�f�0 E.U� V��X4��bp%:�[�#���� ��e��"RJXǹ7�0�@��2~��5�2����;7��mb.����DΟ��gQ�tT<!��Fm9�����pmq��rg!�./I2��Q� }Ίf�5���em3X Kq)/��z>tg�"�g��N.�Li@�T���,�4���c�$�E��782�X�/�"B}1�>�K�k����|��d�LRt ��#�5-d���_l��*^��!8@ҷ&H����6��7PY�1�b�;�t��|�(p�2U�����}'r�،vi&"Z���ḏ�E@꺑Z\Ip�_ ˍ R�M����Yo�/ �%�Al��4D�@#�/G%{��B�w�X���_`�E��V0u���[At�o$����-m�����agy=�Ah��aԧa�ǯ�(jO��6j� 6�l��puT�w����D�RQo;�5'?�S��" d�� �Y�s�y��Nj�C!\�Db��\J�F��Ɔ�=����8n Uj:7I�|�2�>��T@�1�F��t]~M����~�.5�hUמkض高 J~k�ԥgr�_�j{Z��~��GY·#���j��-���=�y5���P��PV�\�c6����'�[��{qO����q�z�h[��s�6V���6�<�G��P:^u7���Ari�v8T���MRX[�_~_߅9��0�<w�������� D;���z@�`V�j5uS,C�!_��*�̉㢠Y�B��w͙����.����K��� � b.����e��fަ��sl��ϯ��4B`�]Ou�l��^�C@顅�M�MShbnS˛O�_��u�%q0�b�|��?MKk��)Ւ���Okz:���.�� ��L_����<2(z����Uns� 'S�e��ʓ��c[ӴP/�n�.�)�h7��O�y�� (�ě��V\o1�}7�j�@��5���Ը�$9h������a�ҏ፲��?m�>T�h@e�?j/�ʅb�g�����<uУ�B�����|�"�nfqC�Y�勯ij&*n��ӳjY��������k��Xp�,��/��� ͝4U�z�w����\I�� �����H��t��ڒ\ �k��Q5۪P123�$��]�+������-��^[�����������4�bF|j��ؖ��{���e��n��^?n�eCDc�_F�E�.�-1�w��� �D�����Nz�r�Y��� ���2 c�?�X���7�9�*�p�s�@e��9I��R����&a��zfQz��{i���I�ݐ�� ��G�Te����ue�y�v �+��y X�PӐ��*��mm|^�^&�=|w�eYk�d�4��_<U���&��6XI��!�/���z�Q)���$3���7s[P�e�?}?ز[��m��?�u�Ѐ�'E����);�`��F�m��"��ꝰn��x f��3��:�m��;����5� Q��ncy�1���?�hC��S'퇫"2�vk��`9��KT>��<*SqFp����p)��)~Yx�VĿf�U��<6P��;��H��9�b�ێ��SH��� �(�ASa3�B7��k�����-��*u�Y�khi���^5����ji�'���w��B��m��,�]���ڟ�C2���em������ID��(a�q��{l�0C�����w�&��q�����: 3�k�F�0g��\�\���</O��In��v���rvYY=-g�b�*�����7s�G���G#Hc��_��_2쇱Fe �?�f�����h�1���?�v�~gӻ�Ε��74�7���v�\�σT�T�%�y*�ͽ���T�Vri^�*���1 �����v�I &|ڱ��<,:6/���1��2�t�,c����!���p�N�����ja�0/�b�ɻ1C(ɚ#�Ti���}���mY�ݼB�(�.�Z���2�~����]�KV��_����'L���*.�0��?&"�W���(��0�?X�q�l��7+�������ԩX�s�S����D�]���TpL�G���4���1.4�4�X�ݏ���ח����mL����%��vG5p��4�vR�U���C!� [aYI��<�aֲ� �7�w���V,��I�_��� i��e����;��rzp�QAhq.��3 �ߥYnm��|}�"��9�nH��Wn�V���;���"9����=t�����r�CI��USaq(��':X����vfc�yRͣm��o䫗�~;����A運6�wjl�55F�.�������vn �����俔j�Y�1��p��{�f@>��4&j�����ճ���h�4\�z��i�N �N����X_S���^���&�:�AQ��?A��A�w� ����|:'Z���wy�T��Z�|����A�UF����R�I��Q>��s���A[M���h��(��Tʭ�|��v����v�;І�|���#M>�XA���<�� �ĞL⋾F��^Fl���r�i���>�HRV�,�~�i��,lSw�u]��!B��Lb�˓�:�e��M����/�(�.柨MW��Bj��Q!��-�Q�e�CQ�r�U���LuǠ5SOU���z]�({x|[��jH�Kw5�4r�p鰺��J�;*��A'x�>�NS+M�� ����%E?�Ӆ�$��Y(��D���2�ܼqe�*���\��e3�0L���+�;�#��h�.$��êYbf�E�Z � ^���I��'�b+^z_/��}��'UK�^p��xDqG���h��%7~��{�8���Y�װ-��`�T�`����I����yO���=v���i3�p ���MR��m�a,�����8=�>�3���F ��ZQ�gū��nn����I?2As���� ӧ���mh�x|�Q�D��b�7 e�ӠN>�SB ����l�����8��4T����-r���HM�P ��i��gc�V�5a�`����C��X�A�<�0 ��o,��o��"Fg��O�;�j�f|����Ҳ7t����fNo�%I�k����Jw�_����J���6)�����$���d��Q1/j�#�s�67�Ut������V �����ٖ3�8��������0�Q��I_�h�g�����ӳ�]���L9m�.��QhLZ6�g͛�t��}�s�zjy�Sem��U�_�/�|�ä
Static task
static1
Behavioral task
behavioral1
Sample
2a42489334f9c6b0a66c39794a1c5ce90b319fdf0a5997fcf7681aae78fc3014.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2a42489334f9c6b0a66c39794a1c5ce90b319fdf0a5997fcf7681aae78fc3014.exe
Resource
win10v2004-20240226-en
General
-
Target
2a42489334f9c6b0a66c39794a1c5ce90b319fdf0a5997fcf7681aae78fc3014
-
Size
2.9MB
-
MD5
227e6080bde014723a40d8f9e8cecc69
-
SHA1
604b179139a5feaf9cd270746f4faeca8b85091f
-
SHA256
2a42489334f9c6b0a66c39794a1c5ce90b319fdf0a5997fcf7681aae78fc3014
-
SHA512
850c8ac10f36496817d056f5bd521c06ce350fe04ab6453a6e08f14ae16fb54e7bb7d9ab89781f240ba0a7c3331718bc762e401314647b0d72e8b4758860a033
-
SSDEEP
49152:EPc7CG5hjz9GwvpAEL2nruoxSQ0gZnQn2xKqQ5kRnE1HY4D+w:aPG5hjz4wvK/7xSQ0ZD5kChYc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a42489334f9c6b0a66c39794a1c5ce90b319fdf0a5997fcf7681aae78fc3014
Files
-
2a42489334f9c6b0a66c39794a1c5ce90b319fdf0a5997fcf7681aae78fc3014.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 344KB - Virtual size: 732KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 36KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 32KB - Virtual size: 352KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE