$�Y���(�zΉWz*� �y=WPv]%0[)��wF�����?�?���lC���H���1A�4���s��.��ך�t�܀� �v�ͻθ�%<�]�dycO��ij��p�V6�.ŕ�y ��/�v^=*m�Pb/OB�j��x��XU�t���DL�jB����֦a�@\/��V�ǭi=�-fu�[�]C��(�;���8�Lj$�Exm]���y��������g �Z�.;�lbŴ�����J��tY��.�4��y��q��'!zZ�I�g1�R�U��#�d>��n��7��Z��{%10}��t%k�@�~��%-��\�~<`1���`�^�����s�����k���;�uOX�j���<��������\��H ���w4������Jo����^��&zN��!yn����)��]7���|�qn����\�Aq�T=]Xgxa8=�wb��=l>�� �q2�Rޱ���h�mE���y�؛�͕�ҭÃ�us�k�!`r��U�,���/��pذ�Y�i�|� ")��������I�.y�WAz�?�C�����z�|��,g��1��Y�p 5��q��ι�d��#VD��]kX�]m�fv<%�g>���T[��ej�w����1Z|T�l���۴ 0�*>�D$�i�8z+�:$��/}�:�kD�F���V�S�S/+2��[X�P���[�M��7w��b��Em8R>C,tn��̘0��~p����Ŭ�6��A"d.C*F�W� ���i��[�/d����g�V���s� x����Pd�"��Ȇֳi����T�/U`wq��|]����bn;HW��)�D�ٹd�U����(H09�'��țS�q�1 7�j�4��zN����ƂD���L9-l.�0���ԯBٸL VI�y����v�^�G��g3�=��|������$��P>��F�Pu�֥��[.%�K�<z�{6��h��rax�����oz�'��S����L�ۘ6m���E�����\: ����)�+Ԍ�,���i��!Ħ�U�hC����ó������G�&xЫ?Ҁ����j�Q���3���Nt�(!A��u�k��"N���:�5�ך:��(y����v�:�>j�A���IF7��{kCJv��mɎ�_��JgK�Bw]��#� `�;��3�� ����p�r}�U�����5g�E�g��k[� C��8(ת�����<�8��oB�?e����y�O,2N�a9Mҩ�?��� ���92%U��7�b��^�4�Oa����y��2g_��*Z6o����ʫ��L :�)'��fv0m,w����Y��a!��Xh����>=��1����l�d�en6���L �R�I���&�b�N����$u�O��`U`�b�����O��kQ���tW>��ޒ���@}�Cvx�\ -+�����y���?@��JR��v�lB����\n�,<S�KD\�˘�&�?��1F���,������'I3#@4q'�����hy$c�/M�EX�S�B|��V�K�}BD!C���3�Iˤה�ڀ��a��oh+��/����������ER=�ǵ���eX���u(����Ɵ�TP���^�c�ώ�,�Uk��Uɤ�i�ÛjwW�|��,��1nؼ�o*�\~���qM�DZ�� �O�gh�G\���o�E�D�]gI'��6 �0����{?Mt?�C���R]�=f�dW�aE��x�A�O#f��e���dž�dOL�e�<�\�����rܥ.�����p/h��H��)�$�b-h?�&��@��3�y'e[iy?s�#Z=�pO����k���i����G�qG��Gi*��>����*j����L(�u� �&��L��Y�ǘ�m/�D���(�����=���F��*%��sR�����,���� O�1T�7 ��Բ_&�>b���$(��;���f!�ն���i*������n2^wTi�*C��?�kG��ݜ����C���^�0 "�@�5e��_�k�JT]wL��r"Nd�!}�� �q��eP]Kg��@� ��[#�Ʀ4-�<�3� �c��zY��aI��������s�����ڼ M���S���{=�CQ �V�����dҐ± �_��kf�B��:�a͵|j��L8ՌLڎr�P�H�R��(����B�3V���ɾ�1�-��N0��ͮoR\�����]�"�8�d�����drB �B��~@r��Ҹq�La\����\*8�4����2��&���[����D�����q eԂ���������w�}:�}б g��m����g��K�F�����$�L��T}~�q��>uEm���qʁ���S���6>2 RLzȞ��7?07�� �� 6��ĊE�1"=4���n�hW���F^oq#��z�pp���,_�Ԏ�T��A�c�����Z����}(�*b,p��=�h��p���MBI��=�(tRϠ��>����S�qT�RR�=�u������#f-�8���K��c�s���A���odp.��sҺ�8��1!��<9���'�CAj.��Q�����,����> ⩂KS�Z�9'+��cPk�?�v d-�/5��[�? ��(Q�Ȓ������a U�Z맞m#�o�>�l�`F/i����r��d��E8�s�y�xx�����ne�k�<~/:�����w�ȃˣ\�2�T������������Lp?�j� =�iG-&��BVv�����v��~�#.�_l��ֈ2^�E��3.l]�"�����o���!�`EH���� �~`�y���&p������Jv�P����5�Fjv.�bUƊ���G���G��ݾt� ���2�fJXAI�d0`���m�������/Ug���iќ�{�����͘���+ h���W�˿��� �غ�S��Z0ru[P�����+�M����ə͈�w���el�gl�-��'w�h.Ac�uZ%-ւ�����e4�r8�� �(�~X�Uk�Pm�D��Eca��TL��M�}+�l�`�a� j08���r�Ñeyi�g��`3�4q0�E _�� ��m%�L6|���Ͻ9{p$K+(�GEZثl\W�A�l_�V?ȵ"x�����P�Z��cJjE�����5��,�J�,������� �f��H�-�PR��R.~�(�Ko�ڣ)zU|5�����4��QSB6�����$7mQU�7�О������Z�d<ű�k�!N';
Static task
static1
Behavioral task
behavioral1
Sample
336ce58f80797f4038d970074e77c3f2ed887f34a1bbfb1ef2ff7f1497dd9b44.exe
Resource
win7-20240221-en
General
-
Target
336ce58f80797f4038d970074e77c3f2ed887f34a1bbfb1ef2ff7f1497dd9b44
-
Size
2.8MB
-
MD5
e7608998f60b25830a6ef4afca83a45b
-
SHA1
97a595e7856501bd983b0961ef73288ec342aac0
-
SHA256
336ce58f80797f4038d970074e77c3f2ed887f34a1bbfb1ef2ff7f1497dd9b44
-
SHA512
e5f558c51175069bfe88348f8103a2bd8d9b7c904dd51c3481a8c150465bd0e58fe1f54118fabc46b62e3585a79728bebe6bf57b834b5e4b27fb8a32b068df87
-
SSDEEP
49152:Rb1q7zxKJpglvlvxwIJPWNRFo8qnN7l5MPi2kmKFWuZa0dNKNn:PIzwDQlvxzpWrMlqkxvZaSNK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 336ce58f80797f4038d970074e77c3f2ed887f34a1bbfb1ef2ff7f1497dd9b44
Files
-
336ce58f80797f4038d970074e77c3f2ed887f34a1bbfb1ef2ff7f1497dd9b44.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE