"��RЕ�d�(R�{&���vf��s�E��pw�O(��{�&���rX� "D[߿�$�����ۍ��0M�s�(�� Y�i �J{�,;�\ui��b�'��=������$��CR�S.-��\x�l�b�L��A�߭��Jo��l�\��������Eez&�s��Of�h�M��t���A�Y��MT�N��������M� N:?3�B���BQ��祂�^�G����v�s�($U{x8]:�}�w��n��,6>�"O<݅���킜?˘����얱Xz&��*,�a�8'��I���Ġ�� �7C���Ps�q��J����0i�B��8��B�^�x·r�gZ lb�=�$E/���X1y�u���3��P2�����9"�����#� ���?���R V�/�e<���y�����Aj�SX[X�X�h������O4��|Of~�-�`�~����k߳2��o�9!�㞽~�?Fh9Z�@U���e��!�<��s�;�V�W-�"s�e�e;�dH]�[f`ˮ`F�ש�<����3:Wq�t+��m�84SP�;^��r��z|�\�V�7�c�rbKa�2� �h~�K�:۽ɇ�B2��1$� %n�I]��P�4��m���� !��,Ě�CQ�.K��8�I�XI�`�yq7>�_�+xp�s�,}=��Q�Y�����{Zɟ+�-�n4�`��x& ��pR^�Y�)�.�؋D���&� q(�[�f��V����@��Q��u�%�[��2�r�黟����<�~Zخ��t<p�B�ko����� �@�;P��6N'��۸h���ځ���2�ڒ�S�x�w\0���������=I�EX�8�p� ����(�nN�����0�9��:��� $$'�;��� ��W A_�)�f��� �7�҆���y�Ǣ+���䋆��g�*��dsھ��sτ�g��j��^�����=�jW�ࡏ�g9�}�{����O�q/ک� k֎Yω�J�%����9(�Ք;��`i�u�"��O��P���E9|�g��ks �nh(�����:=T$�G�`�B��7�g�&}�Y��z�.�����۞]����i���&Ǧ^c���}�����a���ߍ]]��((��� Brݑ�?41d���,j������r�1X"*N^���r�����Q���G������Qxn�[;Mt�uU��U�zo�C"7�'B௪����W�|�"+���s[�EU�K`���X��ʚ9'd�o^�" ���g�E<��.��-U~�ߠ�x(��7�����(���\Ig�����2�Z+�(u;�� 5�4w����&L�D�����_�ő�NO����N��3�CC����x�%j8_�H x�"3��Ie�CఖL�&тiVg���!�fC��S�ri20�̝��.�,N���Ng����r����d��I��}���i�|�o:ؠ+��!�&qV3"r�yY~4?!��²Ζ��>]�4���?�]}0�}O��z���C�g� Ɂ�Za��Ե�\����?��E������T�e%����O�]B�����fW*�ʉ�X{��N<i�_��C @ ���~:j�YÊ?-?7�(?1&I���/� �E�-h�`��HӔ�b=d�~�>_oU)�^�� �+!a��ΰDQ������.��_���V�?t�o:X+Tp���ӎ�8�����F�w�Q�(4��S/�s��� #�qͽ��ĉ탍a��A;ܑ6�d�fI��~�6�(,�{ԛ���MC��_[��q�<g��� ��? � ;I =Dn #��Ah[㿨w����Od*T��@X��w���^��E �NEU�*H�f�/���V��j�/ �W8Ҳ0F�o��[�{�"��b3�b�R��>��pt5��E����d >Y��e��8UYi�|�� j6�@_>q������x���S��ut d��\9wn�����]:��9����ݖ����xSe0D�k@a��.֝�����Q�ڷ�;�2���I�W6����O}`����4�c�%��4=iBWl%���9��Cf�y�f��n?:+>����yE�m�i+gsJ��j��'��<C�B5�q�Q����,��yL�D\<�W��-���t���RY `sd�C�?&R{��o��6����+I� c�ct3<")Y�[�Z�U�$����p�K�s�|��IZR���h�����:���i� �`N�{���!;+�]��7^�/�gȾWb:�"X6z�@� �AHe=S�/�� ��^`F@�Cp������X{;=mwt ��r�ؖ� �펴0�6�SB�F�Ä��jq��YM����="�̊WvͿ�P�3~�����!5J3(�� ���|\O̭�eWT��nK�|����E���K���A"���݊>�d9��V�B�K7�|b���5����`/H.�ß���u���>y`)0���u��F*�������X���/ԓ={� h��ӟ{X�������|��i��wL���� w�����S�Y�l�Nq�E�tZ%O�.�H6�&�&4ɉ*�ى�t�3u4$6c;D.���� ��ی�h!u����CȓG�����u���ƓgrĦb�y�'���a�CM���^��/0�S�dvg"~�� D��j~� �.HO��ɣ��`��M�M�I�cgc�|�L�� ����P�����n��9E��D�D�B��}������X��sD+��Ξ�F�*��4�����������n%o����F�R�UP���P�ij�h`�H}�X���TQվ5rC0y����:�� V�?^�/�����7Q�Ņ\g���%�EH6^t_�ՈW�ݙ�o��Y2[�:d�o4萗u��Wَ$�����iyd�]���Z�YY�;R�u�����~���ԋm�C��g������<b$/�� yR���b�j�zԋ]�/�w��h \;�}��*���{f2Fo�];����t�����}���jL37����:��֬��B| @�� � ��Kg��M�r&w��d3�Tz;!Ӈ9J��0FD��1�WÞ�?+c@���63s6/�7��u�)169ns%��mي� DZ���Z�^�t�;�+t�����,ϝ�y&����n�:��Ƙ��DKap�p��p�v�4��e����� �WJ�_Β}��.�-P���l��9�UL,�Al�Q���جf�+ �nQ{��_����!���_�陈��s/ ~r�\����K�L�0����ܕrՖV2MPB�W��8��6�t�6���uT��a{�St1@>VA�\�(C�5ʞL�� �0pH��S�vj$@ڜ[���ժ�*�ma_��x6��,p��(əVd��#���Oz�O�'b9���}cPX�?�Y�n���~8�ׂ��:���]�3��A����V���$����x�9m���*���������8�ır��r��\�QO- �����up�i���6�&�H<=���-� |��̍�د&T�ۅ;���b������S����`y��<�^ }dq8��W�f ¤zޘ��8�����;��J� J�yY{Z�|��/Ǚ���
Static task
static1
Behavioral task
behavioral1
Sample
3fa70807e36e4bc4782deb35ae14151765c785cbe44e838d5d0ed64ae0af9eb3.exe
Resource
win7-20240215-en
General
-
Target
3fa70807e36e4bc4782deb35ae14151765c785cbe44e838d5d0ed64ae0af9eb3
-
Size
2.9MB
-
MD5
09b3d5c66717500251456a89b7619133
-
SHA1
02101ed9f385ba2be40206c63538de0387fd8071
-
SHA256
3fa70807e36e4bc4782deb35ae14151765c785cbe44e838d5d0ed64ae0af9eb3
-
SHA512
0ea511ccdb7e645795b5bdcab5c21a83e7b48a6a2e538cd9d2790e95cc534c1adfb6d2146c0e4fb7b80283ecbe2b3fd9ca740a86dcbfebba7d9db084f0c0b8c0
-
SSDEEP
49152:uuAfDn2fryB+kmIEcZYrc/eMJ+RzawgqPFbQCKjb7DJqrLzT3y4V8/z2VFBrJDhq:NAfDnOyAcZYQ23zTgyOLJqXVWS+TXTsy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3fa70807e36e4bc4782deb35ae14151765c785cbe44e838d5d0ed64ae0af9eb3
Files
-
3fa70807e36e4bc4782deb35ae14151765c785cbe44e838d5d0ed64ae0af9eb3.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE