�|.����[��k�g�v�儃`�h w0φ.{&E�i�1��Ѯ���2�W�d�gy� S�A���ǩZ�%�|g��`&�����s�|�`1t�c���ئ� ���uV��ߣ��(s�|���X�ǃ~7@��k��c��X����ϊZ�l����t�X��"^XG�\�D�f?��Nj6-忏MO>�*L)n1��F�����}^ȩN��N�u��\y"�ƞ`��l�.l�y8���Wyl&���?Y���M`Z� sw����x����5�lDk�no�g�"��>r��b�m��O�|���p]������U���������Dz�4..)d_�6��k�Sډ<��j��b�c^�UcT���:I�PAS���#��>��/{��ӣ�t��4��+nA��7e�F𘱥����h��i8b�J�1i��������^�2�x�A �A҇<������β�B��oa�J�viWbPQ��3:���^�oW5=�=�T�O@'%C�9�q@I����{j�%�*����̱ʯ10��p�vL��U8Ëa��g�����NYo��K�Ez>��X�"Ӯ��l��u�� �ϕ�Ŀ�c�@n�V"ZƖnc?�L���#w �ou ��%^)��<��LRd���31����1^����ȹ���� s����A����N�{#��ib�E�S�/NK��� ��c�����1ڥ#��b���w ��h��U],�a4�;x䉘<~xku�,�x�S��'�=�M��o /Z��-�0q����G{4����,�]-���B�'+$������Rwe4(���d���GY~W��2,��5?#p��|@y�٤�\�g���dv��lɧԍC�R�����\/�z�#M���}���\w��D�����{�)T��|�w�D?�?8UN�삃��z><y�����\��á����~�J2����Vna������� <���-��3����H �_E}�Y��qX����g�~�2�;�h/��Šq�Ń,tB��탣��ӌ�ԼY�h8фsiI,�-~���x5����Njpix��0�KXT2���tM���AW�uX�0ۍ����_���;��β�2�E�L!@Ӥ�ʕ�ee'��C���pt �ؤ�s��*6�(����(��Hǃ=���N|��� J�]��8�erm ��8�d&��>/<� 3���ce���E�=��`��+����W�$,`3�>�H��x��"���N��p��ȟ���&H�e��dt1{��s�5���Ǎ�����>�7�� ���<ԙ��ߏaZ4��Kq+��.Y�f�4/����:J�r�QE��ɢi��LS���t ^�˗s1ۿ)�<���Fh�(3������%����{�w�_v��'�~Ϛ�+`����gzp�%��-o��j��NB��h��z�t�`wܶ�ΜA��M�W2J*h VO�x.u�G��X�<<�_�p$*��q<� �"�!�$�U����Ez�x2�nS$h&Y~Ѵ:d�o!9���8��B�3�p7ŷB#p� Y��O�x������7�;�Y퀐�?������cb��rw�����J�"�������lj����A����$�!�}��� ���Q��e�sg��|�iMsD;4�vW&<d�ɠ�~��� "I �ڪ���gBX�"�� gֲ7|߾���ą��Q������t�!Ga����x4��k֟�CT1��/�<0&�H�Z�������eQ �����eR$�_Ȱ��*�r ��bJE ��+x첓�����%a�`��xw�k��˽c����.��j�N_�X�XI��s��,z1Ե �����N�����7�����]����uf@�>����'�>������t�\M����6���/f�JΓ:�IY����o9��Uᮜ�'g� ��\��%��:|%v�_ט>{�u�DG�x�l�}�����j��� ��-=��g�j��Z0�����l�N�������>����M����=�����om��u"��A!Ʋ�o���k�v�����߮��?�0TT����������LI$��L Vz�8�F2GDF���G���g��"�oЕ{b=[=�;�-�����r��ƕ4;k��FN�����b�'?�gB_XM����N"�H�S�5Y:>G�c�-f:1[�5�B��U��J���y.����ZI�SƲ��}��c�d��U��`���MȔnj����~�� �)l���C���uܐ��nv[]pIt�T�8I�( ;�q����ζ�A�'\�N,Ĥz,�������3����'�����>ѡ��͘N1�n@HD�Qt�K<z:�[�:�y�r1$X�����P'����W�Z���oW�:����{C���oLBeN�@6���i��~�V���Б�9��m7��#p�P,�8G}���Q(|�XQ�Q�^��[im�@]�p���� "(h����*���[^�kCԯ3���[s�M�ax�� ����5�ѡ�h~�,��k7)�����@���(r�u��) �f!�B=e1D6��^_��H;���v>Re0�g7"&}�(h�����Z�ҫ`]蕫���R�Ǵ�% ���T�&f�]�E Z �T�j(.�"l�c�N ´���L�b�P���s-QXe���<����9�Ab��<.K��Ht�0_�>Ŋ4�=�Jk�y��@+�>A�L��=o��,-%xؒ�_rW0:c��w܊2��RFh�x:�d�vHEfK�˒[���2k�4��im�]aqhF����Շ�~�Vཹ������D��\7?i�A�֞���a��q���a��t�����Pu�a��*�d��J�{��͉w S���e���=y6�쏉#G�y�J�Z��9�&���}Q�Ƴ?�9�<i�gqH��`��bF�����@���M����3 ��(���A�j�5G�>��4`@�lZ���!�� ��:��A��Z����F�$R��� ���n�+q��������^��:w�#|n�0��e��Oe���F�&�@$P��eV��K��n�S� ��ѕA���)��O��t�Vg0,P؋Q��P|����c�� �ᕋ����7�c�DA,c�w�3�+i��O����)��G����m;¬q�����m�؍��z��z�OVClE>��Y/���{J<n��Z�Ȑ%���E�g|*P����C��O�oӜX�X���t��
Static task
static1
Behavioral task
behavioral1
Sample
1d909ceea8920c2e2aca28f71aca177e4709663a6c856dfc83fc46c20b53a888.exe
Resource
win7-20231215-en
General
-
Target
1d909ceea8920c2e2aca28f71aca177e4709663a6c856dfc83fc46c20b53a888
-
Size
2.9MB
-
MD5
cc3e60bfd41020da7245dd9b68c39433
-
SHA1
7e1155bda487c5fe652cf5783496f7985373bebd
-
SHA256
1d909ceea8920c2e2aca28f71aca177e4709663a6c856dfc83fc46c20b53a888
-
SHA512
0f0e6d9c16641f53b2066f5e6ffd4e0a03db58079068414acbd9c9d48d210b076cf96d4e99f9b30e93d957bf0f61626cdedc1a363f4536becec324e1b9fc3eee
-
SSDEEP
49152:lSssEiUINebch65SZhxrJIyiZVRA/IBibYRrK5g6aYlhem0QeP4V:wDEir6SXxr+yiZVqQBZag6aYlhemy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1d909ceea8920c2e2aca28f71aca177e4709663a6c856dfc83fc46c20b53a888
Files
-
1d909ceea8920c2e2aca28f71aca177e4709663a6c856dfc83fc46c20b53a888.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE