R��\~��Q�s�� �����zh�#�#�7�µ�W05�%� �;�ŁlO�À +P��-CGT��0��N���f#קuS��qlc��� |��O�,=�B�8Q�=���}��d��I��Wh�F��2��0����@�&/����$ �'%E�:�U7i������ך����%�ҘJ|��i��(�����oi������)q��abq�˂0��wO8��b#oљ��)�d�Gn�RUYxfr(��ӄD���0�N?����e8Ӹ��%����cu�DH>s���|֛��c�Z�f9UV�fH���(p��T���V5oLB��t��}�W���2ꞧ�.7��������S� �!m�X�ET��Bs�w����?;/�o��iY*%�fHa��Vu�~���]�u=�!a�'��DZf���}/m��Y��}Q[�@���L��dt �j��BѬ�W[��n��Jl932� O�-B�1��42�Ƕ���������\���#���{N��@ �A���>�[��EbԊ���!N�v�}�Ɍ����k�o���z�(����z˗�:�N��ȃ�LK�yx |�ҕw�8s0+�L #IR�ŷE���V`�q-��Ԇ��[1�sE5��]8���hm %&z�Nc��0���t�����@dj��j_�aÅƗP"���|�qG!��nT�S�T�� �Ҭ�����C���K�]���@�d��!!���[t��;�;D�ȏ`$Vc��+K��ë�F_�Hܷ@ނ�N3jL� �nذ?)�� 1��fr9r�t���5ɭ�pI�#������R&a��x���~�=��Ga�Ġ�#D�7#>�<���Mͬ3����j��Cn�g�k2�հ�II�@1+d&<�fl���o�j�c4��E�Q�U��e�k�1���r$z$�di8TO ����?�C�[��\�YJMF �S!�� �:���&�����_=qV�G�N%�.Wd������7^��̨ݓ4^Kp����>��g��=�%i�gp�L����Zz�P�Ȁ2����2{��������2��:�0�������uHH�DLB��Mݢ���N� ��)�ѯG3�9��<:�������s}�^E}��9ϟ����(Qz��n��~��N�w�]�W��^���u��1`���Cx^��k�����zǭR��r(`�@��喙����k^���,���C Y�>VQh%Hl������A�Zm$~9�`�(*I{���F�d?sB ��s%&��T=c�Y���?"�<qR��oۓT��Z���^ o���h�.(QA�����W�� ό+�Lb:"��l�2��!�j�1����̝���Q0�C�W���Z��k�G�����I��Y-�`13z5��Jl�-)�����^� +��U�^Ҟ����la:� �Ĺ��`B��:U68B�?&x.��',LaI��.�.��2|��%M>�g�o����1㲨~ (��zU���p��G���G!����e�v=�&�יǾ�KÄ ��[�w��.ق�⻤����~���~�3I_����ٚ���#П��P YR!�M���@������I66�z7��s��U�ukc=�����"$�������p�./~y�Vۯ�������LN�&1ђ�Rt�B�+��hut��{J���=*ߜ8PdH4��RV*��S�kvՓ��ԓ�/#�k�NZ����:��mA��w�ϐ�1�Tsh��"?K S�.Rm#��rn� � .�j.0�5���ȇpqQm�.�7;��;���_�L u���ͯns#o�q��窞 �4So�v��E���Dkܳ";�Z��Ʃ����0!���I���c��ɯ�Gv� ��znU�ِ�Df���w�@��2��_m��R��K�˽�^����0gK̩'3�����t��<���h�/!y�Ʀ�P��=��@&�L�&P�������O>-�MsJ����?Y}M$e]p]�^�7=��C�`S7:[EpD`c3:X�<�o�4�� _3�f9�Z�u������&w�P��¦�>ő��5�(��X y9M�X�{����O���Nl���D�o��aN��ez/�"�oZ��ݬlL�Β��w�g@� Gj���ݩx�f���4�=���DЅ�hw������?j��nT��/�$�09�7ῲo�R��Xu�U1}Gz��p��t�f��4D��}OZ~�� ��S|�6�����R���"�ҡ�t��\k�|w���-T�$ �(���cbĮ)2����<i�-��5@��@)��@tR6�p�<��������xe�$Xrm��y�{��IT�(=�۟&������U�d���f�B:����m�w���b���������)����6��M��v��yDK�?���O.r�����p`1O���>rH��g_;�%*�z)X�ztn�_8y�!�� �G�/&G4��V�%� B'����=K�N���l�Za3vcr��Ռ�{B�v�\�}(��!s��ؓ6 �X0]�������Og�ԙӝz6&x�{�� ���`��?�ē���� �i�e,B>�;i����i��� }�6XI��ف5��d�������^1PI�&e��N��n��)�����ߵ�W��+�V�G����-+]��� �4n��`xk�Zld P�{�����F�������4�����9DЄo��(��w�C��j{��"� �� ���v8?_ع��z�n�Ґ���o�' !^J�6Q�"d���fXl�g��iK��Z }�#rVG��W�2t�������,�ђ�-��SJο�ֽr w�W�D];���TI�6 0VmՐ�.�G�x6�b[K�cgE(�I���"`�5*T�e���(�f~��TDjt8�������&��e9����,$mU���m��`b�ϝ?ϯN%�G�����h��)�7?�̬��#ʓM�ݞ^�5��>�/<�ؚH��t�����6� $Qwc��n��=n�7�����<����� ��o�����֡���*g�2�0+Z/�:`�� e�Z;C�.ǀ������*���]G�1�ȡ��#0�~����� ��-�KF��"\�b B����`�y�ID�≊qp�F�uŁ�z���Yll����Lk���0���S������ G� %�R%�JP��j�b.����N��G�;%6����ޕV\<_�Kjd'�Ac���l�;��F��o߮X=�������h�0�C7�O�\F���jQ��ܤ?9MK�We����Ֆ���b_�@�SD�;������I��D�}:�e�E�֥�c��\�#b4�q p���ނl�O1��DG��8�Y�7#��J��2��������>H��y���qr~
Static task
static1
Behavioral task
behavioral1
Sample
ff78909904f008a5339fb015d9b929fb2c6b45e228341cfd56118b40bb8e45eb.exe
Resource
win7-20240221-en
General
-
Target
ff78909904f008a5339fb015d9b929fb2c6b45e228341cfd56118b40bb8e45eb
-
Size
2.9MB
-
MD5
7a0b56697cf626c63f8f527836717c83
-
SHA1
e1e8556dd25a49c7c03db092a3fa781fc02390c4
-
SHA256
ff78909904f008a5339fb015d9b929fb2c6b45e228341cfd56118b40bb8e45eb
-
SHA512
8ece63e5177fede1349d9c0e99d0e66b23eb10e640d3a240ee92f80f284b3b8db40592c0ff714f98863e7449c129674d1ef860f7431e6db1b35a3d8523e1f566
-
SSDEEP
49152:BljR4E/D3J1BZ8idVR5N4D3BllSpdA6dhPdy2enMYgnIfDts8dPMq3xZARYUa520:rjig3JbtDPezJSpldhPdrEMjL4MsgRB1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff78909904f008a5339fb015d9b929fb2c6b45e228341cfd56118b40bb8e45eb
Files
-
ff78909904f008a5339fb015d9b929fb2c6b45e228341cfd56118b40bb8e45eb.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE