�?|�%�<�����[��i}]��vs�O7l|�T��FvR�>�2�|=�Ijq�>�,��bI���}�E��/��x�<��5�v��2e(I��BX|=l����ܛ�F�[���N2|P�3�[G��$b��1�S[��d~��l�ЇeW"�kD@p�����eNq��_�Z��a����L�� ��d�w�g�Ք��=׃�����C � s�8Lf��SO�aK��I�vU�X3K�7O�0j�U���2��̃�on����r2k���Ɔ�o栭��a�n�9I!m�?�N�~��RMY�)����$�uiד���3��dqFM���0q��% �����|�fOF���U��C�PF�b�"ї�v����� �������f��ǯXׯk�SN�y%��D@�teۑd�ҢP�*[{��d���������c���B�0�����2~�I:�����̘���<���f�X�4��r>�<��O��Pڇ��A��6uXر��5��&W!��o�d��,e��V[C6�I0�dA�,;����>��e��w�Y�`�����⾢'�E�����R�@A�´�T'��|��� dD��\�S��G�KǬ뭯��jv����,���������:�j�nI֨eN�@��ܒj4��F�4Zg$����X��� c�\*Y��p�#���b6yS�ӵ�%e(���(G_��}��q �qG����f\#������U�֦��1�l ��T�k��/�e���4�+�j����#�aK����_��ؼ p���5WJ=l��-����cm��,�ք�� ��<��� �+��ϻ,-��je���YԲ�^��?���0x�+H��7�Q�C��`聢��nN�����%��G��<�j�����A#Ӧ�w�6�����x���Z�[���A�+@�*��3���ü���:F8��.c��~C�T���ڳ��x�T�Lc���;X����������ݖ���� ��Zu�qO3�Z�o��T�����ټ�*p~��� �k9��th?5G��Xx��kav�|����$��H�1N)�Eg [w�Q<ƞ����G]�y'%��9�ZŮH��T�F����w*��{����Q����8#�p�[�E�gE3X�LB^���� ?�؟����{R2e���@�८�E_��`���jȀ��w�t�`�*_IbF��D����+k���vja�f�m��]��Xk�1����5�ͦ���s�>G���"9��eYhh8��57\/]o����X��'���k2�����%� ��L;}Dx�����ÿA �<8�Օ{�.{פ /�<gy Gc�4KW�f�m�����]ˎ������S5tȖ9䡜��aȪL��SK��i��TĞ0�{k��0 �R���}�!ћ9.�����u)��9�&!���݀ ̨��Й�6Cخ�Re�������$� ؛|����Lax��88�E%�Ge5<Y̞��$Txd_���WA ����� P�ݪUh���۲��G�V�)�U_�L�s�! ��$r����� w<���Ï\��ꟗ]dk=�j��f�b�'�@�!�^q^\Db��{���ŚI#e:�F�|ޑѝ�� hSl3$RY|ΫE�\�I"��&-���Ɯ���q#��a�b�f���U�1�I��Õ�%؋H�]�n���O�����Q�A�P��ئ�\�b$]����J{��%{H7��=ث�IL�z�a�Nc �����2�L�=3�����q�C��)�Q��㍁��$�7����q6]zL��hV�K�qi諩i��I�G J�������`�����\ѩBHйq��5�^�����Җ����1;�乜��Te䪏��#�K~�nq1Ž$%�ڂ�w�7Ʊ@�����1��p�D�&Y�X2����t��������m�8\��T� *��.���NRր�d��)��l�+s���Fz�Uυ���{���N�"�8���ֳ�L/_M:���7p�B����Tv��\q��N�M쳷@�@u�w��W����m������R��h-i�����v?�PS+��3����S���O�����������ow@�H�LZ"��ե%b�� Y]������N�]�Ϲ2b��Vގ �������a�I��q����1Jד�F���|�#�Sꖴt����3�{���hQ�#���6�U� c�D����: ��6"�K74T�J@��*�+��pӯ��G̡S�"�ki�kRN�`R��7 2�xa�>�Ϛ��j��l%�k����]ե��Hs"k����/�Vqfj�9S1<�G� ��7�g��|�|�B���V䆘+�'�,/J�[��A�S�)] �ќ��I�:?vݲ�������KE8�����*qh���Uq�l[�C���]���}�s\�`�*-D���@=����9��2��+�ɻ<�uҧ��y=�t�R����k�f +����h�<� ��uV25���p�\��CK����ʳCְqkH2w>ë�Iu�u�2���F�!�PϖOQ�:t֣NHS:Rp�ި���㏄ g��tLr{�BmT��p��zJX��ӗ�Ϋ�� /�Qw�.�LJ �\�UR6�bIo��\�����S3H�Z�t����<Ħ ]Q~�ߋ&��� h[֬\ �%0���w|��(���ݾ��0�'���[��`)�O*2x���@��U�!��#|�i��g���0�'��ݏ#�E�nz#�T�3n��Q�'Dz:�@��ڃ��Y%��3fc�l���)���p�-� (KOm�����gv����3W�v{`yÍ�^�m��V3���e�v����U�E��*�VOn����\1�8��tV�i\��B �Y+�BÂP7l�����<�YYȟ�0?.C��x)�e<���4�T� ���p%4rY���w�J-λ�Pu�%M?uB���Вظ�i4Cs���@�8@/8[9w�������(�1ӻ�!��ũ��vs�m7y"�:+>��q�����9N��c��i�nm�ҡע��/�>q� ���W 1�v�SzV��hEd��DW�a�N����g�x����_����88��\��O��&�����&�,)���f�a�#�ik�м��a4փ�WZ���P���/�Y�u��|Җ�@!�/���}�i��\_�[���Rl�*?"��Wwe�����f�j��Y���H�G������ɐ���nN�r(�idzSl�2�o�n�#U�MxR�z]�E����=���2�12�N?� �31��]L��y�M�z\�i)�O;����h|�W*Z�r�6b�M�x�C�N��=�c� ��`&���~����4K�LZ��H|b]�c:��k-);[��x��F���LYs1^|1�H%0��S0�������j������*�66�[/
Static task
static1
Behavioral task
behavioral1
Sample
02c45cef650eedec38736b43d908ff553132f001d0a0957ab4933298d2b980b8.exe
Resource
win7-20231215-en
General
-
Target
02c45cef650eedec38736b43d908ff553132f001d0a0957ab4933298d2b980b8
-
Size
3.0MB
-
MD5
9c2580fe181e2688438957d8d5185704
-
SHA1
e497a2b0f1266e706bee1e96ca3e398ebcaecc5d
-
SHA256
02c45cef650eedec38736b43d908ff553132f001d0a0957ab4933298d2b980b8
-
SHA512
2dcd091835a38ec4995d118c5173336d3ea144c4d395e35ca975df728bd4673b8314fa10b7e9a4d3ffaa2955dbd0433e8342f81180ce74855d8cefde20798408
-
SSDEEP
49152:ENqKD4z3XZUmM6AkRgDiwoDOcImF0rhm+WWSp1sn8zuTOm+Z1EA7M3PDbNY:EQH+m4kTwoKPtFWWH8zUOfDEAIPDm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 02c45cef650eedec38736b43d908ff553132f001d0a0957ab4933298d2b980b8
Files
-
02c45cef650eedec38736b43d908ff553132f001d0a0957ab4933298d2b980b8.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE