��Xh���5$D �����7�����?!N��(��7|g�Ah��z�h8)��rĬT�mF�Nr�Ҳ���9`�Qi)0ϫr�-�8��5�츍T˴> "FBG �S�,Qt���%�ΚrJ ��bu� =d�ƠZ�w��w��W6�7ߗP�N(^Բ����$ 6�t���e4���ϰ.������ؿ�Y"��w�ټ�p��!qܼA�ȹ��}�v�Ne?o�� ��8?Mכ����BeV^�����H�P���rQ���`xj��~�>���D&`?F'[i���5��)]�8_Or���z#��v��b[�����ؐ{�kH�F�F*��JD���%]��4&B�$.v�s$L�����S��?mZ������3@O����7��s %���6�a}m`�X��L��H)�N"�7s|\�9%�Ҁ1쀾�ë%�����t��E����h;�.�fPB�5fPi]~�p���> 0YՃI77~���.���-L�&�e�0AoI�����k��a���~��]6�E�͐�7�|�<uM�8�8t��R��1s��[ź��}��lg�V�3�q�E{�0E���(�� ��W㺥�WF�I6�ek(�R���@�J�1�{��`i�d�Ų���{(#�f�,�R�+[��b�U�Y�dSZo6v��]1^���j��F���'�����'�W�Y��J.f���]K �h�h�Դ�����I�ƣMm�(��y�Gn8���u����acM�#����-U�@�@��V�e!&}�r�u/֗�U���Mږ[S��V��� ��v��e����J�L���皴)�ݱ �]��N��y$���D"BT���;L����s���c6 Ζڎ� ��B�ڦ&q��g��G�w������� �7��Y���6Q7���-w�y]���g㪘Le]���f5KP N��݉_���d3�/Q��C�v�sx0�dE^ue.!֮���kZzE�Ž���>�/$��c`����0�ď�C7\곙�A���� q�e��f��=�mҍV'���;������o|{��ݳ� :a�e*P753���>��Y��$"��m�~�i�^�_H�>�K5r�W@zH%�в�K���ܽ<���"���}}�0e@�<Ε���b߀�p�"�:&�%j�V��BU�d���?d��3�|�Z*�QGS7�K�B�B��l�zR*eāw��?�'(U��6�<�#Q&}\���+9G�(�!�e��f�f0 ��7���<-c ��$=⬊�Ɉԟ�������$! ƍO�$f��&DSbD' ���|� %ɟ�H��/mAn��?������yecC�����^���-Jz�e8=�����X6�jm�S �T7@�d��ӣԐ�崗(1y�FZ�����t������ ~"�N�'WV�'��'v��~s�ЗGI���9�`��P��"����,�A��p�Z;����!��d�.���(X��6�wG�5�F:�x>��������e�λ����Ǝ��r�RP�1���+9�=]����V�p.�����7�6 lR�, ��3�k�qP���>!�m\�-�O�Ggo��D����'I��^�z�DV�r�J��7ު#rz�8�.�W��@��%��Fǫ�����+}�<H� �`�Y��������v��V�|�{�����!��(J��ȿ�RZE6�c�̚�.��|�!��[x5��O�l�'���7� �=��Y��6֨�����.���z�an�2����pØv����W�j!���ܹ��V�s��!�9������m���W�KX��|B��Yk�x���0���鬌�2� !�@�(&�|�*"��ڜ�';��6ܯ��X��1Ò�[s�B~�&��C+߶�ָI��p.eR�j�6� �q9�4�@�"�\+�e���cDہ|��1�~�I�I6��}��� ���lJ؛T��c����4�d+���>;����qQ�)�w�N^m{�j%��O�C����i��&�u�¬XE^J���z������ 5u�T�KVۙԨ,��v#c$���xj-kWK3�R�=o�Q6� �%� �zK@8\fۜ�s�=��b��B�����sk}�ƺ�!El���-q��<f/t��l�y^�k�ܣl.�N����Ik?v�7�e8t�ǡ��Y@^��@Y85�2W,��q�fX�V�nT��lw�<���Kb+�������_p����wO����H1������¤Ѥ(ɠ!M9#uG�z�P5��$�`U`Y8,w�D2����~���`�qߑ1@�E)2���v�c|(/|����Z֘�^KA`v�E"�LW�����L�P�s�=�=`��Z� ���M�AN4QN���4�v\��4� �|Lzx�ٕ�i*�X���,�Y���n�Dn{�+ >��f��z9 sě�n�3f.|;Y/��%姢ͮM����Tg�'����"f�.>�s�{;��l����'{SX����ҫe_�����4��O�%�2ݕ��� 1鬌Bl��y���[�̴�����x7�|���C8,vm�g��>�Ă��&�y�vImg�7��}t����S帙����R��b��L���!>��܊�ntG�`��6�J�ӏ_��e�κ�9��O��X�P��TӀ�N��Y'�HEO�q�0�[�m!��I���ܾ\�h�����.���Z�Ԁ����'@"X��\슷��?��JCcߎ�0���~zr����>��n%>C?�ZO�q��-�-��?��C�/O-���U3E;[Ցkf$~���3����|���搫5fC�_��i����|@��}���ݦ�sX9�@�V�JD���*�������{��ɡ#� h�>��^u�R��yX쳶{��� ^���f�� c�8�|�̝�`��3�ث�wt��z��$���wΓ+�c���^� QVDB�y�Q�|4�h2x�m�<�ӆ��P^̀�#�"ko���C!��J���Ai\ꄁp I��$���FB���y-�F,�HFL�K�^ջ��������A�y%�|���n]6y���=@s�$V����:�(��j�L�%�9Z���v�ԣ�7}� �s���B/J��F�9�r����"�'�1N��*��:]G5�ee!·� �I�y�f�iQ���:����h���h�w�N1�x2%�gK�N��u����\���V/x��O�� _ӠQ+6]ĪQG����t4�$7���Ҏ�*F��9���%�Z :8D�#�&b؊Ȉ�N�V�<�DA餮��8��5�g�h�����s����^����I�b��F��?>o�T��-�m��6H�59�՜�����ʢ�����sɜ�^��Hev���!K�u�Z9�G���O:{4<���n�It�Y3�gE�E�_.�Cs�v���?y��h�D��?��=��J��p��1�,B݆�q�:X��^[�<HY:�r���R^J�H����p��՜Y�b�I����F�V}�x�|b-@=�ݒ�oK��W��5�Y;���U�$������3�O��Ab���OX��d������T���F}�*4�O/uhHF�r��&���ͻ��d��e��0��gp=����.}<F!t��c%��Ϩ}l,w�%�KH�L��ɄM�Jb+�3a ƄT��w<��;��%�
Static task
static1
Behavioral task
behavioral1
Sample
577f41e8e32929250b3a23da81765a35a3d7099bb41277fa9193b9790cc24bd1.exe
Resource
win7-20240221-en
General
-
Target
577f41e8e32929250b3a23da81765a35a3d7099bb41277fa9193b9790cc24bd1
-
Size
2.9MB
-
MD5
f5d6c70ede6f72c83d69747be1c1658f
-
SHA1
49315b02c82520fd99606d19a25d79e620129c18
-
SHA256
577f41e8e32929250b3a23da81765a35a3d7099bb41277fa9193b9790cc24bd1
-
SHA512
d80664bc737710270c934184396ff91e8b81473b8fec12e3bdc0f3c3d4d102e65ab028006bd8ffdc54dd923b7780e81bc8f3427f4ee011489142feac47630dc4
-
SSDEEP
49152:mHg+r1fKoaDVjgqJWSQW40MLOcmPyHVbuoPnfbVn3KUoPzcae6vKkHtfP:yg81iFDVgbSk6HyHVbuoPnRn3KUo1hft
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 577f41e8e32929250b3a23da81765a35a3d7099bb41277fa9193b9790cc24bd1
Files
-
577f41e8e32929250b3a23da81765a35a3d7099bb41277fa9193b9790cc24bd1.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE