ItAj��@�t���xsN�#0Q ����g����T� TT)ɖf��9�pad��*�@畽S^��IOc���ȝ��xtX�{*�&6�����<�9b1+&.�;��ԱKJ� &�*�M�O� �|yr,��-�q+=������y��UNܸ������nPw�K�l��ӦjQ������4�g�9�������Vl M ��l0�p��3^@��u�r��̃F�y�Xr6����C�Q����[������O�Ur���/�� ���A\/`��V�4�X�s�t:v5��������c(�bSLkM��P��Q!����"p|��������0e��:(�T�G*~��5\��# �J~��O�c�ilR]�����;V����D�����oC�=�fc���~n���E�w��vgV�VG�#��t��T=c��n�7v_$O�f ���q��y���`�֨���s2�.�!�{�$ 6�Z��B ˙�[�$>���7= %������r��0"~��3>j�x:&�jG����E�0c�~.�Ύ���w�"�;J��wۏ�L��0Bz9��'e�]R��l&���a����˹}%:F�0a�L��0�[��D��[}\�����}c<#%��!�ES/��:�~Y ��Rk�K�Nbޒ���Q6jM�쬶"�;}�Z� �B�� V�pw�g�h�-rBS��ҩ�Z��y�0 w�)*ۖSp�o�u?��L�m��Zh�Ws�P���?��K�Ǖ!�O=�F�^�x4<w�R��ڕ�5n�)���4[J�x����V,��c�b1��{D�P�)��0/�p��%���tQ�G�6ܶ�Y��������5��ڿ��-�XoF�����e�JOT)�p��A�Oϕ�Zu��G�s!S�����+n,R�:�Ӂ`��#B���E��&�fo��}x�Δ�n��:��37O���8r�^�E���8��v2R�}��i�t�{ ��$��N�1(saJ<J,~��W�?ٺ,���7� X)@ڊ��sA������a�Kq�Zc|��~ki���xeˡ���#4(�R�1������ؽb�T�Q��BFa��?5��y4ll �2��U��r����!��X�����>T}[�[V��(2���)?��е�cB(p|VpH�P7*��M�iVP��ds�<�2�W����(b��@�ƴ �qY>��E�n��ۗ�.$%�����]"��hPJګ�u;��Q���R����ql��M�E�������������R�b7�D ���\�v"bzR��[]��.�Bg ���� o}�G=�h]"ߩ��S�fB���r���Y�-� )� V\ ��oSs�\�SZ#�*��S �|1��lJ��vN� �IRF�#4p�I_W;P��o"��BT?$M���pVgG�y?���.��ttp��IC�gFH<�ٖ�����(e�g�ZJ?{�P�������j�B3x�,K��̒G����J�b�W`�����DM�f��4U�ޅ�y������~�+~7,֒ ��e"�ej������xsd�f�:��� _�}`��tl�/�wk��q8�+O���%��u�����/��s�:(2!���?G�} K�uaaBt�dW��C�9��~ ��ɲ+:�s�JH��h���z�wd�.\�s/���g1���g@w�s��6m��E����e�}�^�@ s3X!<A�����bNrץ��cGd!T��*����O9?#1�Y���������J���I-e�ԉa.`O��mom^Hwo ��t���'L�e*������.f�� ��[�uKa�3�����J�ư��XP�Lϻ �������k3P��4)4�)���hT��Y 4N�����q/A�����I��iX����s�'r��-��;�$H����9��*����!�x"��NWlL�_XN �<$s���o0Vt�B�dWǷ���5��%įm��!�WXy���;���C;�Ż��� m-�-hbI��aݚ���0�����W'�)fTO��/{������"��T��0���`���tk��#p�@�~�,>�"�QT/�(�[$�J�[�+�����t`؛�J /뭊��Btq�\,�ֹu�E������0��dѪ6&�?��eAU:��$!`n��p�-���xs?�լ��/����v���F�}��'ʭ��%M�wi���Ŧ����bcJ~ *��s������k4K��͍��J0�Nȵ?A��>(�Q��O?�k�N��9ev�-n�7��^CI�/{Du�O�d�f���A���\�I�0��:����,9 4���Di�F�S{)��gʯ�)aӖ�:H3����˺�U�?R�0�] �V5vs�x�T/;L0�����c�����cQ��L��C���7&o�� ���_��|YÊ�|�+�0-UeE�`k�2~� {Sb /���^����������ZYy���T����h��-�����քzPܿ���+�>��'M&��u�&���yR�����8尴��4py)��!៵��.>���_v�`�;I ��ě�>,�bR7��]6����^�r�4K�L�:�W$q�L�����:<c�?C虉 ��=~��RE�����}#����,�*q�7�op�q�#2�j)��s����p��9}l4i٤�/�^��`��q&*��?i���G�wKb� LK�uK����y-J�KB$�!8�fFS��CEe����2���V�}0>+�����(����}p���I��:g�X��T-eD,@f�`*QYO�*(���N-��=�&z)�劇o���P�����Г:[qP�g9�Jg=��9��[B�a�"���Om�v�M��(���R����Y��$Q��ˑ�`��ƽY#GaG���}[R�y5�,��yp��O}P����K��3��Fdq�ք������t��x�װB���ޫ:D��e�H�"ENM҆=�aĉ���c�����^,��qP��B�� 8�n��J���|�2F(�r1��A��%��E��̆6��xڀ�=�1J�j������ ����m�;�&�V�����ʮ6+ab �Ծ�`h���F�\ e"�OP7N�tX�L:���c Dw=F@-c�v�53,[�\/c<�e��1����Ks�~Ե�"�BO,�ǟ8��>3�E�l[I��r�D��fH�X�h"x�M�g-5Չ ��hy�P@$��',�|������ԗ��E�8���s$ ߶����C,�W�S�����4���G�y.�3i�� �H��b ��S�����]�����U5�sT�ӝ$cZ��5�Yo�@�����[.�u,}����QW��[s��)��TJzI�n|߯�^�k,�=��I-�
Static task
static1
Behavioral task
behavioral1
Sample
40694ef0c235436eb5b9fcf73d2deba1a08638ea10ab49fe31207b63af8d8b60.exe
Resource
win7-20231215-en
General
-
Target
40694ef0c235436eb5b9fcf73d2deba1a08638ea10ab49fe31207b63af8d8b60
-
Size
3.0MB
-
MD5
14d9fddfc8f52d4df9dc682827cbbe87
-
SHA1
64270feefdea77a6dd5d92199e0a17f96d7310c7
-
SHA256
40694ef0c235436eb5b9fcf73d2deba1a08638ea10ab49fe31207b63af8d8b60
-
SHA512
41b4169b737fe7550f819f444a1caef2ca2c58ce837ea1b6e397b214aa3e43973a9d66eb6db9549e30ff9bfbd2dba79b6c8df9b4f0dcca58eae7944bc1f4cf54
-
SSDEEP
49152:ZeGb/XKXKFGYRemm1SVhi0h0t78AFGQXFgbMTShXVUp/7drpML9Jfse/RxS02mpD:sGLGURJMnCARXiWS8phyLzfsUnZ2mp/O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 40694ef0c235436eb5b9fcf73d2deba1a08638ea10ab49fe31207b63af8d8b60
Files
-
40694ef0c235436eb5b9fcf73d2deba1a08638ea10ab49fe31207b63af8d8b60.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE