7v����?d�<N �����|q7�gt�e�7N�~ m���kf�X����3]qkZ3grO(2�Z�ey ��1 ��9Pt*{�O7dټ�PO`��mٚ�����Ð���C���,� 3�`�Ⓗ�)�â�]�e��rZFq"p���߮Έ�ڇx�p�ܤ%�j��f��܇�\~~��^o�QVU!��y��A���L�l]~z0�A�4kB5/H�I�ZҬDIC^�%��Gz9ED j����H�N#xR@KܨK�X$��Ʌ� " 7��c�I�/Wՙ������!n��ȇ���Z0���0���Y0�ɩ���J�uH��uO0����1�eNz�)�?R�}Y�c$S�g'� � 怐� ���=�������|�#pj�/�\ml����@T��m�_I�����JHhr`�/�B�Ŝ1ێ���P��Rוٚ�$ӏ����]����U)�� �J?�&F���Ƈ~f:u,�]����C��{j �]s����b@B��F될����6�B��'��Mob�1ѽ[�J�g0�����c����D=��}@���j�_��qM�/�]5�e���>��M�Qޤ@�B���e�l��b�B�<���{�}�}u���s�UXi?Q��Zf�63������E ���r(�:��w���y�i9�g���쯲�=��ܽ�%t����B�3��BdɈ*��>_��`HF$>6�瘉Ҷ����-S��H!�#B�&?Y-��N�C{�%!HXF��.��f��Q� �0�Ȼ~��e�\���\Gc�8RLT��#$w�%�X���Z|P��@6<�L��Q��]�CC�h�&��ݍ[CV�R��1�k��ΣT��;v���k��qw��]fG ��ھ�<8\�)r���L-���2:�CK4��Ԣ�>!꺏�q�M�eX�a-U�*+��W��d��Tw������繽�K���������� ��Bm���k�7����:!��s'�Dr���s�$� r�� X�s��'Xn�*���U�������p�KtYL�*뚽Χ���{mPkP�U�=������6�R&���jUˉ�h��2��eU�)KpR3�"�jX�,FR�~����u�dĜB��5ܞ��uD���ԬQW��}� �@�~:�����˟͝ OՒ� �+�r���M��WN&��jf��I���8�nH����BL��1-�lrab��Z�R�7|���W�� >��8jޕ�B���������縓ex�Mv�=Rr�T\+�9H"@v����Fs�e���8����;��*�����c�y��-"�jW�}� �Pm�u�}u��j�*?ƫ�aFy,��*VJ�F"��*�y�W\L�f�1��nšAxo���g�o4�1i��q�����Nq�7Hu�hs�$�d���Aԣ��7^�K�"��7ɚ�Y2����1���ʴ��%��U_��xz� *�C���i��Ul?>�9�'����/�h�=��0+w����X�w_�X��1��O�y�A�-���2�Êk/���jTooӗ���ao�c���B�n0���mV� *z����Ԝ����T���vR��k�����R��69Z#"�&���A39�8��p��w��̸�;ҹ~x�k�XL;P|�q"�^��;A؎Nk�3�T�dYP�����L3� �)^j�Lh5$�-��}���R��|�p��B��O����� ��[\����w��7��G���SI�th������0����E�j7!�%���M�g�xs{�Y�}��OY ��C���HҤЃ<�)e��2�S$��7�cѣ>'�c�U�f;���}� �uOyuˬ$rQ��uݏ@��T[J��\{�0m!�aӐc:��v2w�&� ���'gZ���/e�@/P%ЫX� XR�/�2R|�w"~������^axHGs�8_����&a �8nhaO�m��SJ{�#ܝ?�S�tEh��Œ�u�2;`�Y/l�g=2N��,��S��$P9��Z۽!�%KO@@:Q��`��'�)���U�% �e۔X��Q���+� l�?��\旒��<�k��2$KUmh;��l�K=y� �|t���b��mI���pnB^=�f��Ip?���+$}��$�8;��b����z��+"���g���BV"�h��+���b�p��l����m�܀2�[����Xo!��o�_������P7��w�5��UBD������p$2E�ϻ�'DγE�z�K��wNKa�v��]HIx��-9����<������~��:P �w�ǩ�,���J �n�,��������Hީ 2㋴�G�%�:��5u�rF�_ܢ�EU��o�"l�ܖj���M��&�L�:��кq��'r��ejRJ�\�7������mv�Y+����{?��2�7��~p���ҝH�Vl5��y�U�����rO��m"�=�:%b8qx��12���aF1��D,� �V8�;2NG��fg��&�Y�6GK�zqqR{��j?��F�u�"���b�����+D�����/��*51���V���^���k�܇���j����Z�F��Vp=�̛gB[�ta0g�m�TN�o���K$����O�D4�[�Lv�x38�FVL'L`��a|��9��7��n�ĺ�>����=� �D,D�Uy�L)t�� �objL7���F@�N��*�Iͺ��H�{VV���݅��on:��p��-��Pی]S0��+�%)����A��?6ѐ���Dj�:��?:o��j� |�<w� �ZW�ra�qGL�9@b�zy_o�V;x���3<��e�K�?���[=:�D��Q����=p6`n2��j��P�G�v���ԶdůQ���3wՌ�1i��9��V��d����j�~� �� -g�mJ�)����h���E�EAR�W���\���1�a�:�h��NǷ��nd�|�k[P6�����E�oa�[ �� [&��[+<��y:b8iEz<ٱb��B���PT[g�����W�< ��E��\ [W~+٤] �C"�$��%�Z�`ͱxYmtx~��ϡya6%1����z��PG�7V��� ��p��q�~�_@��9�x��� f�/.ކKF
Static task
static1
Behavioral task
behavioral1
Sample
e22e478555a4feeaa2b9fd17891523627f84764ebf05aa512d6baf3f9d6edab1.exe
Resource
win7-20240221-en
General
-
Target
e22e478555a4feeaa2b9fd17891523627f84764ebf05aa512d6baf3f9d6edab1
-
Size
2.9MB
-
MD5
1ee3319b8d339be77ebcac0b4df0b2a9
-
SHA1
8de1af7fd89e2cb7e8e6a1f0d62587eb94bcfdbe
-
SHA256
e22e478555a4feeaa2b9fd17891523627f84764ebf05aa512d6baf3f9d6edab1
-
SHA512
8a12fc18dd9d7ef6d97d565107b114ef8e8a964a56c5cf4afbc777a06a4f4481dbf58f92b210bd28b96834392595637bbbdf127ccc363f01c9066bd84cf89c7d
-
SSDEEP
49152:CEB8x3QS417DN196rgKx1RHohVoZ5lPtXTKuWE18rXzLssTf6rqmwo1vxETA0MBx:50QpJDSgURAV+7o1fXTfObbYxk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e22e478555a4feeaa2b9fd17891523627f84764ebf05aa512d6baf3f9d6edab1
Files
-
e22e478555a4feeaa2b9fd17891523627f84764ebf05aa512d6baf3f9d6edab1.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE