�:�*y)�2�J/)q;�KmT��6��NGt��������U3 bY_G�%}�!8� ���v,��*�(p���W��H(8�A�5�����zԚ _����]�}����/w(Z����Vah��p��� �z[�[q�<�������aN. L�����W�ٷF��4�� �3B���to��뵱S66��|�6�4�l�U��o6U��)e���kcF_;~֧3�uY{������IT[��{�5 do�:".�0�U���g�Xr��3Q�M�5zۄ��+�s� �UA4O8&ڀ6�>�T�I���%��6\�b[;l���\Ġ��ߤ�$�e�7}�t��vPS/�[�:�ܛ�n��\��1�8K3J�_�����TE9�-�#)�{�'��-1mb�щŨYB�p��]�\�H+���ԑ}G<�3�ŤX��t���=�@��Royc�H��_�mU\���uY'�=z���^��?��UB���¾�sp&_L���3��HL�� �oo;F���+k�C��K�)Ӗ7���C�r[߯I�g���'����.Ŭ�[�|,>��$�8X�H�"�u��a&!�կ��ƫz�s��塊^��zՌwM˓����T��X�k�0�����!���R�d��w�rQ� �L���w��[ɰv�����Z��0��e�N8�.~r���.��N۽��j �)�\��nsS�X�Jm�7Z��a�BG�� �T����l�LZ"d�]������'�U���R2����8������D�����@l1MY��l�v�~D�UK Uֻz~s{��L��g(�ʌ������9����FZ0��ty4T0&���I]4� ���=����������J�!�F��6��\�AZ�vxArּ� ���$[w�-��6��|�B�aGHV��5��cĸ���l���j�>$[b���g:��a��X�����b���B��>����=�����9r��(9�_��\ �'�]� ����T߸�SN�c:���D�5�/�{Yd���/7��Q6���73AמՃ��rغ���n�9��X�w�"�Dσ`������nXD2��rܛc9��W5p�"z�D�Qc�(�~̨@��'�.4U��e�ZE%@����Qv�����%��S�v[njG��6b�4b�5&�C�l��B�q6�E%�ύ�K����l�r�p����o�< ��R��R�=UGCSw�����uȝr�0V�Wi��l�zW�/���v$}5��p~� �ד�=���79�?lS�ng��uW�9#fa�#�%��>g�+᠔y�G��tʵ���&r�@K�M)�H�� m7i �T55wN���zO<��X��m�gS�h�<J�%۔��X��Bc��ԿՇo� ?����D�)��ߍ�xr3�_1Zj��8`bC�)��t�n �8:#-U�*����0���h�-�����tA�X��Y�1ۯ������b�"�{y��T�ǵC�q?�ͳf��>D����y^X�J1#�LR��u��h���j�E��-�iK&ŀ������^nH��u!��Z�Jive|���A:��M�K�����](���U"q�(����=s�~D�h�=��5�.L�r��3�g�*U�㨾��虿�ߌǔ{ad����uf`���K���"�|�r>v�y�z��IY��`�־��E��r�e���-9�^кz��4ݕ�?�C���ljD7e�i�L(���?�M��qB� �;�� uB�%�{�����vɽ-�����������'�0*���K�<ꕙ���D\`���J��S���VWJm-"V�C*۹և�s���7^�+0Og�tE e��A�{l�h2�n�n��:y����{Xn��M�"���gh����S�e>8+�X�I��<Y�i0�5�k� B��g$�9������K����-�E� g��Y�o�s�8��]z+�K���h�tn���IH!���!:&��'���p�T�*� ���@��V���2^S�b��g]���u����7r(D��"/+�M�FͫB0��q�,�e~��4v���f�e�������Y�Z2�nw_�˪g�f���@��i��@�)�/���7B �l�PXvOa���iH[�_� R%eZ*D�X����2Ãf��2щV���ҽc̊�ɲ-QC��9��*y����H�S�|� _�ݤރ[�f�2����͏��s��9Eq��� �\!�A� ��u�W�"��q�����pr�'��F#��מC���y���TuaRp�=*��⾇3.�JDM�a%�!G�-�^8���ф�ȇH�L���xd��(��A�s�=ʠ^�hJ�V����^�ղ�Yx��8��7~#h�\�`��mdB<�MPZ����4\��/ɪ̥_�`ؽ(�n]�&���Ӝ��j��*~8 W��uW�� �M�ȓ:y�#:ң.������(�R�;�L�g�[̰� ���j��*ü������͔��m��~��d��� A�b���]"|�`�) C/%qƄ�OE�jI�U�3���K�f�q����d- )>���ҩ܌�j�A:f�,�mK���J34��/+Q��3 ���h)��H�!*�&A*���W�X�D����>NiS�IvA��0�3�-�^�]r/<:����~�[�;V[U#80�k��c�-��^Mw{�殥<X�݀)lvү��ΕAu��r��2Ge0��/k��b��I؞�[F��AH6��nt���yc�nT^͡�s��F�,Ht��4�]�.U�@�~a�n��ZƋ����:r7�W�qW�L���=�������Z��W1)�� �!��_�W�%xQF�Re�)�Ha����o{�T�g��>��ӏ��2�N�π����}�uNΎcw^/�'�����}�n��U���Wͬ�LW��-E�*$���S��=]�A�70� ��U F8���X�9�Z��W٢��!�� ͼ�PSZ� H�m�ё??�F�����lk��r�Z}d�z*�[ ×�)�["�F�=��.��ݗ��M�a������S���n3����ɔ���ʡ��B���ZQ��Е�`z@߄�U�&���lܟ�/�i��>�s��*b<�{��Ma�-O��Y��ȯ�:�R'�@12@�d�:Ή���ȷ\3�|��=���ʑ�������r�=�v!բ��4�U�}g�w�Od�5}�B��9�,���5�A�3��lZB�^����{�n5�vKVN��3�PgV{���B��ԪzO����H���Gg9���#]�,�p"��c[�pp�G�]�������hO��Ϙ������M�1a�s�bWf�^��'���}M�,�̉N���H���g�w�Z�g=�3[��9q��
Static task
static1
Behavioral task
behavioral1
Sample
b41c3690bb0c2eef16bc536cf710a3780491bc72aaf95d8439b43cbf477381fc.exe
Resource
win7-20231215-en
General
-
Target
b41c3690bb0c2eef16bc536cf710a3780491bc72aaf95d8439b43cbf477381fc
-
Size
3.0MB
-
MD5
01f0b7a81a7725fe9294eeb2c5855798
-
SHA1
d5258db4222d74e1eb55ede233e241f9b0c40c43
-
SHA256
b41c3690bb0c2eef16bc536cf710a3780491bc72aaf95d8439b43cbf477381fc
-
SHA512
a9e6731784e3b922f1b81a57f3500a5586381542a8359df8b2c223dcd7a338e0474df4a3d8696f6ec5eb179d5986154700817cadf56019b78e13808022582324
-
SSDEEP
49152:2JxBmA7usskIysudgShRJHz4YGiEn9h5URbSpfE6allQ+F7NFs6g2:wmhssNysudJh3GiwEs3UlQ+F7vY2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b41c3690bb0c2eef16bc536cf710a3780491bc72aaf95d8439b43cbf477381fc
Files
-
b41c3690bb0c2eef16bc536cf710a3780491bc72aaf95d8439b43cbf477381fc.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE