"4~D=O����uA�}H-���'F�Hx<�]|�>�w`��@����o�����cq,��k k�`n�w��=�}q7�RX��#��B�4\�iuT���,��+�|)S��{�q��(&�� ��y&VȩZ�$X�Q�_FbQ+�/�ͶgO��!f0��[Hr�w�ۏ"��#j�ER�����X%T�/3��\��`-ݣ_"����5�)� Yl�k�zJ�"��x�=_.���6��G��[�&X�U�@�8@��m��-��f��ݛ� �a������N2\��< I�M���d}㥠akA)_C��� f7��kC s��(��7l}O����̘�������!?�g�{�Ζn�\3���Cb���#B9W�dޖ�#2�4d�C�m�"�ߡ4%�Uz<�r�&�,M�z�K��]����J&0���hbb8��2Pv��Ko�Մ�L��Mb�|�eq{��+P/-^��.g�P�v�A���7�Z-XĔ�����˴���B΄������?2<� �E�/�����|vt����1�w!��/���席���!�k���0�Ŷp�7::- Z����2Z��� *5��|�p5���p�Y���_�KV�F�7��Z{)-%Y�k9y��P�58�U� ��Ac+�q;�Rw�[��9��#�N�V2�I�L4g�}�L@� �ZQSxDF����FS����qq�%�|��{�L�e)B`�+��ݱ�$nh�����}^���AUh)�N� �Z������Ĵ?��a+�'���܅�j��E�er�9��8�j(:VZ�<f�8QG�h8b���#���p�Z[�[��M#��!�*�i��:RF�1��n{\������NE��_�1��vj`]⧴���k�x�˧C�����27�n�O� �U�e�&��.[�*G���7&��q��e��@_m(_�Ze{��t���6�ύ����ڒ���3�o�i���{���<�{ ��c����/�&�p����мg���l%s��\��Z�®�pIVA���Joy��i3<"�)9z��K�J��/������\�3�ړr.�������)c���Wh����ܚ��2����H�nd��� 4�h���5zG6F�XZ�:D99]8��˷��p�������3|���L�D�k�H�Be�*�;�6 �����2S���F���}/k�B͐^R��sF�S�������xD� ��dSy�U�ޞz?�9���~��;3����FyU��f�Z�z�t�Q4�[��E�K� ��2��_��M���[�>a����7�H�.nՈe·���1�etQ%B�K���߳Z2�!�҂����������XY��&�b�鋘�d��L�� S��4u�荊'K�c�"a�QK\cO��R��z'�u4�\C�_�J�7�<!��/�^�=3�I�&�gWV�F��폋�2����҄��"Zk�"D����l@L�\��ʇ���* $���V�f6��@��[����.}�U�d�]������D�����L�{��h�9��1q��R��.����ċ���ٿ����l~����?�������d*,�ʫ�=FP�f�P��y>��x�/7�4!��̀p���R�6�\�QD�]�R�����D2�ؔ0�Y��������^]<�5S`-�&X���Ke[(:�p#���D�O���(7�i�����9�\��h�q��Q��8��d�I����𖮋��?��G��y0�B8O�R$<]��-4���VDf�ϱZ.+|E�p%����c������iL����� "�TM�!x����4ɮ�*APLR��r��$��������(ݭ# �o����تthq���^f� ���6>�Qu��L��f�P{A��l�Y���l[N��>X�!rU�h<D���M m�� �(��&���1pQ�����i��������u�p份H�\Y�#�m��$\-��'��Y���`t�!�ڣ#�=Ѽc�ۤ�p�த��5���゙^8��V\]�"^h48�·�1�zz"'�P�`�A��nvv�~�#U� Z�O:�rz=�1T�6H��:xO�u�Lɴb����Ϥ���l=�$��rqp�n�d�P����Ҥ�N$�$�,����y�����_�&^�s|`w����4x �8*�:������bP��e4˼�-0�g܌���ްT ԍ�&����)R8���+sh��q�l�8*���B���dzN~�����f(''%��D��tg�Hg��J-�����Ã+g�kR����������zi�O�i�Ŋ�V�^�<+��v9���M��h��F��*DuY���_i<�T��k��S1D|��� ��uǓ�����[�qZ��EvK)�� .c�� �`����P0Kg9/0p�#��TÀ%ҧ��'��D]}ޘ�q-_y�� �@j��n���1,Y(gj�ʫ�*��b�y�gi9��=_�>JE��O���hQ>�4ttw���M�T�ɨ��)�v)���� H�R�����f�k62o_�*d���1�}o��� R������;��@!q�c�� ?B#y���˚2���Ux�0.x�$؏L����1���w�#��8N���-����œ����%�3��{�2x����P"� W��#��,I�.Y��h���nۘ�����A���;�< ���ŭ�����^��4�|�q�h�u�<kO m���r����h�@���g%���#(j�xU������C��Q|�(�IC�W�[�O��dB&���s|���$%���#m))�����xM6b{L�'߭:�u��!p�+��N~��V����&�qcFw��/[ŷ��dT�X�����Y�����Vi��u�"����ǟRC5�r��Е��wt�;$��������n84�Fk���)C?�#R8�`#8�K�H�6ZH[t_%�����6qr%���u-"$z���)l;g��d�����r��b=��!�������s�+B^�1�d^�0�k'O@֨���&��h��v�^Ɖ��1�>��::��O��>�9�w��+%4T���ef��#d� OR�&خe��������+I��CΖcc��̵��"o�u='�%*�,�W���v!R�z����\�@9-�u���{�_����%Z�P�$<��K]mR3[��nml�+5<���������_����Yc]�)/,�����Guu��d^�۬�S�7���Y���ev7U�ߤq�to9�d�&g�bҝO:�C��OO��;��ә�`+{�)h���L�; ��o���iuI/�]T�S.o玣u��Q�~/M�%�9���7����2�4^�n�U����w-�,���f���|�-�g��Ԟ$���6$��}�P�<�s���HN��%�5҄�� j���w/J=�J��&`����2�w���E����\d���D@h*_1/�؝�ARL�K���ှ���|�aތ&J>VOS���=�O,���nK!�\�Zܙ�R<Fz�x~'�� Ұ�/O�;a�>�8�PW���̤Q �ڽ�_#��L��[a��7U�?x���|3�Z��:
Behavioral task
behavioral1
Sample
b7673d307b8ee78b2a48d2dcbac580a4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b7673d307b8ee78b2a48d2dcbac580a4.exe
Resource
win10v2004-20240226-en
General
-
Target
b7673d307b8ee78b2a48d2dcbac580a4
-
Size
11.1MB
-
MD5
b7673d307b8ee78b2a48d2dcbac580a4
-
SHA1
1fd017a819f32f640a6b7de5bd9a110a07b0e505
-
SHA256
b3149dd6082792c613d1d4e8707b708aecf1eb2c9d6a408427928db8216429c6
-
SHA512
bd61596d818a36672f45d01c9cdfccbe6df6aea9b3ddd29bca613e9d7141dec012b3d6870a6a797c46c81b97d3f01aadfede60e98cfdeea6169a6e3304ffda29
-
SSDEEP
196608:TcHI9wPAaCYM18Hq3WSzLfqCtgOquGAgyc2apjCREy/1U+0F6puA5KR:goAArWs76As2aRqMGNE
Malware Config
Signatures
-
Detects Pyinstaller 1 IoCs
resource yara_rule sample pyinstaller -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b7673d307b8ee78b2a48d2dcbac580a4
Files
-
b7673d307b8ee78b2a48d2dcbac580a4.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 71KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 61KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 19.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
hi.pyc