�9��MK�������;�m���qLx�ίf#�� (x���@������M�s��JjoM��ӯ%��-@sj��/��X�!�e�0�������֙,��(���蜊�Kg*H��ZS��N�}�t�N��Y#�o���#�SE\)��1��&�1:ǜ����:ɳ��X��ʼp�O�?;h�K7=���z��.B�fY�'.�OƦb#%Ïu$�,,Vuc|Zb��h8����dH`F��3B�_��-B�d����|��4��ZD=UUE���cbl�iPeS��0-��O����b���~���K����q�����U�]�z���m���iw�j���5x��a��LĻ�R�|�a8�5�S����ޘ&�Z��@�����Y��X��E�3"�gb�xƃnB�cҖ�!z��ج9�C$76�]�|^��v�ף�_c��o���)N���=ud�XS @W ��1L��rR�t�c�i��6fX4cˬRa� (�(��|d�#ܗ �����.^��t��+<V] �/<�a�S�2�P���(����]7kZ�c�[eCt��Ռ����q)C�-1VB��M���4���~k�\?. !7����a��e#�Ma0<Z��x10v��s��E�u���כ�3Ȍ���C���Q����me�~jA����'}�S�=���� RE��UR����QL��(�����@B��U��2��u�@���K�#M�����<~��������A亜;��L�ڜ`R��O�1��:�o���-�-gb"Kh1���.7G�a��s�%EX���'(�#5"�����)��s�B��59���p�k�01�?�9�74p�����e���t��W��v��*l�t%����FB���1��U5E��f����M�V� ���GY���hR9=چr���1Z5�ީ�m��@t�������go��f���� ����دF����UZ$iպ�ͥ79�?[U��!D��j��uRT"[���#F�[�~��Z��~�H�u8�������ͯ6��`��(ࢂ�q����d�U�:�r N��g��� ���[����C��&��y���'1�.R��i~S���D )K���R�KE�=�Ljx|`&S�H^S#e��$���+���)����|�Kefe��)j���r�i���1qĦi���&v��2_�]\���l]�Y��n(:�?��j�9J���c2����4j���zx��p���J��ts�e�Pzdž_�?I��5�ҜC��Z���V3�@\h|�U�ƚ���z����*���c5�+Z2�"F�����v�k���w�C��.NX��uN��d$�w�MY��|CJ�S�@�ci�U��b���� B�_Fj�Wm�����҃mȠ�E!b��<Tܯ'�ro���7"�غ�e׀���g"�,ឣ���Bl; eJP0+T��y���|Ë�vC6��^��aO�ת����~#�I�g��O==2�퉺�:����o��3R�掶��m�iÂ~i}]$��۱H�5X���%�����^io<B�n�.j!������7H�j��*E�?�Y<�m��]�[�UN�.҂\�����]�6 ��it4Op��@�CLI1�`ّ���\����O����ZV��a�F��R���y����L������q�LS*��Z��Iuz�Ve�8���9؞��d��z(��)�}A��V�������/d��5��� %:7�Q��>�@�Ffd���=�a}�����Ai�y�m��6� ����1a_����}�����5���b���X���K�yc[��wx ���vā!ފO��q�!wC��|[s��k�����ݪ� ����SL�p'v2E`=�ukK��L����� )nF�g��D�L@���aZ��`�^p�-oW��]�� &.'��3�ը���Y�)���!���;n?�JWSAa`n��]����iŃB,�#)�jA6��-�pfً����D5�5)lJa� ��;O��@p�:7���9�_�������엥:8�]8��k��ȡ�S��C�Y��@�����|*�C �c�#�r�3��C�+~?4;���DT��gF���΅( Ya[�X�ab�wZ�D@���2>���H2lR�P�A�R��*=�)�iXgC ;�T�ɘ~�ߗf҄)�|��-b�`�PB^�2��}rP�����J��<yŁ�YеGƧ���;.c͉r|y�E�8`ɱ�U��8��6�h�1�l�����누���v�5�S���� oF��C<uH�3*s1C��m$�(E������mǣGy�%3�ؤnj�~2��~c��'+�c1�4�HB{�i�p��Z1~H�p����8�V�����H�� m�$�Z�P:@�;����Z?=��w�P�R.�ak�="�I<=��Gw?�h_�B0"�f�"ڔ�G����X5�x�N�8닏�bW�i���jբjL^�E���I�;X]*1� ?�şLɵ���e��A�$���@(Ų�� ���ۍY��3���1�Y�[8PH�5��Ȓ�dZgE�!�D�$<�kfkQ�R����D݉Ѡ@�*�NzVs|;�>_��Kj�������41 �C��J�%{yx�b�Y�O� �/�ߗ��'s�٬0�K"Q�����mn0��jM�0�P��*���6]�%K�J�D�����Yu�����r!_�;�͐�U�t_�{��~�P����Y���Mqf/ ݍZ���n�Y^�uƒ��O�cv252a�l0�*�#ؚ��=�UW�3��eə�>Ve�U���.�d[`w��.H�5�^jFW����M�nӦ�O���טc|xTz�2��˝}��BN5娤�s�"�2A���6�C�R�� ��)M���e�pr~�W����G"gT(��1$$.���Ȁb�$#����)�~x��$�'d��c"r�N��܅�YId��;�w���D�����D8�lA��늳&�.{/3�~1V��u�^��,+'v)�e��N����~����NrW+�+=L��Q5��K�b֭�?�3];���:)o���k71���=Z��BI.�R���͊�~a�{X*eYM0"�g�|�����P�q�<F)��+PV����)���*`hG:`U�O�(���)�x�I[S�ͩo�x{�톜}
Static task
static1
Behavioral task
behavioral1
Sample
d5e7cf22aa7cd7157cb7ff6193d48b4a.exe
Resource
win7-20231129-en
General
-
Target
d5e7cf22aa7cd7157cb7ff6193d48b4a
-
Size
3.0MB
-
MD5
d5e7cf22aa7cd7157cb7ff6193d48b4a
-
SHA1
3c396a6b5330ac3d4a1f288b9dd26503be444e89
-
SHA256
05cee19e393591f4e1ccd40c525a5a6032d8eebbb44fd6da28f2e28e5e1df733
-
SHA512
9a277e07b667375435a618a866e81f4a77b2afef4338714a4c11700af1fad5ee399b377c770874f8ae92f3e43b5b035af42e6e6c0e68fecca0345acc4d7e4ef3
-
SSDEEP
49152:7GMDCe4LTnxu+AXGFFN8b5qdvsqVxD8/LQMyxRMrCsj09m7/E99krhtEnSMU:71DCeWOXGrmb5ql/DD8/jIMrCsjqwO9z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d5e7cf22aa7cd7157cb7ff6193d48b4a
Files
-
d5e7cf22aa7cd7157cb7ff6193d48b4a.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE