@��3t3�Q'����P��Y����++�9ʆ�&Ⱦ���i(��k�� s��t�B�E�V����&i��р��Y=�2�� � S�̢ov#_�P���A���AQm¦��9���B5zR�H���$w2�E��f����tlΖ����G'.>���V����A5#V�S��I-��R� ��f��<�ɒI�0Mh��q��b/)����C��=�wvF)�֩8�}y?TDk����Apa�0��2�j5,��{�as�f���Y��U]C�S7s[a�S� �̵������I��km�O]s����@4;�>��d>M��oS�A5��� ۮ�i�`�,�um [�Rwh�@��7��m{�|A0��6�\��;3[�w�ݓ��`��[p4��j��ыJ㱍y~;���ϚF�I<DS�r�+A扖Ǡv�;i0���>C#|SAl�X�����=�-z� �����+�ScTG���*��JLA1�$>�E�?���#>ħy�Z�H�+d1�����5�x�n�~��l�U���s�4'w� ����0v��L�5���}JB���pj���eD��1��G�?�������&����yE�аs���f軦o����ʑ��\�v �o���Q�QZ�kZ���Ng��-0�s+ۣaںyo���o�1N�T�9O�|�u��x]`��g�{9��?z�ɹ_�����5:ФX9j��\bs���y��Ki�H<a,n<u�����aa�[f�(v��I���;k���!p�e���y�V4 :��EN���r����=�"��֍��� ϗp���}殢g�0��b�D�����8��-��0j�;�%��42TI ;_��ժ��˟v@��DA]S;�t� �'^2�������Գ<��ue�M\K'd��rx C�����j� �ضFA���u,����Q�ƻ�U�]��2�I�=��Z�[L��~��'�8���p�;0o���������\���L�]�~>���� ƀW�v�ಓ��`h!�p���v!�`��P�'��?��� \�W���^����*��JMr�0a�}BHFZ���7�Q���1���̀>!L /��S�Z=����>õRn���~�b������-�2�g94�L��� !��.� � R�L��������b���.Gz�u2ը�հCF�B��2��ZQa���_Q\�Z8v�C���5xw� �Q=y�@����i���ـ:��� >s����5��kP)KO����f*�8�Y�Q=�WOe�uځ@���tn��Ϫ�"��A��'�ʱr):\JM۟$d@�fҳA���~�(u�v�.�I�o[���yƗ����4���?�aJpY� *���/Y`�����N�/����Ƅ ��@�-�жj�-��9�%d���Z,3$#1 ��.������s�8x���t�������K����u�{����>�[�ğɫ���%`��w��b*��&��\Ҙ���_��"��X-9`NK)g�2����x�_d��i7��o:P�����9+�-/c���F}Y�lG�}(����Q��Sd�#���*�������*K�w���VvJ�T���4�[����rr��a���l�����Y_�� �8�9 /!�ҐWKdq<� �X̬R��1�|]��H^<a��)����� �+���pX㯆�|���3.�H�b˶2)�DWO���&��k�$�3���8�6p�t$�S��}�s�Q%g�)-���C��f�q���"���;#�� ���� ��g;��j�dO#�Fp�u�uEu�����Rѭ��Ǫ-��8nW%s?�C,��=��N���@���y�Ԇ�o 2"��OwM��T���&#����;�P<��.�S,�89���jx�v�"|�����l�9م��)��1����[ H�-; �/EË;#� ��^Lj�Y�f;���Pb@L�uJ+�o�{�����0�t@�)8Ǿ�k�S�E���U;X��]c�hIw�te'I�|�)E�k���(t4c����B�2+5�Z,O�g*�U[Ue�u�z�Jk��|�?|G��N�b��5^�pz&����Z�N�������S�>EMHoԈ��v�#*O���A�^���C���u����q�y��e�[nNf�|?��}t�c���p��~6ߌ�h��L�������q%c���V�S='����N5��d������p��؆/�t�e4�4�ÄVLy�7h��^�=�Z�'����*q>�DwbM�f��잁�e}A�y�:�W`$�F| �J���kv��XHk�r����$'J��g��f��,B����h�鰡�VǠ��/��\��r&x��:���{X\�r�8���T�62��aJN��(�J�{��{O��f�[|��j�_/��]0�����3��ĉ.yFGXT���m�$'���w��)�?�P���J��8F���-9p!鐫I�õ����W����;��N��&�b4���$E���+��w�C��w xCar�=���[+4�P�� ��dj~;��E���wy'<Q�r_M@F2"��C�p�VKe31ލ0!�Ε^/�&��i��C�C5�!@9*] �nh�c}A-�;��n�D����M��ݻp�u��F�bY�P��ĥ��PpK���V����(�)$g1�Ev���<��Ѓ�,�8���Ϧ&^4x"VFK�_.��:��o�`��Q��x�;'�r$y����a����_��Q���#ќ-=�5�č�@c���x�`�s|(��(�J���"�$�d�%K�^��t���M�a�w���慞����uæH��N�֦̋� �㥙J#\�\�?I�.Q���Kd����V>`%Ͷg��˫0��L�*K&���J���(��[����h0�'!�����w��Sl:��pɪ<!+�@x1�*>�]+�f�ms�9�Y�6�Q�,�Dľk���nvv�gGjgv��A<�A�Y�ky-��AR `�ԩ��͋�.>��^S��s����%8����$%��0�X HD�[���Q8hy�r�_��y&���a���|g`�Iy`i�y���X(Q!�R���Rh����� h�ss�J��`��v���� ����t��R��Un֍/�;[��x�D�d���C���UϨ�o&9Fg�6ؖT�'��{ ����ٶu9F�$ꊸ��p[�'k�=a=���#-�8)�ZFLCW;���������1w�ଗ���3�{��iN�~�<���m_K�g�Ȕ�����ɩ��(��Z�'+�Xɹ����N���cX��(��A*���@�$��ʑ�k�_���*�Ă��:0�{o<����x 3)�:�v?8<��۷s�O�3�<T)c��*+/�)8�$��i��������ܻ�ϕ�Y�OnI�(Rb
Static task
static1
Behavioral task
behavioral1
Sample
950bc1597132228444fed90e7b8e0f3173b7eb2c1c4867fe7cb775ecae1c5410.exe
Resource
win7-20240221-en
General
-
Target
950bc1597132228444fed90e7b8e0f3173b7eb2c1c4867fe7cb775ecae1c5410
-
Size
2.9MB
-
MD5
e33f26bbdf25e8aff6305469e263a6e9
-
SHA1
a8e3646bf31cc0b00a554cf640395076bd1cdc72
-
SHA256
950bc1597132228444fed90e7b8e0f3173b7eb2c1c4867fe7cb775ecae1c5410
-
SHA512
25737839f966853f257cae92f6732169c9befdd6d14b5820f85f709efc96784aa1229737928cbf3009a9305e07d0fd717ff56f865caab259bcecb3e0d3a430bb
-
SSDEEP
49152:LhcpTlxJRim0hIGCxy4n0zpyE6k48Jk5YVobYv5orupuzTb8p7d852SRY:ETlx+m0hsy4n0t7WYW/cuz3Mq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 950bc1597132228444fed90e7b8e0f3173b7eb2c1c4867fe7cb775ecae1c5410
Files
-
950bc1597132228444fed90e7b8e0f3173b7eb2c1c4867fe7cb775ecae1c5410.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE