�O��p��ȄS�:;��V7�б�Ǥ�R��q��f�B����B^\_�?m���(��ߘ���^b�.Ġ�7[�-̱n�ٰq���3���A�D=�E�&ǖ+tmSt^?R�g(>�N�lf`%X�T�Ǣ^���=9Pn�=���b5p��s�-n ʵBfM �#�C��Bp��H.��gt����J�9�^6�V��z'9�OxS������+~�N�zy]��q'q2L~R��u�g~Ҽ��J� �k|��i����8�.��('��r���'xUD��#�l㽲�Q�tO�)��PwB��@b<i:d��_�J}����_Un��G��CCDᮉ��E��\v�ߧV�R�������]K�Qr�ѵ���-R��=�p�3A��RV��i�b�e��rڊ�5F&kA� ��"����l��m:@I.�����j�*��W�u}�\��U��K�g��D���a��P��7��^l �K��Ma��XOKs.�篴���\������\ݣ4�B[ ��2��Y U��[/�i$�����87P�'���|w�7�-��2H�n�� �1W�4���ے����X+��~IQ��ŗV��֡W��p�,f�ɸ`��N���;��UK��~�O�Nq�"9�<���lUzY�[n�6�f��U��}��7�>����α�,�rC�Y'�P_pMܶǒ�R �&2��\lC���~�F��Ǽ03������҂��y�3�%�xm�1�5���q+����[�L�R6q�����Y�(5���Y?��d?�-G��聑"Z�[E7�&�R�PV < �uOeQ�ο��Vl��s��i{�(Z*ŸH��l@�&�,���ΦL%o�rN9�M���u���z{&���#��;.����WI����:��A��I�Z^���x�i;�_q<�k��@`�U�w�����-��TA��H�#R�)�K1��o�BSA���l�j���&s&}�D�=��t8�;�zi�F�b��\Z7Q'���.����eRV��&&���U����WoH��t�aEU��`;������O\��3���gp �H��=mU� �����O���}���9��G�4m\��h�tT͉���s�UD���@���jq��$��GM�_������EdFӁJ2�$&$���n�J؊�R��K�^/ij;��]ߍ0�!T��|�L!P�Y�nsC���E�� m~�k��Ō��Z@����Y�")�����A�H�V �v�"�d��*��� ��<[�K��e̝%����N�q'5鞃�{0����8���������Y�E�(�L���bPŋ���{���4=�C�>0�00�i>'��`U���;K�3O[(�$�}�RP�/�>̵�aoV�����uR24^ rm'�HБI�e��� ,�4�~Ľ���]�E+p�@:���$���_����w���)�@w�_i�`���Zs�ٻ�X�r�$j� �*��,q�5�O���~�Ŝ0�L������ 1������Ŀ[�v�A�xsv먞3)�0lG�#��Ƕ�3�Y��"��;�`l��lA;��Ҫ�����u4o̼�I��H9�(��>b%�����}ݗ\�I[%���A8���W�.�~����lS�sCu,����.yo�Wf���cU��$ �Ak�h\�ew���[}x@W�4ZPM]�g�!�����$��;����5Y��|g*�����fΡ<J ����W�*d��2��B�of��J��8m�f��3�����<�U$[����J�A�ݸḿ/�ײ��s�3 �xrL�{`��C��%ޥ��X�6ri�E��:�,�6��N;}���o@7��\p�=�]��}��<j��j�a��� ]d�w'�h�l�Hv�ɑ#��`4��~�z�*�94 q�n?�ë̅-J��0���Do�gh`hW���`��1��6���� �i���|X`���!V�>8`�/xd���q����>gȹ �=��5Q`g�~��pM=���]h�W�j���Bv+P�g,T�JU���ʽ�5u~��kT���ְk��,�_�E�`a.n�,�m2E�T��0���e�R/�,��&Q'���6��u�``ʐ�����3r�@��.�{m��Ϩ.�|�����4� �[l��Gcp��[��Q�Z���o� J�wA�<J�0yrV��6˄���N��PXA��끅õ��;�*kd1 +�i����`#$����)֞����ET�aN�]rЃ�e#m���4ۏb�ԭ�kX�|�@ߚ�>j>K�i�4�7�2[��qT���\�/C(���I�H��$>��, )Ϗ���"k���j0dH�U�$�fў��zdy�Ya���M�>W`�%���{�"�|�N!�0b&0�տ��Xh��Y���m�����B������N��8��<0�gu9%�ܮL�x7�;��v|B �6J��|ܘ�c����[� '��:��*�P�B��#M��n��"��L�/��g�r{��}�vG��X/�����zK1a l�i}ټX~�<�J^�SKkZU�HM�%�n(w"{cjjd���3�@^���q1�/��<;���]�>��V�"�/���;�n�m�[7���w���ڑ-��[?�K]34ݾ57�5�D�'�A�ʖRץ`{�au�j!�;�r͘8�P?5�>%��*�up�!��0q�Q�^�H��j̓"/����Ju���V� ��ᑧ�o�����̟fOK�\s�.��`X���o^,�jD��p��Y��#M�f�ů �U��3���SJ��o�>�q���[��Gy�"ia^��&_nWZ,��J�vd��ΪI����g�)�=��,�/�ɊC�p~��5��+�p#�����۔�Q���g�u�j�Ω��|rk�-�������ּ9�7�6(j���.��Dц�n�ob��2�Zz��#�%�����1}�Q�v�W?U:��ۨ���s6�8Rj+r��>��ޗ���>%dž�\:�{�g��kp� ƒ�!(���B�� ^2E;�͆X7%��3u0����1p_p���@+7�r��V���$�e�t¸i�f�ǔ�5�f����K�I�#ɹ\unX��p������.q����Y���.@E�����bc������G�T����t��7�%��뷱��b7aw�[��Q����j�Ue�C!��ao��y&dw����;`���^!�y5u���8�]o���� Zq��uF�-L3�V�lC�z%I�$�`N��X�u�1��/�-��`���B~|��h2�;(���!�GQ� �}�0���7+���������t��6��ӿ��PXϜ���dG%�j[o����\��E̠ZX��b�;�X\�꼢��'�:�̌<Q�X�����VX�ޞ��ō4Z''P��@W��H���<XR�h��Qx��~,��f���ư7���j��E�c�;�87�=�> �֯�0kW�������� �\�0� ����"!�T�&��������}}ڔ0Nm��~��P�L������w�����t"�4�n�i�ˀ\����иc�.L*-�x��b;���i M��.�4�u��e����e�_^f���[e�Y��D�8 �a~ �P��Vkt�V��*G �{ig�]�W�QS���Ji��q�a+ �-M���J�o�}�p����i߽´H���k5g~���A�gϪoG�Co�'[������q~2���(`�ͳo����PP�ذň��m(5B�Zb!���fA�#��RT�����u����W�7$�$*�ᨅ�
Static task
static1
Behavioral task
behavioral1
Sample
25aeeb81455141cb8a49e77cdd023138065c918e3edfaa5a6fa587fc61d71e4a.exe
Resource
win7-20231215-en
General
-
Target
25aeeb81455141cb8a49e77cdd023138065c918e3edfaa5a6fa587fc61d71e4a
-
Size
2.9MB
-
MD5
8566b098d7d308073a7109ae31744ce5
-
SHA1
42b4bee0128ab194e6087ea4e682824ae0408eb5
-
SHA256
25aeeb81455141cb8a49e77cdd023138065c918e3edfaa5a6fa587fc61d71e4a
-
SHA512
7bd5f8eeb584807a289f4bdbbd6e21a402df18f768b244b15edb2e8c1c3b91be028202250a8297d07c8f1479825d065b34d5e4d52701d96f58813b09c0c695a1
-
SSDEEP
49152:INIoqRjTzIzgxH5Blf/pQHzgsVIS//EA7cZEcuOXmnQp7JD:J7jHIExnMkoII/LcZEcs8JD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 25aeeb81455141cb8a49e77cdd023138065c918e3edfaa5a6fa587fc61d71e4a
Files
-
25aeeb81455141cb8a49e77cdd023138065c918e3edfaa5a6fa587fc61d71e4a.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE