�.�X�"]��y��d�Txg*��m<��Ʒ[���A�&%) � ���F�S�6o�KT�Bvp]S�H��X̟���#�\�vqg��$6�Rb� q��tI��=�^�6p˭µs���J:��7�L�^t8��(�>����1��+ ���T���^1!�_L�l"F�k��ท�U_�`�o��9������A ������n� @��"���5��� �ϚD����\�� o:��'�<���z���!��N?{������r�v�p� ��v���bu�T^ �}1q�50�� r����;B6�:(X�8#�'�T�#8�Y�x�u����7f���cy�y�1tk���0�ڿU7�`�?@��P���gQa&V�S{N���_b�b=�2J#+Kq����S���\�K��>u��v%�ܝ�v!�(WM5����N� ;Is��' ��O�<�V���h�bC��%a)|1kƗan��|��q_����xkK�7�AO�O'>u7��@���Ǖz��ѷ�s���4P��ƅ&e�t��J�q��f3$JjǾٹ"��I���*�% ����.��Z=R)a������BHC=0Y�Y}��<s@@G�pD�d���������+����s�Jx�eR�|~��wL�O:%oavE��HT�ޢ�F62u$� �Å%0z���%@�o��Ƿ������Bhk6|&ƒ?�R�5 ��N����P�T�Qyb����� �]�0��z/�f#�9��{V�<���v4�_����o-W�ɯ�K����r"#�Y���I��]����s��!zM���&��G�8�k�1���������/�ܞ��h+z}��������h����T�3]�X����^��wJ�u4�yno$�\����]ۥ��xZ�IE ���ʫ��q��c�YM6���5�]1}6�ԶH�*Bmv��(��E8�6��Z���>��Z�"�8��8j�+�s�;l����7E�/1팖m�=soT�Ђ+e��n[�Ov���?Q~�ioH���U���h��Qō�� ��lME�nPϋE�0X�Y�-��4�r�/�Byc�>75�R���[j�����q�99��l�Pu=�ܥ>(@�2���(�χ��QP�a���o��}�D�o����$(��AgK=4�ܮJzD�|��������0I��6�9�!��F�O����^���9��Ԧ�Y��S�z��s�G���W3{�?����,qt�z���io���r���p���K~@��kp<@�Þ�e�d^J悵G�������vP�RG%;xL}��(��~��[�ǐ{ XH_n�=���t&���>9�b��]N1f#e�x]��^�Y���_"��@�������|����~d�SG���, ���f�pE���$y����i΄������{h��1���5f��U`LN$w��)�W�qV4腆(�91�YW���� du��9/ӊ��W�&2.����3t�0����|��C�N11 O_��W?���wU��H�^�쓸��J��pN7�~6�K��)�6a/� ���l)7���� �Aѫ�S$Z��t]:U�NSe��7��l���פ�i2:��]��{���= yP X�_û��P퓁������ǡLp��=6�y ���O30_�n�y9NMیxϛP5s_H�M��W�\t�!�5:���g��ԁ5�Ū ��w2 ���7-�����@J�º� \E3�*�=b� �/mX��L�6ܰ /�C�[ٸ��|+VX,�ъ\)e�ӎ�HVX����L�T5������+O�f��z�.� A��>ցl ��c�KS%TP�������A�>H�8D���[�Tt����������ޔ��b��g� ���+(1�R�ɡ|�ȡ�����U|0� ����EΌi�}3�@������}��U�������HJI�I��x �9�6A�ߖ�&���_�ۀ�u��� W�Օ�U�>y��N��W�|����sO�����=DQ��FD��[���>�@�4i@{��3cO��T)us�m�-�~�M!�OWBy������D���c>ߨ�������Sz����$#��凛D5a����oyؠ�����m���d8���ˀ�n�B�c��vr�'=d�~+��]���c Ԕ/�N2�$x��O��l�`w �A <�����D�=K�h��e���j�$!���q}�: ����R����%&��sǫ�jL�ӻҘ1��2^�+Ux�Ap�_/KA��i�Y�n�r�ǎ���t�s��%S�х����z��*<Y�p��f�5%���=_�U��d͎��}�s���y倏rj�,q�U��x9�R ��YYjF X�2�3�#�#�uؾ��R��N%mʧ����t𣆁xݥ���i�E���==�#Yߟ��8�|������,��%�P}N��k�%���0�=sgoЙ쏄��8ټ�j�%���Z��N���JUVy�M�IK��ۋ��f��U_� �{k����){��Y�Dד��f�*��Yn�ȭԋ�3���� &�cv�َ�F��Q�53��97X�7W����fp��wF��z��h�wO2�mM䘽δ���:�+�X��d'�{���;��Y*L�[��ư!���O��#���#Sѿt�?�}�7���`�T˽�����- e�����ދB��fYU��c ""R��{ �;���g��o�&V �ț ��nBnB�&�P�hu����ؼ�=d�P�O�kqB�r7���#���u��"�~�����~%O���۩nH.�kUN���]�#%�������=믿u��e���b������v����e����M1qM���ޮ�3�rG'h�|��3�n^Jq�����7�1�Y}����X��W";�K�<gs�Iƀ�$�>�[&?�++�̚�Lr�} \|_�x*\,�}�8��L%���v1�0� �k�>b�3��{CzY@vWEW F���~0�;d���ѡdd�Y>�By�E�|����vx��N�CvB�%)�7E�o�w���櫣vF��9�+��k!p�=Z�M������]����뇻ڧ� q���Μ��Z0��-�s`<��8�M���(�������x� <p��?Voe��vk1y��0��k��b*�2�sȭ,�����2Jq7<�'�g�f����Oj_>�B�Y"�O�e���N�*�&�Q�q ���i|�-K%�����Qa-ݡk��, ����}��aȾ}לR�\/�ƶ.IŞP#�"�.���!��yYY*��bL]W�h��Z��.(��U�@:w)Y�=��e���`��$ +^����}��1�b_4�1m�G#��a��8�m]~H��zQ�����ɽ�դ�X����y
Static task
static1
Behavioral task
behavioral1
Sample
85580d774d770ca3a8633ee23e5d31c3a2bc54d8e4666cc4949433cd69621171.exe
Resource
win7-20240221-en
General
-
Target
85580d774d770ca3a8633ee23e5d31c3a2bc54d8e4666cc4949433cd69621171
-
Size
2.9MB
-
MD5
b0fd7b7d80ea999859d9d1741c03c35b
-
SHA1
b9c6c70b8e5271cbcb168da0653d74f55d4d5b8c
-
SHA256
85580d774d770ca3a8633ee23e5d31c3a2bc54d8e4666cc4949433cd69621171
-
SHA512
270d92b6d336ca9c62f75d3bda5129ba8336494e1124af2daf6243a2f6486c3a7c72cbaa1f5caf67d5ac516854039d431433e445c30ba34d3767c6eda09b56d4
-
SSDEEP
49152:fKr1FVQw/0Pg9HQUtHqhpKJCo6pWgOKo3uj2yON2NT/7sBovH0kAkM7Bn0eyg7fP:fKrXaw8PMHQUtsMgp8KV2yT5/QB2rzO1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 85580d774d770ca3a8633ee23e5d31c3a2bc54d8e4666cc4949433cd69621171
Files
-
85580d774d770ca3a8633ee23e5d31c3a2bc54d8e4666cc4949433cd69621171.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE