�7w��b����W=zL�et��"��2Ow�UN��:CkЭ��0I(��6x\�h�vr��qK�@^��|(������t"�v���lE8�|\�6�##�?>��0��A�p���4�}���=t2� ����T���>-�1���lxߎ��X?ZK>��X�5��.O֬N?E�rh]��U��L�zqP���5�Gc��J���0U�['DW�� m���Ng0�<:@��ԡ�����MAs�D��)r�f�B9697�5�[c�z��/CL:ͯMY����K[l�/��[xl�� �sU��� ��y�����N,k�'�t��YL�����z_eh�S����5ߢ��a�3�}�p��xnz�_��a�r���>ͺ��n(&���%�_�p��"��N.9�[�G7+NNyQ���yk�xմ ��%H� ��N$���/��q�J�6E8'�"����^�v�zU;�(��Ӟr���Pl<���=������x�A�1Dc��:�%%l�~�8�P����>@`&��S�8���|4������^߳.�0ϭ�܋�侔�Je�mz� o�\^��#�^���?�1�M��bt��)�:%�H��<~`���g_�jX= {S��HI5��46��l�~@�"�a`o�/ z 6G2�>������z�`��O��~h��V��B��4*����=K��w��L��ճ�#x�jN�>�Sle��;T`fb�V� 4p��T˽�x*-̻�2?Jn9D�=M#��mjx���xX���k�s��m�]&�̡`�RJͣ�ዅK�k�w{��:U�І�J�����GNƺ3��.&�vJ:�ZxsMBi� 2� ����#��2Ԙ*.�ݪO��)�j��$d�\"�*���o�hY����-�%�u@��(�^v���`�h�>����*�~9��t$��9��/��w��N�r�i�� (qnq��Y:�C��}���y}�ޑl�������)�F���Y�[1F��;Km,n�3x�X*ۏ��Ȋ�e%0N�g|$��κ�����V��3��9ڥnGgd�買�N�,[繛��r{ݏg�5�\=R��L��GAU�}xr8l��G�g�rup?��1��4D���3P=Cm10#fKQ9�Z�V���A��=���:b�8�7*�y�`�p6��oU1� [o�4U�<[F-/���cl�-����|��l����٪0+�2!;fdS������h�g�i�BÏF���w�*�P��LM�RL�mtn9� �G6j�Z2{Кj|�l{���<�q54RmK��(��*��@�;۷@,����t";�NXe���u9�xW���1 �.����D�rF��.�6;���CF �B���П0��O��2 �1ҳwq���x%���L�!�)��؍ު����e���I�$F�u��`�X�Dd���w��k��-������ ����j\R�7�~:J��C@�����W?c������iM����V�;gE�#��(�D�vNvi��=q��H�:l|?MB� ����*{B���xIRڈ�-wGA��Gj��K�$�;(��Kr!�E��1<�5K�E��j6�q��#�~aD���$�YȰ�q�0Lz@J��1Ye��! J�X_����c�"\8����v�� v�n6�'ܒ>RH{����Qm$7<m��Y����˦>��t�=�B����,��%��\`��<ͧ�TF��@����X8��o9s@?:��ܪB�q���b�/�Y�+�w�]��a|'H]L�en�n��F��5kB��<�R _�7Vk��UQ6�\��IO���}r���Y�����a�E�B����Zm� ������^�>*�_�<��������:���Չ��ma��P��w�����l"��.az�r�h��?�����/��"yJ���/��ЃJ(X�7��t��Z�{��|V���*FO$y8��Z�g��G9Oڔ�Mj8&���c<��Ԙ*�=��]����}�lA�rI�Pvbƽ"���|Acx:�nK����6]꾐���i���i6D��� �|����=荏�Ypo5S]ڂ$f������>/�d�bydf���r������YƔ�j�c�<kbK� H_���5�~�L���+��|W�l��E$z������+a֝�V<B&K�%{6맀���c:I����LJ��dz����J{�'����Gʆ[�[�s�ܼ��Q��A\e���>k@踸cz�|U�*p�� �ք��� t��C ���WrR����[cG��?��e,� E8����+�N���a_V&����>�G��* $`x0٘��M;�W�X]n���-���_�D���8������ �ZGuk|P�7:�D��,�z@|*)Rȋ�L�����9�5�1������.�%S}���wom�e�&Wz��r������*�G,���0��QYe!|FH^�e����'�4���v>'�١mA5֗S!i��p�l�k��Q���}��Bq���l���,���V����9��[_�P�H�r��D����T�8�#P,v��z���Q�;(��B�R�g�И?���t�V���j�G��J�w�Y|��x#�o5�d0=��\�n�--���^�Ƀ��j"Ww�}��=�������)l�@������c�rҮ�|���l�4�X��ĞP$��{4w�ea`5xs��29������|z�F�1Kr����v}Ob���EP`yߤ�|�!z���#L�v�Rk�LA[��>�ƵhB0�T��= �x��c����eBz���6*������ĺ2t�Yę�*=����ᥝWa��ksZ#24�@/��Au��f(��(��� ����T��H��X>����~�>�vV�r��v���ӤR�䆾4��M( ��N�0���b�����-u�>,I�����J��Y��t�fKv!Q��ò������@N��L�L*A�Z�ݿ��n�s��TT����Bѷc��G:Zb:3D����Ah�nI ٫� �}�G�w�G�&�@{+��c$���^-i_qA�k]ވ�z�/��UT��~�"H�#Ya�8nJ>BW� ��d����V���n꒔�����[��+4X�j���x�($�-��LHʆ�AE��O<�� ���l�b�3�C��N��T%���p�|�^c���ݬX�[X��X��&E��W>�%���Z�=��a�EVٞ)1e�7c��d���v����[S͵��^L��*&e4aP_�;=��*��|%��_�db�������82$d��c�N/?��4.�����LhD��n�N��Q������N���P��k��X��;��BJ(=k��/K��� ��!-��Of=F�.w$�L�5�����T$6�c'���(Ҷ����-|��=$Xb�}�>7 ��m����4�ߺ$'-ެ�q�!+PI����y�8��6��~j4���Am_Ѡ�KJW�{�����߯E7
Static task
static1
Behavioral task
behavioral1
Sample
dc3e78b5c21ac2daaae6b5fe0f8236e4b9e5345345ae362ab498122a112d6d7e.exe
Resource
win7-20240215-en
General
-
Target
dc3e78b5c21ac2daaae6b5fe0f8236e4b9e5345345ae362ab498122a112d6d7e
-
Size
2.9MB
-
MD5
32e4a2f6e0804e0c7982817ebc47c760
-
SHA1
b4099f893f36cdff9acf4bbfd45b60f45b1d813c
-
SHA256
dc3e78b5c21ac2daaae6b5fe0f8236e4b9e5345345ae362ab498122a112d6d7e
-
SHA512
dc4c71f97bbb23757dff83ce4f6f4c10d8a4ccf20719368ddc0976b19edac740c1844a413a0366876d6833408fc9239e0634717d527930b2016f7b314f89a0f7
-
SSDEEP
49152:IziHuaTY0gfEQItecNo8B0IFvUAvK5F0Zo4TK6EDKqDh7V8t6KWgP3KuHqqWl0Ha:tpRLNjB0I9U2o4XqNq6fq3vHqqWlQa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dc3e78b5c21ac2daaae6b5fe0f8236e4b9e5345345ae362ab498122a112d6d7e
Files
-
dc3e78b5c21ac2daaae6b5fe0f8236e4b9e5345345ae362ab498122a112d6d7e.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE