��j��T�M�`��:���B$�]���hx�����u�Ub/����Ed~"&dc�磫��<as&��*5jc* �A���Ȱ���s&����C ŝe�:��n�%3.���L��C�6H��9W�����Uxn�H��������uy��s�m�s�� Ɍ���W���I�*�e�LJe��V�3��`���i+��P�Q����,�:z��J�bLS�hkU'�}C�1�+��E8�k��(sC"&�e��G�̏kP~���m��( ^Kp˽�ô.��'�F�}�gm]���M��I�Aw�Fj=�u�ؚ�S�[�Z�E�L�=��@���/��]���_:i�u$����K��w 3����D��Qs�z ����d2� .^ ܕ�4G�B�A�G������*r� ����Y��=�R��l�ڪ�}����ڣ�X]���O:��:�&�t*8�N�L�F�>bN"�i�����`��@x'c�[.�� \f쁿�.$5���LO����<=��-�����U���H��h)�T_���d�t��f�L:���)"l�7��"8 7�R�+Z"i)�N��m�2|��R���[m�6n3A ��^م�$�d�io{����M]�_;��m�˔��]�T0L�E�}�3�=��~�t\)�0:�%��{@X烲,�crc5�@�J��w�>l+��eKD�i]���{:|���������P7(��7��͈����-��g�k�%���Z��k��'MNa�ݣ�^�Y��~��L�z�w`G�iQc�o�)�'s[\<�g�F�:�qH���T������.��h�9�*����H����6�R2H��<�gQH ����/o��;cW\ v��G0���qT�@�� e5��U�=~T_���@U^�jX,~�#�4w���jg|�!���q�DV�h��ɍM �r�f�V=�[��F ����~�S[I(���K��p�5�������T���=�3�ɸ��l�:`b~�V�nni*\�1���A��a�ZL�yn�5�/�a�m���甩��L\O�k�EGc)�+L�쐊R4�,��Q5 �*`����!2���+xjPL/��~�"���������7J��TZ.��w]m��n�n�XV�'��0܃#�{?����^J�d�6�u&J�[���v1���P���x�(!E5��\�^�L�1�Ǔ�{_%r*Q�m+������J��t��m'.!���;?���9�إ��K������x:M�p��^�<���K?O� �{��\ڹ[��m�aE*A� ��`��t�[�9M�9S���G���+����,�W�!��K��8֊Ɍ�����W�wP��a[��� ��^�p0��:���H���6���_�`拳٨���M�2�]~�q�U3l����ьa�>����]�#T8�����j&�ץ�1?�6�9~�[$��˃��ډ�X|֟җ<��9�΄@C��������D�[EۊQ�QZ��K� ʍ�^cʗ�{���O�� �kW���kh����)2oئj���aU�����2��}� (m�ߙ�%�.=g�㶈�`s@e�h�th����[�Ы �Z��&I�� XA �d+���[`��v=��f9�:�a�R������q���c�Ņ�m��H]�f�S�f(%V@҇�Iͳ0�0�#u�oS����}��ﭰω v����?�s�>�w�P/?hTZS^±�Z Y�"2&}Tn�`�M�O�U;X-�t�B���,Q����A����ַ�_kT��ť%f�G�N�a�N�������o�!�qT�l��!ά�7����qH������[��s��kD�>"�'Z�.���cm\�.��+�(� ����9Ӱ]'I��e�vr �.]��I���ۇ�^W��&vUsQ��@��.^�f���!��C�;���~a�g0!l��#����*ۚ����;*�xx5n+�>�&�i1������L�i��ے3�Ym��& ����Խ����]<�diI?���ȋ�Pϛ��W�I}��3��8<��� ��(mp�@��ڋ�X�й0ܯ�����l���:,�1��S� v�"��I����!��O�n��W�2�z�I3�̷��V�m\�=tF����C;��Ty}t�_�@| ��*M�af.�*-}�{СU��,8�C�G0V����L];kw����"n�$z��F�/�[����%�X�t����_xa��Gn�wز2_������=Yu2����P �^Cn���/��(���ć��囎����X��>~�={����M5���^�۾��EĽr*�����1���m���;U���/2�Z}���N�]��1�)n!���0�h��^xe�T� �+VI�G-�;P��%KL+N�任�%P) &���"i�'0��� �,���8�����謴�+��!ۤ"����ڗ�>Ά���6���E��0����'${�֔=���*������1�,iC�q~ $���&[�[� ��.�D�4��$���8�~_���5:̋��l��:qѦ|9u3��&�7�X��9l�S�� t��@˶���vO.�{F��[`�#]D�*���M�.�%���@�#����>)�3��3�_ Ӑ�y���'��Y�YuVA�s`Cd�an(�6��+�PȠ�1��"B�A�ð7�V��s���c}���c~'+d-��o�~Z��v�1k{S.���u>���>2^8�u� ��I��x�s�M~�Cg�c#�4W'��|iް�u1��"p��2�ұn�l��A?hmz�Ӥe�]���\��k��EDp��X�:!����gy\A#NRב�`�N4�k�(^�lHA%���n ��ô�K(?q���N� h4M��^}�0ް2�%Vk�Է�Tg��M��\�.��v��?a����o꺶7�ѝ�y���t��[��1�f�����p�Py�}��#����A|��O���z��*3˞ T��`:{=�x�_(ߌ J608��bH����D��Ewt0��-��A�Z�8l�����f��Z��RPQ���Kϧ͖.����@m���:����j��Bv*{c1@a��[�����ٿ�G�2�,d�{�jI0p�gOg�N���ʗ��(!�;d9��e���?��.�y��U������x���&��h�Lky��:� �J���Gya�yu�hVx�-o�s{��'G��EjX�t���jk���e�~���x�'�]��h�Cb��� (ju��s�����\/�il%����^-)0���E#b]�c�p���ک���ƻ]RD�.��K&�������#E�^��ޥv�7�1 � A5suܙ��gC�yP1�%7۾��l�K�,#�����˥�f��Y덄BEw`r������52�J�)K2�ّ�h�r١�A-w�^N;U��-��+���3��n�>-�vZP1����!7�&��P!R口d�9þ���Lǻ\k4w-W�%K�2�����3��òѲfِ�軻�ʛ:Ba֤�H �c��zEDu��4-#�j��F"�R��v� u�Ⱥ PCѣ R싱��8�A���G�%X��g�����h�T���Jj�9�w���+P=���~\�g��H�^��;~-�b&clQb����`��Տ��[7����=�*{_�M ��-�jI��0)����my���]�SQ���ՊD�N����%Q������������Y�Yp�e���=�[�~�2�<��9�b�1�����҂����N�K�
Static task
static1
Behavioral task
behavioral1
Sample
d2c855f4015c2bd9bdfceb70fc93d8edaf3127a96e1b9e2f6493f42fb595b065.exe
Resource
win7-20231215-en
General
-
Target
d2c855f4015c2bd9bdfceb70fc93d8edaf3127a96e1b9e2f6493f42fb595b065
-
Size
2.9MB
-
MD5
60d254352ded54fae63cf05070b15eec
-
SHA1
08f5c5bede38f99c829076bf7a3a4a06abe5ebe8
-
SHA256
d2c855f4015c2bd9bdfceb70fc93d8edaf3127a96e1b9e2f6493f42fb595b065
-
SHA512
428312b68bbfdacfc293b274bd76465f269749af4127e922796c88f360fb83890eed22756eee05017885513ec1c021fb904622ff2d8ebf2930914bcafac47834
-
SSDEEP
49152:ZUddiuJ8TFXjEl2ffNF+jW7mFh4CuUjg67yeHcd+XLJxmCdE+5:ZKdiuJ8RFtJmFh4CuUjgWt7JxNi+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d2c855f4015c2bd9bdfceb70fc93d8edaf3127a96e1b9e2f6493f42fb595b065
Files
-
d2c855f4015c2bd9bdfceb70fc93d8edaf3127a96e1b9e2f6493f42fb595b065.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE