o(B\ݻÇ"T��i/<,�n�Qy��$���Xd��iШҳ.����d���jӱ�z״�{S��0��|<g������$�c~:>?�׳v���cK�a1�v��I��t� ��'H4J��2}�1�ʞ���$���E���Xh�=�#(a�K��~��5�2�1I�*M�Df�K��tW��~����\w�7N�GYy��?"�Q��IxZZ��;is���>�?c䮬��ʼ�÷\��=���?���{bM��/�A|� ��k,&��eNu�~b����Qvc��`<4Uc�@V�"@���t�q��0�aU�b��� H�p��߲��H�!�a��#D�~�9QR�c^���e��#��R�F7���^��@�����mp��5�]�C(_��93����W�m�ҷ��!��.c�l;�$o�I�c�M�}�v����:������o���w4��]��| �d)�3�+����j�,<��}H������il�&�o3$m��E/��a�}�T5�a�Y����b��m�}��[!���-3a�H&�UOw�B���D3 �������+°����km�y�A�2#U6�UO3<[K�Q{%���ʩu��T��|�4��jrj@>�{�9t(�v�8?@\��Y]n���5@�;�_��Ńf7�1��M�o���(d(����R)'�;���D<�$\�`���^�����ѱ_���*xd��0Fm�mcm��{�g�G5ϔ[;k��x�� �(W����3�q�^A��-���f$$Xc ���'�":V��}�%2��[�Y��:�>�'<�}%I�|�0M3��|u��ƒilj���$�/L�`��m8N1W�-7�=��²횔�;`P�������]%��������=�N��� FӖ���<��ڂ�%�蛴��r( +:��^Yy�Z�y����V�G���s4)��t��k|tf�%czEDy�[�nFQ�G��(s��2�e�tͲ��-� 3�������nЩ��l��R�[F�q�DC�D��%��'���e��;~^���w��I�q��du&���·�W1�V���Bp�J����ʉD������i��A��Y}j�`C{�R@�?1����^| �?�MW$)�d�ɭ��^o�Ȧv�$G�$Ƣ�)��)���j����X���Z|�'�+�Q*�v��bzk�f��l��`�ȇ"2���*�?X<�E��R:�����c((�]~�Hb Լ\Kw�����ʐ�E�'��G�B:)�0��#��p|]�_u���1�Q�ز�oL}\� v�����m���oƝ�}����pM�O�BQ�F���I�d�����#���[�kb̍�S��)6�C�m}Q֑l�xL|�ɷ�����+�`^�sq��5^�>˰-�7�� �ja|v�(�����(����%�mw ���;�?2�R,v�t%���B� ���6 u�I�o�X[�<2�Q�w���>�{�R���j���m�������/����d�նa���+)c�"ћ2��v^U����"�rHh����Z�Ҷ�Y�Ũ��]dJ ��i2 ��<����G���I�����#ײ[ŧq��vʖ��|F9��>۸ߙ&{�1��\4��BZp�c�5=�ap�`O�M6_P3���wCq1�.��� ̙���=#�CRx"F�M-��eS����W��[u:�0���ES R������=ߏ�!"�=4Ћ$��P���R�@:#`������+� �z!D�g�����R�!�I|+��l̶u�2��v�]M̠�}_�Z���n�7���qq���-� ��~N�p�x{W�K�zn�uoEH*u���|�?} lm��;t�]ewuM�j��廷�l�oS�Փ����t�ݩ��L�m��>6B�؆o�E�GJ�:��l9�p�I}X/R�g��N�����\�F@+$E��M�ڕY@�{��t�X��23��h"�h����lP�����k9��]�s4�m�䥃�ߝSAp��BO!���yGwӡDMt�TM̅l�ײ�D%�1^�+e�ߗ�!�-�B\����ɯ����.�K�䣐Zl����礓���"�1�a�/�XP�pu����o�DV�ҫO`+W1��Q��yl�G�j�e0����}g��6 }�k������Lm5a�Gpx��}�� ��%�$������u���7�a�20!��8��$�y���#Ae�Ñ���HNu��%�r�$?ɑW���T�D�**+���T:��Z����=o�2�CtYp��Y�N�S��� *�´?��$����6_Ɩ�8id�Ɏ�(��8��:o�k�Wa嗢��bʋ݇�^�Q3��;3��n2o�/-w�qi�_�B���O�SA���q����R��Sk��T��hh\!�"I����] w�5Q?ΐE�g�H�;�(z �d�%RgQ��%�^p�!�.P"��v]���v(�o��Ea=,Xvu`:��7��N����e����H��C�|��$�8�zs��!��$����,t�����x/+�im���_o�}�!:fJ2yz(�W;���c�� ]A�F�c�UF���A� R��s����q���羞PEQ!i]q�,RFe�eGu1w[Ӑ8w�""�'`�WB�c������j�pO5wӃARy�#�|��~�t/E�Z�Q��A*�����kj�l�M/7,��N�����:�XѼ �@m���̜���Ģ��7QD��(��*�}0�P���'2�\y`�b��MG�Lr�R�"U1g�%�'7��c�(&�L%�h�[$�m�� ��� oL�7����������n���R885�=6�����ζS�J�u3��� ���*Մ�F&d��g�{��᪙(��۟�Ϝ�i2~ZM��r^���*P�I�G�N��C��J��!���0\�G�.�<���I�%GB��[B�:����"9-�_�u��?؊; �X~���LO�2���7w�8� 0�F�J�رol0�� �: ,~��� �~z��Tz�}b���~���O�eH���o��������,$��{��eY�en1M _�Ad�:���4����,Ժ��~̀F4�:|Q�)s%׀���� ua=�|ɍ��s ���ؐJ�,h�t�18��|����B���l���j����U��H��3D|��ٽ����I[� x�����Ն���Y�7��y�@��b�ni`>��M�@�cM�86��{��wsq��@�-ۜ��;��I�z��`���}�̷�s����pT��U�ñt=?�XqXe��9��+�f��P$�E��?]c��(�v���&,���4��|NȘ?���[�L�%��� +`Y]T3��VGɎ1&���h�"�'f%=mNueo���7��4���������ɞ{FT9��^2Q��������eH] a�+�T����H���6����ʗ�@t����ʣr�g����f�>�j�/:]4�^6iY�J�����Ŗ6@_Y)�[ȉ��Z`s��6�qt�S�m�$(��19+�1�vLZ:�RRS�f�Xy?��1�¿J,�f�W7I��~�B�=�`��>k�9��s�O#�h�o��I\�ѕ/�R�,�*]&PSdf1%��hR���]%(#�%Sx�[�{��i��$��}h�(�����֜����Tw���.����1�x@��Q[x��˵�+��T�;Z97O��_Ug��n�U��'_���o�Q�?�tN}G�>�z��]���b��s��@��W�9
Static task
static1
Behavioral task
behavioral1
Sample
765a33c882e40a624dc5367ae1e5442194c9ab0cedb47eddbd767888495028e8.exe
Resource
win7-20240220-en
General
-
Target
765a33c882e40a624dc5367ae1e5442194c9ab0cedb47eddbd767888495028e8
-
Size
2.9MB
-
MD5
dd55b724e0f49409c4dc4eeaed1ef249
-
SHA1
33026bff125191742ca47dcca882097624ff86e1
-
SHA256
765a33c882e40a624dc5367ae1e5442194c9ab0cedb47eddbd767888495028e8
-
SHA512
b01f1c18a98a8ec8818cf0c648a1c3ed0488784579ef4467643d1c6602772aa7683043cbc86b56d8da27bed3f78eadfc0566872417d85dc5d0e239d7f7c5968f
-
SSDEEP
49152:+Jbuknk69beonUV4OSmPKi20V6+nZzmP5Ujgc9A/af0sBp3aVC:s6k1j04xzi1VwUkcL0sDac
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 765a33c882e40a624dc5367ae1e5442194c9ab0cedb47eddbd767888495028e8
Files
-
765a33c882e40a624dc5367ae1e5442194c9ab0cedb47eddbd767888495028e8.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 459KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 71KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE