"J��Sψb&�=_mj�Y�FG|���kC�V�"I����,�ݥ�3������D�������0!�Z���Ǡ�oK�/�a&��'�g��w��b�X�e�n��Y���?3C� �*x�|�����@�qa�#�'�u���+�x-8{�����"�%���v~(��S8��qs����#e����я'n�j'��k-i���J��3��7.�L~�4�UԽkt�1�J�����h���íN�N FS{`o�`�ۗE9���3��>���?o*h@ǎ����a��㢓�������������N�ꙛ�mb D�^klhGmd��Han��睳E}vz��gA[���D��zȾ��Id���H�Ȃ[��x>G"�|����4a:W�����R���l���� *E�����%��1��D�����°=����,�N��^�rS��qO㴭�&{5.�|ƀn�|�d�8S���T����'��q�&��1;�MrpQD�pQ�er�l��S���%� �mv�����('�G8�E��S߉�ܷ��2� �����d7�8�K��œ�\���c�"`ư����^� eu��8�<�|#��ʊ���%��i�@��1�����'��nh�>L�3�J\���UԤ��ɸ1&vB�&֠ɕb��J�B�C��ڮ�"w�����aS>(���5X�� �T ��9�&g����~�Y�D����E�-����wcR��$�m�g�[���E���NE���0qͯn6SE9+<�盫���9�)7o��$(�}�_i�#���p�j��|�q|[#b�����]|�z��ف�D�q��4z¦����E�.n�Œ�4N��Ax�mF�.�*��j&8�եe�T�-��ۉ��5��y��w54�U�s�$-�WV֜�2\��x�[:#��D:�C����a46e9 ��|�tf�3�u]���¡&�~�;Yc�V��sl#�'y����*�_�p��ٽ���r�i�rS~~A0&AR�'%G��nnCx'���_L�;�a� �#V@TC�s��`(������!P���(���l5�i�����swe��sY��N ��ڲ.[|��?����X������[�!���������,���_4ϴQĉa��p���X1����� Bћ�6a�l��4ߣ�Bq� �`G�K�3��Gf(�h�=A���v�)�е��������y����h�߽�ͼ}LЫo�%~/�d� DN�2U�!���#r��@$��Q��m���wM�y�7ꧯ��c����)k��_A[I"%`��aTٝ�Y�Lj���aWr����p�>��X� ��c����e{!�� ���7�~�R��:x> {b$e�WŖ5DC� .7`���YAm#H`����FQ��O���@�*��*\>��Y�b�%c���m��+j�&Y��Cl�8E黈��k����Iy����V��D�g*5/D�����O]���.�������Υ̡��-)�(?Z[�> � -HN��r�xJ����q��Ex��v�KͰ�0(�e�F���B�@�����Ir���ܑW�p�E��N�P���{�"K��3�5���rk�k�Uf\�Fi�7��N�0X('�={����y^ct��B��M!E��<�h+TDt��H�]����A��iN#"�o6I"i) =#����W33:� �$1U��>r��«1�f��^5=�,��V�����q{�Y�KZ}�����>�>����G���CJ4�����(����Yv1�(���h�,�(Z�'�3���ZL"J�J�gh�4~���m�~�����v���4_]�pϦd���r5���.���,��~����uNB�j"�6 )e��j*��Wi����D��ߥ�z�����T��oN�:��� ^�M�5E��w<[� �"+����$��r"~���pZ�ۅL�L���d�D��X��k�������ؿNb��ȭA�օajC�G0UKю�$:O��O�@0�TG��7����̌���N(�<U�� �Z�|RDA�<Q�.���<���+�R�}�qd�������3dI��W��R3|���Գ㑿7�jN�c�8�z���A�b0����=����X�����G�}m�T�����pF�V�y���9M[ _���8r�@J��� =��B>���ٿ7۪i=�=S.�̇Z�� �v˯��N��o�섩?�� ��h.ɘ]�oy7��P��e��V�"���dzG�������!�;��5����F��y���n_���a��By�?�U��s��̕q���8}gnH/�w��`�x4���TC�<Z������%���{�V�6k��Vq])S�PCՈ-�3#�4�y���4�����3����������",W>C7���5���Hyz�&퍾�~��~�*9�����uÍڣ%b��2�5��d��~>�Y�H�R�6��bFg&qu�\v�Y�sL �Oj�̨Q� ���m_ioh2��E�)|��^�9����w6�j����Y��f�~i��̎(����?dt� �408�e�(��^G�Q� ��RIA,�}V�y6�Ov�D������<e�lT�K./���:�=Ž��֝K�('6�����]�������Ii=L6:U�?�JάEf���Ap���w�+6|� �~��`L]+��cc�{Y��y�h�<h ��yZj8���:�����I,k�o/^ _��Ն"�d.�(_pµT,�;o���M��d��<�ݒ�rtV�Li��g݈i�6?��q��\F�=�Z�]�h��x���LN���8�1|�{7�%��ViV=,PVV ,t��1����C��q*TC���3N���@�X���(�Z����Y��M��p>�N�]��#�6Ut��@�2r�;�*x�姫�Sk���t}�%�R��f�z�lPKur"�W���Bnk]^K���Sr|kJH��^��gzw�dq�_����|��k%!q,�n�sE��ҝi��$���e�8�.�<F��ˀ�P�E����Y���9f �#,.�Z�� PT?=|�����c�u9ʀZ�iNȖ8����wQ�$i��@��H�3C��7�:�����^Z'O�
Static task
static1
Behavioral task
behavioral1
Sample
b1869b167184357526b213a143a28e0806e5e3b454dadf623fe379b881bb73e8.exe
Resource
win7-20231129-en
General
-
Target
b1869b167184357526b213a143a28e0806e5e3b454dadf623fe379b881bb73e8
-
Size
3.0MB
-
MD5
f87bc6346d76320709818961cab0aca2
-
SHA1
d2d2853beb6d32b448581a546466f4805effe571
-
SHA256
b1869b167184357526b213a143a28e0806e5e3b454dadf623fe379b881bb73e8
-
SHA512
acecabef5e51152cd0263bcd787baf71ee749748eea208185dcb26a6b68dca8a2eef293c43418ee75241264fc41c583f6977cb8c5db1543efd323d48887c29bd
-
SSDEEP
49152:rZ525/i10iJrykHuPoig/aciCPMey8J6B/cJ0pFbK5S8u9nMFQg5y7/lr3sR:rZ525610yGk8m/5PpJoy0PbKOBe8/lLC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b1869b167184357526b213a143a28e0806e5e3b454dadf623fe379b881bb73e8
Files
-
b1869b167184357526b213a143a28e0806e5e3b454dadf623fe379b881bb73e8.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE