����R��85��yݻy��5��렓�my�8��Yn������a4R.�?�x9������H�c�9��!�B���:������Rǭ�0��,D� �n��!y�C/u�����6e3#� 6c���N.�����X�u�N�?2�w�i:pWpel.��U�κ� 8�i̙9̸v��'7Y�7��U!�{zS�!OPj��pn�:�!�6��������2��7��$�<([>�w��xw�=��F�Kp�R5TT��ގ5����#aW�Ւ0���3�w!r�ȧ�����Hy��|h�����@�ЉVm�����Pˍ+OЦ ����!h�06 �����i�p`����� �� m��!�=k6R�"�ϛi�IR�=�"��kjB��`�~Gb;��Ѩ�5Z��%e�^"9O�r��X-�l�{G��<C��������ԋl]M�ވ1{�;W%�H��[���R��iK�*��e:I璒w>�vH*4(.-�n;{�E�U�ˡ�2�|C����q��jLT��#�ܔ{w�P|#/��+�ӵ�wL��|I� M� -;����j��t)�)�h��A�y\渲���nw,rj��d�KL}[���ձ��W�?�U�J6OԮ�c�VO�gl�����'��߉%};����V�K����i�)�,�Wlt�O lu$)��3F�L�V�L���Fd8��R�I;M�u\9SCp3�l������>�%���5����]�r���^(��U$�Ӹ攻s�l�S[k���[#h^�'�}�-�)�%���Dp0��&�5��w��mg�ٮ��K�>_eþ$�ajJ�����t� 'z��ψ�Z8 :;��e���ǯ��Q a�[w��i�-|��f�s��5~���:�3����F��� 4���T��%�����G�@v���K�m��-��x��O��B `�y�v3N��y��xᲓ��S)���"O����8�KƎؘ� \{7��y�$!��@ h&ΰ^�̈́~����,�߸֘���{��&A�=�S��F��0��kM�t ����}��(��^� �O1�2����W(=��tj�'��A���/���}j����F�E98���)Q�@�I�S-������[���RlvY�b��-x���X�K���P����;j�h��G�KXѦ�0��8����#�aDm,j�%w�0,ES�M��s��� -�8��Ji� MO����Ů̚-�e ��X�'avll�g�4CºF��(;ϡ�$�ۡn�b2ʒ@����rć-�:":#� PH���O���l��l���z�Ze�C�v���+��ap���D:q�[�l^;Bh����a2m� ���1(��k�5Dp��i���P<IL�nH�c�eo;������71 �Ua���0~����䇉�İZ�]���{ŀ�����7�sl��Ra �� ���8TC�q������G|��q9���:d+�u� �{F�!�@�M�]�u;�%������y,Џ��^����������BdF"�M�LO��J�5�l�]��E�2��Osvv��}�ȼ�X��e�.�y�Nw[�x��D�`�'�ԣ����ah�`�1tr�&���<+^=�Y�':a�La�f?7m��j�n�9>�%�=��7$G��o�Zw#DRWC�d���9�ֈt�B��By�L�7� ~lӍ�itFɁl��D]K��^��=��fL��&~2�[��ewl�}S���^Ɏ%�����\#��~6:��/��1��F���\�քr=�[��ܪ]e����.��c��'�� �v�����l����1�R,8�~`��)p�I���C)}�LS���]`��/4�RkF_ W�&��B���Ƥl����p�:���.: �����_ۦ݊��W+t�iAA���G�X��؇|��Q�~���}J�M+�x�jS��t���:$T~�T���}a��R��6Xp���߾o�U�1 �%�f�~��)X��o)��~\�˶��M���`�>kɡ0��5���_sH|8zwj�eV���͍�0�T� `P��>*�G �K�������f�|R�'%�T����S <b��ֲ�O�U90d�g�?3B4r����~^��b,�I�u�z��"���/��яi��s�g�.�_��+tf��q��B���H�)��z{k���{���� �X�����oy����#�.���($�:`ʯ@w`���6�ר]6��i�uP��Z.*�?��}{PG�bÊ,i1��/���{����V[�~���Т��л�<�#�o`7��a�xΡ�ݚsmW���»���&�r��kV�5D��������H�x+k�� ���m����^�\����F�ǣ<%��6�]Ĺf��M��X���aQֺPΕ��'��זAf�g�Ќf��+JYݼV�7~���殝�ܽiD�P68m ��Q���9��^���)\D����Co���Ԙ���re��9p�4E�\MۆxN��� k-�{ `���ys6�Rf%�0;�\^w��H�A k����,bk1��;��GK��&N�3y��e���B(�r�����aKІ�AU~�h�*�A+�\��"��o�w]^��H�h$qb.�}�BE���|���ݶ���|�\20�p�w{�8UR��;���D=ߒ��%��sU=������%�s};���� .U�'�Q�I8{��4�_�v���ĺ�_˂ڄ$Kᢖ�&'�9&줰��ӃBPOn��j�4�8�H��&eX>� �����K��EX��a;ș!���jL�:�$�SeP�He_���ƙ5Z䩝+���t=!�6P�E�9EY����d�5����.G�ʸ�XF��(��z������o5w��?��(,�;D���Ӯ+&k� <t`C|�dBd���-� �φ��\��r���h����Ȯ�0,�i���w3mk�����#{d�9;|����&�"�������0XBw���QK#�p�ښ5ԚG�x������XQR~�';�Ƀbi��U��+j'B� c�Zb��������Z��N��M:��A�)O��d��zU��IL;b��!5ļx �3� ��m4.�]�gIH�`��]iJ��D�`��-��LÛ�r�����\��u0c6�ݎ0�t���
Static task
static1
Behavioral task
behavioral1
Sample
a3b80116703bb82d1a163194b3185c51840db7c39d6609736b9cf8f468c7e11f.exe
Resource
win7-20231215-en
General
-
Target
a3b80116703bb82d1a163194b3185c51840db7c39d6609736b9cf8f468c7e11f
-
Size
2.9MB
-
MD5
f3d9f891a4b9e22b7607572f286ca791
-
SHA1
db47f03d2c5c7a3fddaeebd21d0240eaa9031c24
-
SHA256
a3b80116703bb82d1a163194b3185c51840db7c39d6609736b9cf8f468c7e11f
-
SHA512
e3ac67aa4055fd40fd44c20a6f17f5be6bf3d3a73c52787bf997513d0774ad5f33c0955eb0cb2489615995b73692f8a608b28135c7ddc27e0dfb64fc6a647067
-
SSDEEP
49152:YvR/N3eMBP1881I2z97Q/0f3Leaqm/ulexf1RdCu10V5qLRtqyCnkZF4s:YvRV31N71vhM/0vLeW/7nCu10XeCnk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a3b80116703bb82d1a163194b3185c51840db7c39d6609736b9cf8f468c7e11f
Files
-
a3b80116703bb82d1a163194b3185c51840db7c39d6609736b9cf8f468c7e11f.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE