�tv"�)�W$O�O7�J�v:�mP)�9�?�7e$4�d5j�Q��ǩ:0����ۮy�z�%̹��j�KJ�ۤ`O����J���B,�1ܨ�|�>��w��8��⊣_���Ə���^��*��^0�� }}�Q>�������R��x�e�I3$�� d��t�mT��.-%�?�R��-���m=�7��629s�� }=�������q��� CvS�3`p=9����_���9䚎�[�t��0v�٠R\�[���D��X,& ̚;7i�A0��) B��IO[�\�#�q����G�)k��N|�@ l�M��$�%�h�r=L�zNU�ϛ1�^��4ߘ�q�|����>��|ێ<�����b�0C�9<��+���7�y`��SN����[2y`@7y�C��ԡ�x�ei���!��tSA��n��>��#R�{ ИE��e7��(*��[�R�0T��ʏ�9t�Rl���a�ȹ�9����E�f�����vK@��0ϕOu����tm�|�0�]����S#-0f�"��{K,`����ˬ��c/�EFӌ(ϴ��^A����ߣe��\�܃������XQضY]�Ff��(���� �p����k�����b�Vu�J�0�2�,���۟#f�2Y���#�;*��ȿ �u��d�t����L�E����g����4̪!��W��&��$�U�2�f�1��R�c��vՠ��[�h��-�R�b,��.���m??�|e�H�����S��}P�"�f_�:v�jnJ 8�Z��NͨC??2W�@�BHR�x�"�������Q�袶x����1<Ҋ�1/ۧ;�۟�����#��,���(?���:��]2G.��N��y�bf�@L�@*6A���'��Ȗ���&��cL�r)���d�B����}o�a�h�A6*WT��i����k�A�����Ӹ5@ވ^M���:tH:��F���F\�z�&~�S#�K9�#�E�N���.��Z��p}[l�m4�a�qY˚;�a�_�1��� �#�wp�x����<��9��B�6�?����SJ�"˘t6X4���nT��S�F '# =9�O8���K�$Ÿ���K�G�~\'AZ\+��� ��C��3��foipk#�S6��|yyȉ�@|2��XmN>,������dFYE;!QH,�DOOjt�4��Se\@� ��?�>�IY}��Ho���.FU�Y��s���Y^;IF�a� ��m�-��v�"�u.���kLjYm�Ř[Kk*`�'�g��<փ��=���3k�g��'��P����������ԩ�,��(���-��XkeG����8娱J���\�����m^�4G6+-� �WmC1l�/��Ec���d���Q.�k�0�TpV�6n�k�,`�����o6��z6,�+�Q���� Uo���j豅G���p�v����:fݓR�L?쮘��uC��E��Z��?�����k:3�a��|Ͽ��j%�������νAHy�x��2�=CD#�S�2Gf@�A�b�h.�'Ry� C4��>��/&U�-��iUب�����Q9x�DCM��V���&8x��� ��G��Ch����~�Fߚ:JCs�,ϭFO�i��mL���ϊ��3W�s�,<�q��G^��L��$�*�c��@ީ�]�zGf���W٠�ѧ��H�<� �(N��^�&��P������N�̈:����4Bݮ����;��O+/1v`E����߃Vc�����Տ���N����(��VHe" ��zJD]��%˶�����/��g"����S�&��.͍DL�oz��a�-���g nU�z�s�0<�}z)h A���<��� �6�9�����|&�/e$�r�Vh���T�q�n����Ń�ߧ?Kd_L��қ���&_��U�)���� ;䨩��f,܃�3ẵ( N�9��s��Ɗ��٪s+�� A,��_`z�mt�e��-:��r���2�| c�JQE�����a+��z��(%a&�.���ex�~�9�o�@[�b4à��*7�^���+^u� �wWL���f�ـ��X������6�gb���j����:5 ���SCU�4p��7$��&2U �R�K�����&a�L��A5������Z2� 2y�7V���_��:*�b�{{��𝠝Wd|x��$�L��S�zx����2C���WQC$)�o�N�{��w��d��.��=Y�i�B�Oֿ/>�oe,���y�8(��t���|=���} �1�X�IPe����bӺ�U���]1@�T��$�^(����]��I�_6�xb�!�Q�J��H��c�nKy@c)��'����?݄�`�!:Q��� 2��~ 8�R�c�h��P[���&8�1cB�0��E�2K�� .����dā����e������P;� ~k"��q7�� (?���?��nBPJ�I{M�;��W�ju��i�����K���K��f�Y)E��i8#�朹'ob$��o}����K�����V��b����3N\2ߋ�R���xX0T�I�Q���TӚ�Gό���1�a�d�]��lp��d�'( ��^��X�e�^~mh��i���[^Ċ��Pݫ�t�v�Ib����={I�����9jXV&O@��x~�b��p[5�=YW��_@\��,8r�%�A5|����W;P���;�n1J·ϼG�Fq�m##'�y?��Tr;�sݶ�wǓ��L�u�o�z�#�F4�/��bG����7�l���yM h�ke?jC�3ݴ 㞢� ��P7m(�e��n郁�lyH����4�@���$��s���DǴ҈F1/yA������������������� s�����d�V����� ʎc|-l���g��\Py�V�|�ȓҪ��$.&?����X��.��Ѳ�sd�l���mj� ���s�w˼�(����꿛���[c����M|Y!p�+You��7��w(����<+U�n�1���␑�ư��|&:�/á�^3��~ �!��iЍ5���L/{0�l㧄X�r9�(��[,�����ȌKY�����q��`S�8�.������¸uc�w ��"J!��f���ÿ�4���O�ϔ9�@
Static task
static1
Behavioral task
behavioral1
Sample
5795e176d0b4ae0949d649ae030a4d12a30467ee4bf67e7d306bd1e1a111d02e.exe
Resource
win7-20231215-en
General
-
Target
5795e176d0b4ae0949d649ae030a4d12a30467ee4bf67e7d306bd1e1a111d02e
-
Size
3.0MB
-
MD5
4220fb27004166cf928b2cb0767f63dd
-
SHA1
0b5a0d545369b90175fa5db81a01766f5196b6e0
-
SHA256
5795e176d0b4ae0949d649ae030a4d12a30467ee4bf67e7d306bd1e1a111d02e
-
SHA512
c135f97729f6a29b9fe8d3c9f911be9ee961394c5839acc02a216ab1fdc1a6a6a8c9a9dd07c8c5ec61cee5e38333dd5f967603f53f1d9bdf8da125e4280ed41f
-
SSDEEP
49152:2aqJH9CaZcGaJdCIV1cJAahRh3Ncs0+3rPE0ybm3+71HijsQij+hZMolYGj:2VdCaZcG4QY1cJPhRh3Ncs0W7Ezm3+he
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5795e176d0b4ae0949d649ae030a4d12a30467ee4bf67e7d306bd1e1a111d02e
Files
-
5795e176d0b4ae0949d649ae030a4d12a30467ee4bf67e7d306bd1e1a111d02e.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE