQmQWhNNHvG88ypT7G6CILBj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ac47144658a0449eb135c2d7c12cad7fa452b5564c18cddff86a3df77a411c35
Files
-
ac47144658a0449eb135c2d7c12cad7fa452b5564c18cddff86a3df77a411c35.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE