d(gsC�ȋ���o���������.MVa����_�={�Wu��C6S`�/�!/�cB�ɍ{ ��X`+Œ�"X���8�a�S��3j�5��K�D!,���1����!��\N�lm>���������f3Ls �^W�ؑ/��)�����MU]�����H��k�K,�U�:ɥ*��- 3�h�l����������Oq2��A�����U����A���㈨_���>$a��a]4��܉W>@+Hu]d?퉚Zφ%�?�m? ܔ͚xի<�ٷ٦$=i0���վe��| o�l��A~�]PD�"����l@���Z�M�Sr:�� �)HM�!�L�c�K(�ŷ���֬>��]��:�ҒP�H���0bnN0��]�m� 7� ��jB2��`u��*x�i�˦4��u7��3 "Q��C|��PfP����$�� ��t������gМ:{�ʈ�+���n���oÊ��䮘k,���q��VF��RTZ��������%�"<%��(.hѣ��KA��#J@�����FVv�."������L��HV��k�H>����A� ��u�v J����u%�D����(r��y�q�0���d�lL���|�G����hh@�8�w>Փ�͵�)3��z#�q�~Ev̹�VWܪ��D�A�^h� ��ӎpڂC���������9�ʊ9f�������B*����X ��N˳0���Su� [q��cK� pj��N��4z�T�We"�cM�$\wn��;RM��R92\���K��8����4؝���K�u3|�v����XB �ޘ���>�%8�ʪ�(DE4~�,79������®���$��Р9t�D^Z)|g��ph�R���@�t͍��Ќci?�]{ o�m#��>:�o�e��N�`�݉*_c���`�T�p�T�ڍ��'.'����.ԧ�u����!�[4������v�D�b�vw�T���lRTX�Q�0�����}�nnG���P�O������JC��D0�.�k&�C,'���\f|����j봸�t�n)�-��SF�}b#'��/���ޞjf�錵���GR�>��}[�B4� � �������Ʌv*��<cAo&J��:��<{��aSH!s>��)��K�?瘎��x�-N�1������t��u�� {��-���`�gkk�{�$��6�Dn�I]�C��/���;<I���&U`�O,����c���쿒-_KZy���u*�����Dd���1 �u���dP]��v�K�����bh������0���{Φ$gYA �6z�8������z@h �K�,�t��*zQ����(Of]#����2�f�\L�� Ŗ �Vl��w{[<��P�U.�d���&.��zv1�g�� ��|��}2r�l���n�W=w��5Qe�-<��9�B����J���(".JP��SvGIJ".%g^<��DHZ·�z��,W����z��q��._���٢*���X�4�9���f�P�Lխ�vES���A�s���,�x��=���\�5XZ��e��]_c� ����큵7fܜ�w +v*2-v�л��,c�Iq��e�M��O�) quq��堼</�ϓY4ø��9�]�~l���C���am��'jL���Vs�9��;!��7�ء�Pp7ɱ�܍�$Q�4������L�P{!/�J0V�`W��,A�w{;�w2M�b��h��;Y���F����8� H���3���Ep��b�kȐ��`����Ƣ��`=�{�ƕ#��kgg��"��;���k�8����i�ݳˋ=k�gh��Ǻ'��-s*n���N�?*XE��aWc#-�����C{/�v,��G����(�̥���_��^r�j�nA���$7q���mVm�Sv�|~!���~�S�/�~4P�+&�S���Z %zĖ�ׅ�x3�R)����jL!Au�t�*lc�0��m����̋|B���*} �uk�վ��2f�f$r���Uo�S�ù�2�_}�oAp0,%����-�i?! �}�p`,v0>1QO���E�x�/�YIs�H�]3s��A���(>9��E��35��3��65���;�_c��B���~��c�˅Qn]K>m^ڎ��+I���q�7��nټ*I�h2,�T���p�����m��/sa�r�4@�p�"�̪�V ���v��yڮ�Aw}����� }p��˭]>%c���]!_�^/{b������#-WbT`3 M5�*��`�To�,m��6�_�<�֙�(���>e����1*��}�~�s��(�^�8I��+�4�\V��{��,�-���w|��d`_������#iځ,�_ϳKVbM�-:��;��O�c?"H�o�K����fLJț�08� $ܟ���K�Rk*K��ӱ�����F��#A|�ם�ׯ�7"_�%M5������f�!��h^��U7A���ڶ�yg��>D�W���=aOZg��C�� ��I-0�3b���]Q$\�2/�Grj��J��ܙ~!�T5�M�.h2d%J���Hs�Y��o�{����.$O��yC�[m�C���2����7�GŇ�9���$�&�������]5_��$����� �ͭ�AV��W8��:Ȼc]�'�J#�/����H$s���Z*���u�����Y<6��{TRƠ_�мC�G�h Hq�g����!ˋH�Z�iCg��������Gdz+�ISs)��^?-��*./}-.�c���[;6��z�$Uj^��{Yf@ �<&�%�f������e���T��Z��[ ��z���Q'nƪ.削Ȱ4�ײ#���b��1��q;h��oYtF�|ɾQ��0����6"L�\��H�H����~��n&��1�ѤB@D^Sc$|�9qҵ/��`#VI� {N�cFR¥摲P�{��D=#��4G�̵��b����ϴn��ڟ�`Ѐ�1���s�j�~�+%S�S.���9E;�B��TL����:�ң�Ty{LS����=��[A�}Z��l-j�|8���F�?߇z�X��Uh��!��̣y�ҁ���@�9������.��r��J�x������G�t�6�*�tj�/܋���x�u��6_�M�#�c<��Ibc�?�`Ƹ:Q٣�)� ��h��)s\\��k�m�㚳�q����q�Cm�����W�X���1�H�ͯ��1o&��yI�!�Q����h깔sj[�) 8�OT5J,o0Pv=�8�"Y~(-����v�;��:-�5,_\��S��8F�p�n;�����Yg <3�3�O��j��\��5Aߢ% &�.�I>Ҙ�#��j��@���wR�y�+��k�)5��2�JJl�9� ����ZtY�G����"o9a%9���9}z�a��HFSX�����bi���*'S�`Z��� W<���A�����Z<gI��T=��ƣ��Iʟ{D�ש��,M�pвi��1k�ujd� �ݥ�t"�=�6��lA�[�t�L_2��MK�vz��]�V���@ p�h�ʀd�C�p�B��^��^z��aWJ6>X���W�1+���MD >S+N[�1�s�p�JL#,��G�`�t.�ti����6���gs�9ˆ��|P�����NI�����i��S�8�Vf W�G��R���X�.F�h
Static task
static1
Behavioral task
behavioral1
Sample
023f6f8771bd8b57d86072b2d8d0d633b3253a5eb571349966e5d7b79076a02c.exe
Resource
win7-20231129-en
General
-
Target
023f6f8771bd8b57d86072b2d8d0d633b3253a5eb571349966e5d7b79076a02c
-
Size
3.0MB
-
MD5
a7af982f58ec4d0997517d89b18d258a
-
SHA1
2d57d90a1451de24f72bebdec64787a89368ee6e
-
SHA256
023f6f8771bd8b57d86072b2d8d0d633b3253a5eb571349966e5d7b79076a02c
-
SHA512
40780e4d5eef71d4dfff6fbdcf0d572c804278e5c14b804c31fa25e1d4a2004882f1c866f085cb55fdaeaf09630e8e6c2ede2f74983c254cf7692f7902ea0d37
-
SSDEEP
49152:Lv2gQUuZYx30TiYg30LpVdUvyYFmne/GPqZjOcyyyi3ZoPFTJmMuoNnjUA7oVdqR:duEZtuVWvyYFYe/GyZacy+Zs9LBhn7k4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 023f6f8771bd8b57d86072b2d8d0d633b3253a5eb571349966e5d7b79076a02c
Files
-
023f6f8771bd8b57d86072b2d8d0d633b3253a5eb571349966e5d7b79076a02c.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE