�8�H���� �(Q��7���D��%I t];n��R��{�X/�E2��8��d*�� ��틳%�8�1����P�Շ��lT��N�9�V\D��d���W �q8����F�9�8�&Q��#s�a^%0�]�՞'��� ��G����PI� YR/{B�퍌���8ed�@ �J �Z@#������qH ���� s%���[ ��(��T.;0t���'D?ʴ:��ԂL���$K�n��؝���E:-��3�Aml6+F����P�~0:g���LT E�/,ݾb������n d�a���\�&���Zϟ�����"���`<��0�0�Lu5"e��D~!3ߖ�M� �)�f�����Ŕ�W�����V*ط4��_�KW���^7��3����FC(8T�����=���̟�5�\�E5�·$�'Yk���{���t-吋���za<I�CǗe�q���4����⻝���MB O���Fa �������5�j�y�(��u9n>�7Bă[�$\����q~h3%�a�:BR�D�Q�dg��s�["�`g�:*2����z[����E2ږ���+ב�Zʨ'���;F����(�><�I�K�Y�����u����ٌ�#O1JK]�����A���r���#.����ƛ�Q �{́�B���3`�����jDFR�A�]��ʻ*2��ݐT6�D1Yi�f��)����b��*c�Gn�\�W�M�7�m2x� ���C���LG(Ҥ��C(���k�nmxh��S��"�(�iR�"`���I�=p�[�*�`��,Тo���N�$$��w�M\q6u�ȅN���L��j��u.���a����=�`u��(�A�S"�Q�����m�7��N���ȱ{��iS��V�|�^��77��G� ��~��s ���7���ԮO�-.#��n��qY`F �F��C?r_���z��{�6?��WW���1j�9[{B�/9���r��\昼Е�;pVr�����<�r��w?�z��U� �[U'~o����r��BS���&��/�.�+=����X�_�l�K�7Lj�=���ݭي "?�.|�ʪ��龭´ȼ���0�_V�e�֟��h�+뙩��� E0�N�̙�Pt�_PL�M�v���onH1-���I�@�K1*��ܺ��ܾc�� ;��;����a���sfp�N�vG��W]�$�7�@��F����;�WZb��7k�yv���^��"F��6o�niQ�v�:�<��D{Ta�; ��D�E��CR�0�8�~�)3D������h��̇��w�On�]W��Q��Om�]�y6�x��>�� A�b�������H�V �N$eө������ ʥG�����P�E���&"�4���CWQ|]_��X��y���&(줴j�Y}��8��|�� �<Ck�t^����F�Q����S����:i ;G����. ��4���L�<q������H�X����w.�<�?t$� ���K�g,:[V�4u� \`Y]�<�@ yC喣G�މ� GtD�s+�U������>����0�g��?:�Zu��cu#��Q���Dk�F�JK��}���x?FT�� l\��M:����%�*]����@���ɑ^�ٮ%��͋�ޅ?�{��g�Rj�����^5�D/���X���w*��'fj��$�vl]�Z�1 t�s){��1wt�������dᓂt���GtѬP���AŻ������Xl<��&;�[�'�My�*&pC�<�U��������F>�6�d؆g~O+��Q�1� ��i� Bu�����=�a������A�S (����f�(�%h��UN���x�pq�Jz3є�x!�p!��2�GX��ո��&xd1j�V��Hf��5Q�Iɥ��� �,o�����:#W'�ܟ��sY���\TV����qɌƵ����B���.���� �[ .��'��xH����������� �(��o���;��L8dG0X���qh���������i���-��F�|�MMn��#��!�7��J��qNH5�_B��Swe�h7��U�_G��pA�{,A9�ÛfTC������jh`3��9A�~H ���fjUJ��]��������@Z�p�p���Д���5���ȷ�8�դ:�y��Rt�z����Ъ�C���~%����+�^�dt�H��7���h���;LN�yoglP�5�ކ&$�T�\$۽Waw�+���I����֙�?�O%B?��awS��B_�Q�3'�#=!�:������n�9��Mp�uZ�|�8f�Λ�Ӂ5E�Q���ߤ�s3i��nMUj��ұ˩{&Ex?�X���%a����� t��W�D��H7��`J �I��O%{��Z�#)!��6�^E Ew��>��8*�Rn6�ꑊ"�gA�����['��H���^;�x�^��~�.����mj���l;��LƼ���,�B�݃��]���l��uZ_5�ȧ ���毉[��"��Rz����V�V�����3{&�D�I�!ݔdjw�����l8:6i9"���I'��L���ZX��.�+���o�7�8ְ�ݖk3�bV�KB6D~g��X.w�ptM@D�w�����t��aV���r>AX�ڎ`���ٗ��O�Nw��;�*��͠\���9�a_���3 �Z����u�#f���QV܊>�_��}A_p-L�}vX�:%�'�ǸO�좼<"�����S�4-�dwr��;!�k.?����m�1�;�8k�&f@�r$"tm �v�9�g���t$�ŔyŪ�S�QAK�}�w��E�0��\a] �Т�)�OJ��ɛ�Txc�����B��o"���\6gӣ}D�����]�\n$]�B7~z��X}��&��ԭ�NB���=3fe0�%~)ܑ�����`��b��(�@ɴ�?�$��D�e���� ���4��ޢhT�6��gӺo��bXK�N&�{��S $�P8��y��z�8\߅�)@��%V�0yjG��~���q�M�ξ6�}I;���Y"4�&1C��4�]?�Q�M9t�����.�E��m��a1ލwn}y��-�R�h�2���U�d��@&#�����R�FA�{��s�93x�;��3����������a��l��y0|%�.�aH�t�8<�����G�,�O��GJ���� Y˼9$0cU%���% ���co?��쭆"����C1��ƚy8��z�l�y�0�'�7}���M,�g����0i��
Static task
static1
Behavioral task
behavioral1
Sample
0b3143ef554c91418352bad47585f828800c6636be16e1fbfdb0263a2c0f9c4d.exe
Resource
win7-20240221-en
General
-
Target
0b3143ef554c91418352bad47585f828800c6636be16e1fbfdb0263a2c0f9c4d
-
Size
2.9MB
-
MD5
6143b97f6feb8e4cbd48686c2c4462f2
-
SHA1
3e4912cd27a8a253a3ff02601777e4b4503e1c2b
-
SHA256
0b3143ef554c91418352bad47585f828800c6636be16e1fbfdb0263a2c0f9c4d
-
SHA512
7aa6e2b09a810347aed4355906c5e9fa3f0bd85cca4173f9f4bb93c60a33931b19fb0582b881eca3aca17a3536241a3acab4f17d30e19bce1fbe1c4dc514c2d1
-
SSDEEP
49152:LqWJse/vFpDHbi9ogDYJNJku7gDQpSaof8Us3XV81wPs1SHKeNNVOd6w0W5vbfVk:L5l/9p7yofJf7gDJZu1JPs4HKsNVCQWo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b3143ef554c91418352bad47585f828800c6636be16e1fbfdb0263a2c0f9c4d
Files
-
0b3143ef554c91418352bad47585f828800c6636be16e1fbfdb0263a2c0f9c4d.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE