y�*����13�W�y�㦋��7V��)ygJw�r�b���|2���{����<��;�6=��3�A)��*8����%p3����5�P�l��IG�D���]G�˒�r�![��~z���Kɀ�x�d�fi���1>k�c ������7�����u�r��≷���=�;"|R��xUd A�Z�?��_�u"H�u��xv����rL�S����GRie�ا:U~@�q��>Ge�V���&����2$-�C�J96�-�%gD�j�ʘPZ��o"�\�~a�2�o���aM��` qQ�j#��B@0��M9��8sN��� �W���.��<��(J> đ����ڢ6�T(5�����1 g� O"����+�6.m�5^rg��5�)m��a1���A��I ��WJ��#�&uh� -�~X&'�F��'V6��������B;��d��r?��pu _lY�̇�Ҕɻ'͎���Ե9*�ݗ�����G\������~E���Uz���ːf�ptN�!�����|��To�C�\@�7G��a�bSN�&���E�4n�(\L}�;׆'{U��T�D�����Z��U�1�W�t��W��[��С�F�U�P�D�L���==P�&�9�F$���!nb��EMI���9D<f�;<�i�yz��)��jP��Y����+�x#����k)�?tm�=�@��d����R� #�u#����y��ݗ�������-���=���m<��E�����;�s����� %�����d�T��GΊ0���dYc���c�D�D��7P�A �?��ۂL�NjP}�4L/�AU>Д���'#rڝ64����'bo$�gg�ݤ���sm��-�o�}��B���re�ڙ�,7r|�V�d�����-_9��_8}T�x"�f!��� TS���f��A�Z�9?c��|��`>2t�����r�@�˖9��uD�r�KV���pa�t}�Ƒ�o���.�Э� �����Jr�g^�����9�|�e��ј ��p �4���^�r�o��i�`��V�v*�4�@GM����R"�^1[���2���J�9b�8}��Cuh�'�C?�g_�e�**��_��M��5�٣I�0��d��Ql�(qI��`\�}%Jܠ.����"V���YX�.���� $��aΑ��r�ȭ�ܵ�E߳vL;��=# 顡�D:uM����r�=Sx��9�:�x PU.��z�6�8u-� *�nE7�r�dTS������k�p�9� �A�W��h� ˵J*'Fy'�ȥYZ�X�0�S"�ldPUe[�� 3�EA����}�{lr�E[>.KQ��� ����V�z`=����r���8-#z�dq���d�A�tI�H;&�&D��Ñ��~�S���0N�(!đX���`V����8���fJ1g��9� 5��ńRyBU;�wX�LxO�_FPcrCJI?�K/4�:��L�R쿀J?�(Ł\ck�C�t������C� ��@�)���T$s�J��%M=B>?Y��W�7�9�X��Ѐq6��"�x��bI�g*���"�n�o��agT���҂�~�h��غ+pQ���[�z0�����k��N��ߢ�*i$�gq�;� �%O�/����\ |#˂� ��� ���O�g@�����A��uSeQh��*�_��3��x,�Y ��F�?rz/������Je�7ɗ-EH�����ݒ'\/��R��5�XqMmC�L��Ne��� ���r;,��ɬ5 �,{���gg�UO A/(Y6|��v]O7B�y-\�W��6��M�L)S��X�E��L) ͈Q�����< �c-�eF#NJܫw��q��@����U�o<�������KV�r�<O�um~�fUU`M�+�7i�����T3!��^@|��-w��N²��|<�{���.{�/��E-��x:+?.��9�H�K��~��r�����]K�G�]q����>�;�丕{/���X<-�z!���ʃ�j��({5*�+ƣn�C��a�l �o�=`��!�����?D��-����c&~�Ϡ�%�&`�����8 $��a����1���s��y�H�� ��ܣ��K.bW-C������̄�Y��+0ѕ� ��_��lG�Oc�պp��r�gF�Sk ��Y���F ��&ay�S�+�4�j1��}W��;J���͌��9+�է��(�Ѹ�v�ͦD�����j�0kѸv�=C��TJdES�飮*j#��UO��L��;7p���[�p�Nx#x U�j:��drl�/"2Y�x��`G�����gƣ��is���Z�S�U�3O�:�����Ƨ�����_��*B���������?�L�)T��k��.�8#�"*�iO � �`�*=g��;��L�"�d`���5��Wye]�����x>c�Kt��D�s����|.5B�z�6�!خ=��uS��n�0�� �R��r.���V�m����y�;vJPS��V_�)mGb��E�03��HZ����1J�}��lz�^:H�r7���^ZWF#��P���@1����E16�q������j�w�L�&��˾�������� ?����sglZ �w2`��X1��2��e�#h�帘!��YC�&��J��^�%���)p `��������a�o?>������Yhb�o;D�e�,�t���i�ۉ�V#��vFS�C v�ssw�a+�$'b�UP� ����/D��|V@���`��Ъ,V����[�.�M���.X� Y�<�9)��;Vgg��-�e��I ��� /վ���h?�� [�|@�2�w�l\��o�-���5vz�Y���cv�Vr_�g&`�Q��e�>���r'�抭���Z10�����/^���vfS(�y���38:ۛ���z EDZ}��w����/��=!}?����x���0$�K��;$0L���?�'�Yŷ�1�jH;�ډ����(��.z���sy�>����z�s����Y�u�E���"e���, �m�X_PZ���x �$��s&��������j�^��20 j�y����w�+�}���6�_���d)��"�@��XZ�Q���0`�G)�$ �~)��z�5�[��=��P�8�$�XSz-D(E ��}�3���`�� �������6h6](a����m�l6<����r���؟�UW-f7i��;������=Q�Ud ��^���T�Ϳ�2�5?�",�72ٴ��>�!�x��%K/ ����@� Í�@*|��x�-4PM�mA�U�~G�@�Z��^$��Y���'��%��R����x�?���p����y
Static task
static1
Behavioral task
behavioral1
Sample
138faa25f2e7131b3aff9291e755636f931df6eb3ee3df66895ddc3ce3fdcd25.exe
Resource
win7-20231215-en
General
-
Target
138faa25f2e7131b3aff9291e755636f931df6eb3ee3df66895ddc3ce3fdcd25
-
Size
2.9MB
-
MD5
150c30780dfd5a88b8f6d0e9e8d1a25f
-
SHA1
09afdf08000b31d54da4f498e47d257f57ab77c2
-
SHA256
138faa25f2e7131b3aff9291e755636f931df6eb3ee3df66895ddc3ce3fdcd25
-
SHA512
2b47ac3acddd65d8658f380e0df36f39d31d607980d8c48796e67914df2de6f3f9c838599027fb406305ca3060fc9ac3686e013c4498d0d4711394813f87313b
-
SSDEEP
49152:14dNSjcf/eh5JtN82Ecy7ZgRb/gJgdw4o8RV6Q4d5gVec4MgK:SMcfmtNBytwDgJgRo8n635+ec4Mg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 138faa25f2e7131b3aff9291e755636f931df6eb3ee3df66895ddc3ce3fdcd25
Files
-
138faa25f2e7131b3aff9291e755636f931df6eb3ee3df66895ddc3ce3fdcd25.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE