D3q��s��uhN�� 6y�� ��I�9 M�{��L7�e�W 8��K��6L�"��4�l�uP���,��� ��|���S���{����$SEPc�Z��p%������D���xn���i�h�:��P;/V��}84��y�$�M|.��W�V��Y1�i��V�������d�T��3H���IEC�̛�J�k�j��#_�������?x7!�(��\���]L�(�� �-�1����cW�w�'�������-�.T7��]���aY}�}c%M8mF����`��t�}�.�&��[���z�~�X���L�J���`��ɼx����1�8��P^��(7.���XO3U�|I)�� ������O@�A�Ck���hj��6��%�����Fj���h�@�;K%�] 3��̄$N��'�n��"�|1�1���^�Jg��?�;�=[���5�ՋtXe�-��2:ami��r�{��7O�DÃu&�D� ����_�Q,*�F�H&?��p6�C�����^<��{�v���z+����_$�HA6E�m�:�W�7m�0��OGc-�K2�D�<0�������(R�Qljϩ��%�!ӧM?�B��%Fl��u��]�I�}Ön�]:���d�7�|*�F: �J�j�"֪�o����@,^�`�tJP ��nm�"i�sKE�;�`�r��y���:(a�=�%��I� t����W�z����|Q���q�Q�莱zi�/hN�h|�g�&S,篆�1*)�y�M���sn��g�?L��m�N��vvK��#���/3ݼ�E���[�No/˸�r�R��o"o��<Qۺ��kJ� �w�tL�f��[W���R����B�W1�V4Ѡ@am��0�� @�bW���![�I�t�aUW��A������R%+�~�x�F>����vT;�ލF��nIhKO��w×�(Jv��4�������o&���Z����ŧ����?,�R��m�S��������}pq��ɛ:^�O��)�GT3�xZ�#���ɪQ��AY�N��ZPN�d-�K"%�"o��/��g� "rШL��#4/������)��˘y>��K����ݱ(��\i����� �'.ۉ�t_�E&�:��(��/f[�}�(73���].A�j���{�z� dM���x�j��zq��M1�SS����r�t/\��%��=rw����"9�j��ڻ�����4ꈗ�l�3��rP�"�q�e�U��m�F���1��R �?Zg�Z�d�/P�埥{N�x������][v�p�46�蛇n�Z�T&�S�t=j��<����W���?�q�櫳:U�� �� �{I�� 7��<��������+*��-S:��0~�t���G��uI�zD+ 땽b=���*}Y1�L�a�����(��?H���c����g�啦���#מ�9�4,6Z��g�2���n�k��G�&:�7K7�l���d�B�i���h���33K�)�+`�%'�E�m7�������k���]���\H'J��k<k��i3�.���a��^�,��oE�F5{�����cj'���ʍ*�M�f����>iith�9Y8Ӓ<��$�+$�T}������[;W����he�?�OAYh�`���B���f�qn �[�aO������+_X"}��S�y�M��F���MM2=��>�l>�j��n��\3LE_I��8��*�;e�e�C2]LX=X�.GCF�!�� �>�CW�Bҙ��'v�7"�Gqa��S���Z���\���̀+j`����N�'�z�K�zB�i��x͛�ǖ�e֘5��Mں�K�Hbe/B�F'Ԗ<]�e��3�cڵ{�%ISL���7v{7b�4��3T���hǏ�>ہ���u_x(��\"2x�+< ���e;9�9~�D=��`����N� v�ou�$��k9�[����B�.�R�uf3��%�l��!:}�h��FwV%A�"�w�����q����NX��_DY����uJ�����5��LK#���o�ȥ0�-���,�)��J�!��|�~�(�r����%���F9ycp�s�S%+��')t�*��U�|�1*M�0�J�t{��cCh���3�Wq6��-/�{�~Y~��f�$�D "�cBX�dɗ|<�Z����%�ˣ7�����diu5����qjR����N� ���{���۱�p��'�#x���9�"�#�?2P�f;.���>��f�tQ��Z���SXa?gy=�^�-{�k�s�HTS�obX20<��!��ST�!�Mp��S���>ґ�ĿیL����r�����(Hqڧq-!ƴV��<�P�R6.P�y������� �r��Rvڕ`�Y�z�r���e��G���S���!�� 3%e?��[�v1|AI���͛Lj����ÍD�C�j�����Yfd�T�Mw��F>���*���w���b���~��Oٗ[���X4�%�&��&(�b�����������vǏ)T!�"�Hun*��@�PO���1��V�9��aH;���~jY#�(������R�����d�:}��}�]�Z��=i]l���s�m7(�! �����7�d]qI�ڏ�-0c�v��QM�����`t����ydu�� � ��b�����#���!,�**-�a}�u<0IX�3˷צ�����7�"����ծ`�z�Θ�b�N^��P��Ʋ� ?��w�{�� ��Q ���D���#`n"��ST}�@�|���:����(�˞KB��V���aE�����d�J��棾���RKm �l���<e�����WS��MQ8�-�) .9Ao}�1�P켇���g�%\�L����F�p�|�6l�x�a�#�t(�~����)gC��v��dd�d��ɺB�_bA���*�8ّ�h2^h��F*AE�����滏�ག-��gߵ�b$h�J�\Ȝ��<��)�m��!�Zn�o�[��F����dvB�����$�q���!�K��Yr�z���V%^� �\����TN��.���p+����Qy+-|p��)�II��!ķL4���@�5eqp�R�#3���ը���>;]F��֠�Z��&�T����}��)�S�N�]�^,���҄=��=Pv�)ؕ6�%X��\0�'��٘z�ct�N\9�?К�C�t!�Yf�|��h������2��c)t���2�ؚ�)�M<���s������EId?x��4�ja[02D0���Q'�S��&{P�:��vX�Ȯ�Qȼ�q�-7qH���� 4T���� ��Qo����U(���F=C&J�X�5��ZP�7]�k7;�����ք��6 ���Vj�"7Е���p�3���j�mRE��-�k��"=/f�~��S`��,�vn����R[��M�ґ�����U"�1�a�| �LM8��5��' �H�����y�'��N�c������Girӱ���,�=˾�r���[(�?�����W����:���u��GNI����^��P ]<�ܺ\����;�x���_0<�S��Ѱ���7AosYzď��f���L0E���+р��$��Wx=]^�8k����(t��Ԫ�ne�}d~�B����,*����9H W�Ic�����90C}�7���O~z �;�^��Z�S|��w��c��6$._����Re~<ǜ�������8}e����3S�@��sC�g�`9S2���`�f����m>20Rh3u������V}v<VZ���à_GU��1+�}PzkJf�G�f�����~'��>Wi�0��
Static task
static1
Behavioral task
behavioral1
Sample
84944746616c67e96c20033f5e3bde0340e72b0f1af0f273efb2aa87497524f9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
84944746616c67e96c20033f5e3bde0340e72b0f1af0f273efb2aa87497524f9.exe
Resource
win10v2004-20240226-en
General
-
Target
84944746616c67e96c20033f5e3bde0340e72b0f1af0f273efb2aa87497524f9
-
Size
2.3MB
-
MD5
84411647a6a41de16261bfac0fbd7716
-
SHA1
5e9a5265c344ac6f5c7dfe16015fda343835aa5d
-
SHA256
84944746616c67e96c20033f5e3bde0340e72b0f1af0f273efb2aa87497524f9
-
SHA512
33a54af35b656018e7cbd6947b4bafc22e92b5030972e4a8c8541fe3e0316bf9e8b953bb01d1fa5ab1c55b233a75fb42f94ff0affde06ddc5a308e7d3c68b26d
-
SSDEEP
49152:Qy9M/f4ebReX0z4cQYgr4Tx6CxEpFbhYbKgr4FUFfRrWqu57nq7A/fQ5:Z94f4ebReX0z4cHbeL8BLR857q7d5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 84944746616c67e96c20033f5e3bde0340e72b0f1af0f273efb2aa87497524f9
Files
-
84944746616c67e96c20033f5e3bde0340e72b0f1af0f273efb2aa87497524f9.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 268KB - Virtual size: 516KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 236KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 4KB - Virtual size: 6.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.FFT Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
���}�u& Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE