f�Pc���k��<�X�%���s�i��]����Jn���jiY�c�u�`h/������ώӒ�D�����މ/�{�w3�*�� �!��H�� AADg��r�b�=CX>_������[#�e*2���yU�\�D��e��Y��Eq��`�N�Z�20+AI�]��+��t�J2bg;��qɨ]��� ��Zr�H=���i5��WJ����;�� sY��5�� �h����ʓ�;I�_��|�W�+�4Z:���1�f.�o�etN�i�%���� d����K��#96}KP}T~E�7��^'q��u��O��u�Őo �� ���R*e�v���y!Ш!,�o��R�E$e{���}<П��ɇ&=Ȧ£P�<��^�q���$6�n�68#]�es'�MD�OK*]U��%]�E�������tJ(<ΰ 9�C"��e� cY�� ��;������+��C��cR�-�@!4m0��f�d0b��~9�3����:�d��>�Z��?�������r(�'�LJ��-�O>#ۑNI bz�y�?�Q��avp���m� ��1ZH3�D���ݐ���LS6�l��8���϶D�m���J����y�Hy��|�N���K�=+}q%@�kM����'-�u�[������EA�!+����D�M�%e���P����HΏU�7���Zu0� #���d³DIj�ҿq��G��J�<'E�!z�7�9*�1��q�X��}v(T�;��iY���q��q~�4����Wa�ςb�� ��K���>�9�!OhP`��/�.���`�P����u��Sh"w�]0���Ǡz�%���P�BM��U�l�.�W�/�����%\km�����ض����|�";�I,}*H�p�&�+�f(p�O��Ļ8�vj_�_N�H1z��3�� Q��p�9Y��ԭ�:E�9���#��[��7����<f��ye��w����#��FQ�d����(MO���ʒS^Q{�0f�����h��g{�:�88��o�rO���v��\��0x�]�O�wD�+��~�͚�OT�Fj����P�fL�8��/�QG�9'T �uE�ǜ�� ,��n���s�| ��`]c*��!\,���Z�����n�fjH/�h��Ύ�<�=ϠX^���,�Kg�9Ҝ喳A+�wv��F6�������߳���U�/9 �_a���V�g~n�J �P1 ����%1�t ���2lQ>Ҽ �ł�X�E��)[{;�4�O<�d*Ɗ+���u�� �~z���}P�uo��0����g܀AS����X�q���鹷B�Ư�����?(�ۻ���"W�,.0YR���aiV��ku�U���L��Ȗ�;)J�[X��Q �½X<w���'GI�ۯ�A�.!'�����������P�g馏^��D�:� ����{+��^[xi%Q.) H��� �����S���TqG��=��f�}2��b�� �DC�C0���(9숀u���kU�l\�^j�r��xs��U�X���Z��l�G�j�od&�^��s9��� :J�e�N����r��m�P�F���Z̏��X%�M�fW�������T�.0S��;������h"U�T�7��,y˦D��Dt?�����0�{�T�}R�1�$��w��8q@��J&���RJ3��Y�$3Mrs��:��?��z0����W���~H���D��.݀NMG��:���iT�s�){�s��� ���Q�S$�x�t.���/�F��%9]��); ������F'ha�Ș�etx�Pt����[_��pr��������h!Rl�^�Aْ���j��~<��U�j��l��~@�������;��H�� �Kv�?'��d�����~�0֪��}�pj5���R䤑���0�oz���1c�-�'���� ?Qt}GB���(c��F?Aٰ���3v�Q�Wn�55����j�O�j���硝#a�ǧ���F=�Ky�x^�5l�L �;&�K����C�[��� W���A�S!��9، �u���,��s�;5Oyv���R�P%��:.Ô�7�`���C�b�� ܠ������on�ŔX���kɵcӞ��ʢ⫧�E�̮eK�@k�>�X�������+�2�$w�p�v��[��4����to'_c6���6K2��wj���`�f����[�y:j8s|NL�/�u b��g�e_J^���*61���'U�����@Y���y�nYj���fZ^�W�.J%c}e|M�i_���Hq��]3OG��Ê�, ��m�1.���4HLEZ8mG[�-���y<o�8)G)�p��u�coԕdV������r�L=4� �;o�b�|R�������miW���/��s~c���jL�ךb��mq��� �<@6.��rC��H%�]h p���G\h,*S3�7\��h���[�� �ˉ�M�U%ȵV�Ѽ"�� ����s;��E��?m�X!�<�����0���g���O�zS��ϲ{�^�v�B�H�ҨV��Ȧ���Z� B�w��x�<�9muR�*�rz��݃Q^����$c$Y}-�Ѯ( 'L1��3�O��H��F�T����Mf��ܻ� ���q�-�PE�.�a`��!x�Q��A�P�Iu����������\? ���9��A\����u��)�^Ի8}Z+��K$�=2T�KV-n�����D�����9������P2$�P�U�Ih����GTϥ�)T�:r�2����4��#���yh�_�Ϯ�2�8��rqv:'h?��9�L��lx1ƁU �A�[���B������z]���(H�f�����,���)]�4������X���ETpS3|���NĔg�nT��,E �,|�atAğ���J��)���x����;J�v��.~-b�O#�::���+q�[ik�[Yb���`c�� ��B�/���cɩ�߀M=������<�ųz gt�}��?����$N(f��j� �"�c���qi�] ���KX��:&mV��^�u�a��V;s�* [�Ձ�[�(��Y�F�=D4��>�C+ P\��1���ӥ$�31�����b�Y�$�Je��������U��T����>��e�L[�0�@x/;��#����V��o��r��L�>�����<�wEK����uBŊ��'1$���>���W��ݶ�i BF^F�T0J ?{ #�B�M�k"K*���&)u��R�`�:�X4Z3e^�5v��A�B1uXbI�=vh�^�(��`��$��f�;m&��U1J.���x�۽��Ƶ�T���MX�T��Yu�jO�4r
Static task
static1
Behavioral task
behavioral1
Sample
2880f894fc103ba9d912f7b534597ed038c90f273edd0349c49a7b600d7775b9.exe
Resource
win7-20240221-en
General
-
Target
2880f894fc103ba9d912f7b534597ed038c90f273edd0349c49a7b600d7775b9
-
Size
2.9MB
-
MD5
c174a075763757f576f93aa232c63b58
-
SHA1
59be58667c9498da4b320e10739fc44962746eb5
-
SHA256
2880f894fc103ba9d912f7b534597ed038c90f273edd0349c49a7b600d7775b9
-
SHA512
1b9c1a779ea951226468f2a8ccb0396a2193a200953e21fd07e3363bf26017d132fe5d1e10021d22e4e3c24189f33184390b1b299899cede856b634bc5f001a8
-
SSDEEP
49152:tOcuP8Z0LGphaAh3TPgJFuKC/qbJffQwhElEy99UeSUZfWpB3dJo0D1Z4Va51Lv:fu0Z0LWhTjPQFDy4dyE/wfWpJo0D1ms
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2880f894fc103ba9d912f7b534597ed038c90f273edd0349c49a7b600d7775b9
Files
-
2880f894fc103ba9d912f7b534597ed038c90f273edd0349c49a7b600d7775b9.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE