�0;�<�hTEV�V�x˻D����� #Ujo�CCR�ו�B�frcNw~��{���x��4�S���D��phl5~EV?]�<C��^�D4��+;�~����r��q��5����8|���(�8���e�{h�qGnjZ5�(W��Z�>}�mr dv^6/��A�},+�eȄ 3�,1e�JTT�{k��uI������xJ�䬱E�N2V�-�n}#Y�f���,t�(��'��J�+�/m��4r���q�zV�`����U�8A�զ4����q�J���u��/H��U����U��������6��EF�A��Jq�%���[�Ȟ���h���Ѯ�K�&��1�JLx��v����L�O7OE=��9W1�2�|W�n.z�E�z�T��K���@�ؒ���X0C�G�RF��I-+q���~K�R����c�z���y�Σ����A����9�J���F�����/ӭ������n/��4Y�4��'�����VT,f��6DE~5h�!sd��uu �f�Õ|R����9-cCЋ>�.�(�&6�3�j�o�1�ʶ����$:J�.N�b���������v�i2�3q�hr����b�iJk�;�D�� n "�d�fCA�2۶nP����qѧ�wv�'#��0�����Ht�nt����r��d���a[f-�G!�tY��b��nRx�}���n��v�Zbf�������n����ړg�D/|n������X"����-<d�^�-�K�i'�v��D�<�4H����?�>(%FU~�8*���3���:��W��b���;�Q�������Uߤ[`*Zg��u-��]GŊĪ'�8m�0UUk�l�P��}�_79�#�!�we���驝H]�&�D��J>�{���O����ͽ�ԆL�X�c���T}��JJ���$5$�Zt�a�[������#'�A��U��ŗi4Ź�έ�A��9J&����<p�Z��^Q��8�H�� ߃�<O��hW�_]3r�3:'uZ-�4�_H������s�S�f�5uq�8Y"�������<f�doB\���������اK�|+J'ʉ��D�>Y,7��,x��ؾ��uP"h��Ҏ�n5B �0(��"/���i���w@�`�����"'��6l���ݒZA��0��y4����PdA�D�IK]Q�ɳ9�G<�h�y0u)%x[p]Mn��J�$�yHꞭ��F�l��eO�����q�)��ԭp��,o��8��/!�B�h������E%��!&X�}^ܛ+=zs�)��tW A?��!!s��w��b�2��j�R+P���'x^�@�O 0}>R�����l;2؞l���F]Y��.�hE��\��ɱ6",߽Q�U�~��f�s����̯ �������DLoU�c��7i.Sǯ����F��SC��� �ŭnb�x�q�XC3y��qٷL��$��kK��b�����?`}����m�_n�V��ŷ�_�%�2u�h����+�����p�7\</�m�a�*F#LLu����'9�%�o ����&�X%y�Żr�|�����6��ءr]ҙ���z���ى?9YYo�,��] ]��+�hƬGP��,f�+�r uKJ/���B�C����r���i07�z�Qw�R?99\��nA��o���~0�C4th�im�y�����δ�bS�[ �r��=��b0t8J��^szzeA6��~�����9#V�������4Ѕᷱ�yY@Q��|��a6���0���뗀�XA=Dq����m�<��2^ޫ����6М�^��eFvk��:��SH��F� ��wo@���Q��-��-�3��V�P.�2�n/����4wE���*��aB��zB���:��_�v]�$�\�Y�67�z P��ӏ�X���'��F��%ڏR�Zp:<��i�9��̻���k��{���b��a`�@hԐ� �K���E�8�M�J*��o2�L+=e?��ֽ�0[�i�� �\ J�#A���+@2/��d���!���w�l��@��q(�i�/�.���1a���`�Li i�?۱̂����$�f_�����h��j4�מϤ�Wye�\�R�'ܲ�"����)��m�X�~���d�Ӓ34j�����m7y��'�lv=���*.V{i|_+�>+���x�F[�J�� ܷ'mϐ�>P��A< �3i���$���*�B��jɠ��$�K��I�_K�븋�ϖZ�"��g�;��K1T���Tw�YB(P����u�LM�&��M�N)��C����=�����YQCl<�䌡��+���ޓ��4�j���fk�ѯ���]�`][AyEGw�đ�D��1}t�9!S9�#��S�����5�T��I\3���;��My�m����ݻ��ê���"��L��B��#he�)�QP�C�+7�&<]Z�L���� ��!c� �|�f�/�ʜ�9�cx�:�`�~m�-�0��Y�^Φ/�`FOm `.��")����wu.����e� �����a��d�G|�n �6�go��:�͕� `��w,�����J�k�>�#���&TŻ�P�L�Ʃe��O+� �'�~J���1"�$�1���%�o~���'M$�C�D�|�kn?0�v�j�E���3��_�8����#��o� �t�t�v�s�|@�\ obzV<�v��H�&���[���b�����"w��)Q��s���\M��2�h���f��N�"A����-?�_b�6"��?��9�O��I�|����$��U\���?⦴���n���1�nW2F�x+xYX���C*vZ褭�d���;l�Q����mR��U�=ٮ��D���,�h{�fK8"X�G�JU�����q��MS�\�\W���6ܶ$w��nե_F��tե-���b�������<M�LQt��!4 ^��e���kD��d�)�"U$9VX(R4r�X20!r!>�A��T��{p��\���<`�����G]�����p-�l-<���YDW�Ԕ��1�{�2�m��5m�\О5������N���h7J���3.�0�n���TWB�S�B5F��,k�-L*pΠ��Q[�~ F6c���=��i�(/�͒�&{��PxU7�쳠$�\�/�e�����u*��-D`�B_z>bQ�J@�E�Y�9F �PMU%�Ue� �c0�\���H@F�=m4�X;�j��̞�g�_Fv���J���B�H,g�ȩ�g��t6���bܱ��W����BSV�ni�줉�7��hg̥�yA1��2�����O4a��<AN1��q���.:���[5�*���i��K��,��J(O �3�.�b6��%r�M=R��� �QaG�R�;9� �7�[��)�F-s�lՅ�Apb#�\�|�����HS�ĩ��y��+��?�C3�!����z�gMl����F/�?]��K�ᐜU�I�:���~�Cg1���p%�`Y�g~�:���o�/�4��Ƈ� ���k7��w�����5�2G�����UKe(� ��"R�H�Ou�ޔ>\���'f�1� ��9��9�Н�{iKjŠ @�I�;zU9bq�+��/F'7[{����ϑT��e���q�C�&�$�c ������jҦĚV5����JC6XP�il8�*^������C| ���_gAw e�~�2�@�ph�+��4J�����=HJ>����
Static task
static1
Behavioral task
behavioral1
Sample
2efee3c5c9b4df6f85c768d8aec415fe704aafb155f80bab9eb8db6730e48f2b.exe
Resource
win7-20240221-en
General
-
Target
2efee3c5c9b4df6f85c768d8aec415fe704aafb155f80bab9eb8db6730e48f2b
-
Size
2.9MB
-
MD5
238d9dd008e0dce8c5c6e48420e0242c
-
SHA1
87ccac9c6b27041305c92d6509ab7a20ab38d822
-
SHA256
2efee3c5c9b4df6f85c768d8aec415fe704aafb155f80bab9eb8db6730e48f2b
-
SHA512
9adfd96bdcd9bb89c93e2ffec7d4e5842c6a29bfc6019ffbd37915bf4390d2d1d26af384cc85ef77453fac7a20d43e39b3c15d9e03d83a880ceb9615faf15185
-
SSDEEP
49152:1fpjkLtCSNldSgZNJyHRwzZ+xlZCH0orZoKQdsN52zHhD4nR2KKzhC28fCiNolyv:1fpiNZZNKRKkZeUzHhDWKVgf/ily
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2efee3c5c9b4df6f85c768d8aec415fe704aafb155f80bab9eb8db6730e48f2b
Files
-
2efee3c5c9b4df6f85c768d8aec415fe704aafb155f80bab9eb8db6730e48f2b.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE