;jG��0�{�zq������'塀���T|i����3G���P�w-�C�r�Ƃ�4�6݁���ɗ�53 �x,0�S[��Ko����T��sfP�����1"uk�TV�3�����q��CP �y��8yP��;@���ѧk�=6K�`��y���"��0�:M#��V��6�:ibWt����S4S� �-�mߛ��\�Fךq��܍D�m��}��u����ʦ�5���S��_r��4m`�c^�zC� S~�aኄ��a��F��S�< ����,s � ���[NG����%)�9й���e\��E��%Ls��ɥ���4�[{���$�hW� gl�Rk��lX%S��������Ac�5StH�/��E]P����s����@���( ��/-��A8�r]�ת���2���[�հ�=ȭ/�V��Ha��7��A!}3�r;ᠯ�Km�tW!�Mc��4T�9�R8�ܶ�b��K�ANZFͩ��R�q�T���X�_�V,Y����ab����6M�m�F>�����<�;�Kl��F'Q� �@.��!����$� Zӭ�o$��)���I1ec� ���B��Z�Ⱦ6��� ����h����7͖�o���@�Y-��eCYG��x}[u�(�o�i��.�f-��-������%����+<��Y(u�զ����ON~�b�vD"R�}x����aC�L��_zG O��C�����O�����awtU��=c���kR{Ņc� �h��'�,���T>i��2!riB�M��|YM�Ԓ_�@5���$�(U}����i�A;�<��-� )0�L��F����4���c��ۡ� 0����&��ag9��ۼ-7+�'�8D7NS������0��ݞ�^E�Ugav����~B6�X��Pbv�݅��b�ʣpQ�.ZP��ހ�mM=[�c��'�94�Q�tR���;���s���5~��6 ��;*R��?�̫���eQ��Zl��]⃖��AV-�-���%{�mLơ�������j�M���yb��hU�Ųl��<����w�!��T��H)��� �į�U:M�Wά�ʟU�'�d'�3�{:�3ҝ`�)���~�^��ƃR ^'�,^�ե�}�d9��0 �-�@��6Jru����ڛ��eX����mبX ����^�xH�Z$h�~M��UD}�#N���4����l��zu���zl@,�������q��5P�k�����|�d����2J�w#^5��ï��02��sI����#8�c,l�I3��❇��,ʩ�e�u�ӕٰX'�ot=<�Up_���X���@�W^�!qgo9@lm!$r���ڠ�rQپ��X��C�(N�G�oF71��:#�<��5�y��є�v�i�'���Æ+��cW�QH36�����+Jz��oַ$�V�))� 2��%�@�6��� pk������{����N��;���_f �ȪY7(J֯�OnL�`Y�pP"��:ƪ�-�_R���e���_5䞶ƣ��R�}E��bؾ�4�t��zfm�O��oa��MӴ,d�=��dk{!�8��}������/����H �s�y��5����J�Q2o2���=7�����N�����M�c1QNKm����A�b�j��:�5}9�@�{m$�-Ř#��~f%��(m'�.$��U]��� �+^d�YD��|!�h�D�_*3#(��0���;@$�FO�Ey��8^#Ehm.l�L;�6��3���9.* 5d8�����x��S.d>���������3t�W�4?=���^�Nk��$�^&��@�!���}ci��KX�7��xIi���,y����`��Zf[�ƒE��s+r1�MO`��a�Ti`�~�S!�3�oEd;#A��ж,��Ĩ�Te�!��6���a� 8-q4�����[�L2@��Hp�b0����6V�q���kD< ��Rxɽ �����NG}|l�C#�x�(D�Q�=�>�������F[A{���u�*\��D/آ���z�z�sE)_A1�!O[�ǜ/�� ^g�� �3h�kRov3[�֦͕�ԝ����d��4X��tVB �\����ь������qԲqeb:7��ٴҋهH�;b?����W �_��s�ۥ��Nuo�� ������[ֻ[/R��,��P5�)����lW�B���,�ױ���9�TF�+lج����3���GE�/peE{�9���-}B��֛�]t�>���z��-n,�E�U�����H��6?�1����79A�U�� 7�ğZ�@M�'l���h�l:���,aϏ�J�1�-y-��a�bw;,g�MO�t����cP�� j���]r6_ ���}N� �+[/!PR'�-(.�$ (��Ee1��u�������X��j�}]T�C�I�C��օ8C��h�M#ߐI�T�3w?�l;.����V--u2��eS 2 �tʚ[;縪s�{��Xx�J��-m,�������j�eZ��x*�)��vD;#��祪hw㐬s�����w��'-Sԭ��kZ��C}�(3�.]��u�3�?_$U2��6�V��q�j�(�S��з�v�œ�5~�>ʡ��� x+�V[K�҉��m�1A�eN����m�`��躇->N*d�����S�ȹ&���3���NṜ���$�ݕ,���8p��<r���}�1��/�Ǎe��K��ð{*N/NI�x��c��F��E��N���� �:M��2�`���,Y'�2�^ m�CD��ʢ��y��@�����o�ơ������i_"�;��S31�m:<>�k&�s�-��ÄM�B^ħ���8=�J�n>H6�S��-�m���R����!U���ܧ�ٹ߱��b�:̿��`��W��2�F��X(a���@��R�_�V����i)�\��ɏ���.�����x���#��+�cveH�ej#�&+�3�;H2p��1᳙dF��-W�""�����~^���'�+ܯٸ�6q��\_fؤ�Nu��>D��S΅S7��I��� +�*q������/Z$Ç����I���xܝ��u"��o�u��?y}��J��1�H��D| ���Y��|)#?��Q4��6�~N��Z��+��1>ז;6�F`24�ʲ��u�ӹߊ�"(�QTI� t�S�J
Static task
static1
Behavioral task
behavioral1
Sample
31c921522fe96d1bb2386eb76a17f28f84a28ba6aacb45a4ea18730648e1fc31.exe
Resource
win7-20231215-en
General
-
Target
31c921522fe96d1bb2386eb76a17f28f84a28ba6aacb45a4ea18730648e1fc31
-
Size
2.9MB
-
MD5
91c9b121231997619038e1fef4913c31
-
SHA1
04ac978085c05ed8f8f1f93102f163d1739d9971
-
SHA256
31c921522fe96d1bb2386eb76a17f28f84a28ba6aacb45a4ea18730648e1fc31
-
SHA512
f40ed600c91899bb9b223bd53a4d220f1e28eb8429321a89abfc3d00f621591f9a1ede513a5f6471845718540f33ec857fd702d54835d1e16784817a55b712ec
-
SSDEEP
49152:DhttTgePYl9kc6YfNmaAC0i4LEgtEIqrnhoiwTSk/FJxc9pdJa2:FjTgEYl9h6YVFAC0F387hzvkzxc9p
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 31c921522fe96d1bb2386eb76a17f28f84a28ba6aacb45a4ea18730648e1fc31
Files
-
31c921522fe96d1bb2386eb76a17f28f84a28ba6aacb45a4ea18730648e1fc31.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE