�u���x-�7�}���J��ʧ�������h~�Q���Ő�N><�7Rڦ>.5�r�Z`�ᱫ6����ݨ��T�*���BnP%j��rw���`�p���d�m돲��et�'�3*�$���rt�Ro�]�(��X�X�Ō�B 3 ����9�?���rRB�5�� :��G��R��Wi&X�� ����h�_ N��)���<m ��x,��Cz�' ����t@�|��Uߚ������Eŝ��֯VPp�rfv���4�v��]{�ڊ�^�Xg���3�Z.ړt;I7)��(�汰��vu���'��� "�(��N(rƲs�7����� �����#��%��?.��Z�����t+�J琥��y�:k^`t03H�Z��]��#B���[�m��4ƪ$,.��O��n�*,k�� ��s�sO �S`X�R���O�3e/�-�¡C��gv@�S�)����$!)�&��ʌŎmg��_��K%��bo��C��~���u��=ܳ��'5�d2<}�u�=X�r;��z�b'6r�� ��s���mh�4�������J��A��r���I����q������2��+�D�!-��=![��UIQ�T�z䅩�f6B�k�7烹�Dsf��a�{� �3z����{%N�u�R4�m����;b;���� �y�@�����K��Oy��L7�h�%�� ݣ����������Z+�xH�i�����*��UPm"�;'��:-0G����T�˂��9��S.�*� ���P�*�uf��/�ny��c�刿.�?�*�F�qy�����γ�LM�x����̈́P��=IȄ�Cܪ$�/����벙nU�ި㢒���Z��8��5�vG_����m�{q�Y���4��(�8j�����~��c�/��|&�N�쉀Mɻ!��9���4����55d�ЊJd�ˈ����*�������Wwཌ��@����j�vN`���h��t�M�G���n2�|�������wț��L��x��]�ȌV� �>c��hM�λ���r����=bK2�ɍm���8r���AvO�ў��`8�(ټ*��o���ES��J�%7�:�Ӆ��J�s�L��{�����.��f���(t��e-�=�I��d�ɞU�TLq��R��X�����o�JI����Q�$�鞑���D��)���0��_L�DŽ�%�V���02�z�M�5��X>륽cW۔���F'��$��.(���ڰ,�v�C:�X]'�(�F��1.r���} ���<�A$6�ࠒ���m��a\C:��u$��6 z��D�o]��JԬA(N��tt���մK^Q�\�}^�V ���?�:"j��ynN_� ��eK�mL4�>sӰH0+��š�{�Pll�K�����&ǃk,���2-��k4��Ӟ���h�jD� U�`���<b��?�Fu�z�O�<�}r��1�3Kfv�+,o]t``*��+q�N�`�H� ��If��.{��Bx�^����J�D$y$c�o�i��G�� v��N��$c8P�gP��y�a��&j�-t��c��6�zBH+��Cq������(�����b��_0�%Y�}Q���:�0�� �;>t�ց�A}�f�4P�d�˗#�,#m�� o�����F��3������7S����Q��L�����y�3Oߑ�)fꦆc���'/�ؠ!� ��X'�)n�;xq1��W@U6���z�h(�&s�F�]����Tc��s�38t�]���B0�[�<[@b*��⡽�_x��/l�������o�)�������/M�E�K7R����/�/������X�C3�.�����v�6�z_M�U�k�4�{t���"`��9�T�V�|!�ϵ��*��E �~<<f=��1��d Ȑ�8�d��)�:g�˻��]�����/�u�7��2qn�5O<�/2�4"���Ϳ�d�"�v��9��I����6Y*��K�jK�eTT�I����zFnN�-�����Q"�m���+=�)�Kc���z��gCEd�6}>x�X�v��%SA�]�8��8��=�f����CO�j�ː p&�N��u�CPy��������K�Lq�2`��[��'aҺ$�RO�gu��~��ԃ0�1��l|D�} �Q�4��|vǃ�ev�D�A�@�1�R���#�m����.#7���_���l렿%�W�# ��](n�%�dV�d�ٵγ]�����Z�Գ�s8,�Z��;v�Jsf�A�Wӷ98��q� ����xb܊M� ��-��NMJ~�����3twFIf̐�/�\�m�8�6.z��.�AܢhY����5*�����(����>�|\�m��\�E��e0K��|i�X>Ǹ�{���Г�%������L��H#�G��tb�O��Co&��2��d��4��ĸ�.?����y\8�O�#n0�g^RN4X���z�g�}m��'�Is�5O��T� f~��mb�N�;����ج�c��}87��p`����2��j �:��_}�����j�Pc]ȴ�<����[�QzP���.4F�������E�51?�o4�C������5�89aF�Zٳ�a�'+�7:�Ʒ�[v^�l�ٿ���������x���s��H���|����WT��-����[�4�����9����"��6�l�C�.��ʒw_,�u_Az�z�.��e�jF��V0�Ka"��.7b�$�<3��Zp�?�pW[�OI}��g=�v*w��D�t'D!���rY��4k�ѷ��O63�r�1�'V}�5���J&�� q9�~ih�|��F�cb�[�M�RT;Uw��d��!|0��0,"Pʬ'��s��U��i!2 D\r��7!1���8���_�m�A�N%���:m��JE��p���a��F������{���]������$B�ի��������a\�q���%{�Mk`���>�2���y� y��nj&��j�tt)�3�d�W_ό����*���B��#y"�aL�j�s!����6��T���7��:"�yY���s�\���!A0 ��m*�0�k"Z]�����,��V�j�A����e<kll�ڃ*�����}���֯�U�7����zHޙ����;zjԕ�vvT#X��m�豠YCg�������Eŕ1��ҋ ɪ�ۄ\���K��EK�z�Qy���NA\��8��Y,�0��(�0��-�N�X'�̴�������*,"�-��A������&�o��h�~I�@~a�iq��]-"%��?K��j'��P��@�223��O��� �<ʋ����T4R0�KN�k�E�?�md1ٍ}-�+��|s}����7q&*=�G/�r���}�
Static task
static1
Behavioral task
behavioral1
Sample
6a1a4a9562aea2b5214499156a68e0128d34688b76e541bd30940f873a4323ec.exe
Resource
win7-20231215-en
General
-
Target
6a1a4a9562aea2b5214499156a68e0128d34688b76e541bd30940f873a4323ec.exe
-
Size
3.0MB
-
MD5
ffe137503d32dd02e50dd192f02f1329
-
SHA1
84e30f5a488ce3be3d87e645bddd6378e96ebc67
-
SHA256
6a1a4a9562aea2b5214499156a68e0128d34688b76e541bd30940f873a4323ec
-
SHA512
228bf9580637e8960a3f8755c7cbc8e61c9e595a3bf0b09390ef3dd579c23456ee912513ebbd6a7c027cfc855a8ff4e18fccb4fba101304d9caac2f3765e50b7
-
SSDEEP
49152:qUs74IdmeJORDYcKML8Zo0tXIU4pexeaW19Gh2+b/4an5GUMJ8nrYee91LoLIzFY:Y74+gldSowIU4p2WQFb7n5RMJkrY/noJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6a1a4a9562aea2b5214499156a68e0128d34688b76e541bd30940f873a4323ec.exe
Files
-
6a1a4a9562aea2b5214499156a68e0128d34688b76e541bd30940f873a4323ec.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE