Xf��B�4�؊�Z!��m��-a�� ��gx�?[�5FYq2��Gp��x{����v0mU�*��e�J���_�_���`xzP;��u��v��#'�uµ� �)��nQ���X`l`QX���g�D������ѣ��l&�o�]�lP{�����d����*oZ�s]��'Y���]�=N���[>]-���_*�]{��P�@����H�k~nPK$��Dk^L>;ffA��T�_SD�p�ݕ����)Z�H��ԉ,��M����`����CXG����ߘ��+d�d���Q%͎ݲ?,@�*-���e�bI���]�����\+"�|�V��i!J�\at��k�f���!JC��-��Fr���s̕�`��M��@F�� �M���v���r�Ji��w����+"W��p���Iwjrw]��O�o���F���e6ؒ�c��nCj� %��[YHa�@ȶM��V�L�="����q8��H�ЃHlT{Y�|��,bF��S{�y{B�D���E��2��c��B��0����;�\f����Mִl��aze�B���T;�T��b�A����)��t�c��a��ޔ��Nu�#(|C��?gY�2h84n͜c��5 ��9��vK��d�".e;���c�KVM�f��+ܕ{���K�� ��i����\��nY!ףd��u�p۾��eG���������{�g��qջ��Q�]��7\���`�q|���:�m�v?w�UI�D�D�֛���GF���iiK�)m��,g*rH��s��CP1�)��0�h���1k�?a����xƳ�U���GT\ԥc/<���K��͛R�-A �v� E����'��H����|\���|��!��#�>�y%��8�'��qbp���Cp[�� &HF�ꄂc2�oH���Y��0�ʄ^=F2�~$MX�BgC�Z�d+�uw��B�����\��9�i~ �A#�a�������z}�n'l���+|�^�t8���p>���= ��_\?߾��y��5�"�Qɟ8���%�ϰ�d��)���k<���yU���u"1 ���q��t���=�[��۾�#\�3����s�,Q�vU�� Dm��a��Q7�M'F���I٪����C�&��Qxn������@P۠?Q��a���7�]I����%��{�G�$q;���&��R�9�e�Z���0����%��� �� ��ھ�. K�[������&[Us��:q��|E�r�C�'?�^�����'�:]FD�k��v�H�ZƳ Nf|b;���v�)ֺ_5�[h�v��c�[$E% �Kd���n|�c�1vNm��sV��xg讨e��gO�p}0�Ϥf�RE�]���A7zU��Rc�a���P���)�n���a�W�+���ˇ��'��� �h^�R��U��%����yh#��9���/v۪�%a��s_�7X����[ �̋��NKS(B�^ћ� ��R�]"=媩�K��F �0���2 �F����f�um3p�_ATl�P�a�$� �&4oͲ��r����?:]���5Ll��F�Pa�?��3ǜ��.p1���8�+���b�WNby~9���2|mq��6�ͽŋ,�������.0���KDm�X j�x�����m��b�m!�ҧ����7�2�ᾟ�ڃ-�1o�[1��F�?�P� �[�С#�AI7��/��!�1���}>���*�����7s��NFoAyPp���RJW���R�b�%��Xn�*���ois��ֶ ���6���cFM���m*K/�n���B'`M�� ���;x�`���\�E�N&7;�4 ��?PV�B��&��Y Ĕ��gz �]CM��i��%ى�/�pa'ϫm�Ƈ<YLP����S�\L���y��a�j��+1���t�,�S��~v�K�I�M�_w^熤AH�!��dн<�zT~�֑��P���;���ܲj�l����D�Ր�Q�?0����au�W�q?�锝 `^���5��d��~j���-8�;-e��y��&���.���=Dea���I�I>����B���H4 ��� ��tl6����.�u9�pj�q�#��zY����J��:4�C,89���6pW�c��3��r���ԁ�u �z����e���4��g,�=��� ��Kmэ��j;���@n|0ozֳ���Q�)- ~��� ��a�^�>��0ZA�����)e=C$8F�V���tdg�R���`䉚�*Iu����"6��S!$�#��n���N���_|%��QZ���c���qԏW#�b��|�h��cϴ}zCg1��o�z4��@�vg�nN!U6iM� ˃؋��ɾ����٬�8�G���3�o���F��C�K����)9���j1�3��@�_�L�`6a���3�a�N�&�.��c�|�\'0m��=��z�zUװ�Aᴀ�7j>�)���9��n��hO%�T�|�r�!f3���T��.F��+y�z=�0��*����g ��ύ�� ی$~48�t�����]Y!�N�T�L�Yݷ��X�O��_O�p�� ̬i�k��,�+�s��i�]��Ch~�m�҂^w}PB� H�n��ԙ�=�_�C��^����"���4<쁴����q��K!��J ��qIR:y�[y1�#�����R�{o跷�E$Ժ�~J�H��Tٝp�܍�tich��:2��a� �� �L3�'��e���'ha��yD;VI��XO9,�(-ګ�t����Ÿfw�!n����z^ƒb_(I`���dX��bdV���S� ���_�0q$���Ċd��/3�1R����@4��Ȓ�ܷ1��E`���I�|H�-Tn���� v�,b��y�10:���JRgc`5�֞=�U����HK�D� ��%{p��Ť)��;����'i�<'{1&��P�ߙ�M��M��� e�o�kx<��6��Ah�|�����I�8"d6!F��@������[)����|�:W����A�`��yeK}XJ"��9^�Jf0獈r�X�U�#�s�^%�&� �Q ���~�:�����X���x5���ho6���[�K �bڟ�ʚ�7�0��(��?�kTX/A�2��I)�.�ȡv@�W�Ä ����-� ����n<��+��,C�X�T[�e}h��/v���%Lq��=cL���&#w�$,1��*Q?o��
Static task
static1
Behavioral task
behavioral1
Sample
bf5ba2a7cc4c5fafdd124947781a5bd57bbbb4ec06f2b0bb5e723450dc1c1497.exe
Resource
win7-20231129-en
General
-
Target
bf5ba2a7cc4c5fafdd124947781a5bd57bbbb4ec06f2b0bb5e723450dc1c1497
-
Size
2.9MB
-
MD5
2bb95ba04408e924c2f73399dc867a70
-
SHA1
a0f10611aef18fb1aebe06638122ae626508b539
-
SHA256
bf5ba2a7cc4c5fafdd124947781a5bd57bbbb4ec06f2b0bb5e723450dc1c1497
-
SHA512
012b9a49cba88192b0d7aeb46632a777b09060efd95ad15d92f9d8f0dd08717000352ec90e5fbcc51d11909205e5f6237cb02960265c7aafc16bbab3be19a8e6
-
SSDEEP
49152:ZgPZRkV9cN4XC2rgdACj9PgSqE5hODE9Jnp652UtO09C2+c2Rci5MIr:2ZK2a/QPgSqE5gDmL22IOGZgciH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bf5ba2a7cc4c5fafdd124947781a5bd57bbbb4ec06f2b0bb5e723450dc1c1497
Files
-
bf5ba2a7cc4c5fafdd124947781a5bd57bbbb4ec06f2b0bb5e723450dc1c1497.exe .ps1 windows:6 windows x86 arch:x86 polyglot
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE