Y�l٦�(�[�[4e�n,��jgԅ 9�v|%�X���ט�����F�HK�=|���Hds(2>��cz��<U-W %c8����&XkrߪGif��, p����\P�Gj��Yr<�l���.�zЏ�5&#n����`�g�;���R�;��CVot�]�C`N\�Q��n�^�Ĉ"�K'"�}�wp��%y9$:m��v�M�!�!h���a⸹�@n�9�%�����k�����`m^V���˗�TO�@k��jĎ���,���d^..qCV��/���I6>�ߗ��f� �փ5�wY41����_�p����P����gҦ�0 `l_�.���m#K1gG]��\=���p�����>��Z��Ų���Q�>�#,���"��Վ�{n����}��/H�y�!�Y�H�3�q���'f�N �%��Y�����7ix�uz²�أI��Xe�!jݐ$a�/��?Dn�� �r#t�?,ZC�s�h���.vy`ՕZ:�8^s��� ��݂�_z���q�%��� �����,���L9�<�a��Y���DWf���e�Db�(���R�(��>� b65)�u�q�u.�4��o�� ������{"t���7�~w�3g;u$�V$�}��Ӛ�{�VXG������G�,��Mp�Pc��[n�q�X���!BS�7�hQLJ���|.�5Q�����I�9����bJ��LGJ `Ga�5�eR ]���"�t�I��=f�:z��nFM�[!g���䍮��kǸebU>�7���I��\k����@���W�}\��sNJ�mA��#�I/[������'p#&�a/%�K�=dq�Sl�BNM��{`GM.����P|z¼C�l��=܇տU������-�7d0������@¼�,���%3Ҥ[�k��v��Z�V_�ǓVBR�'m��?u�GkHIȱ�R^J]���ď/��FV�s�-�0!�;��:�m���~�Xaw1��TWϒW���m�rΓg�l�]f��Պ�:����X�c,få��8�+�'|S��/�cW�����Ƌ+���GE�l&�+tpx�_���9j�&syg�J����L8j.�� ��/!4C2�����/ �N�Unɖe� x�>�:��1�����@��_k�����+�Ȁ(�7�.u[o���S)P��-dM#�AM~�p^���7!�ĔktB������IC�?0�v�x��1%{�[���G�114�2�1���t&P���$������!�a�$ޭ��EnzĿ�W��D�/�r������S����f�����O���|[��1Q���e!� f�o�ש&��ϬY�邂a<`����'|�bx줰)�L�u��ӊ͇D,����F�F�����\���S�9/SZ�8 a�#��{b��z[IB ��Sḽ����@ǰD�R�,�}����3O�0��� ��N)ӥkऩ ����Wv��4K#����Q��X�E��v�l%t|�X0��:I��b�)��Xػ"���s��v�r�d�Q'D_��}0W`g|�����;̙��h�dl8�զ#�S^�������� 9EBG�G�>z�'�-m����Լ��r�ÙC����%��1[�g�����˰,$���P{���{�n�x �Vl`��z�I�vȍK��r=L�v�o��=��D�~�+z�Yv"Nf@:��;���X] [qҹrv~y�Gy�*W>��={p'(��wtM�����Z;���!�/,��~�l^�N�5��^e�&"%��ݢ'�i�o��i�g.��X�~g�k����s&{�O�X���H��V����nck+���FD#�^Viz �ɞ�=�BG�j�*�n4"y5]2}�#���ϿoVsyp�]F��"}h����9Ցm�S��UM��Z��c[-<3ǧ +�p7�M�Ժ�N�D�x��,���8�dhOݓ�����`C��jb��5�d���&���\����A/B ��>=�H����!<>�c#�Ba����y��~���:��~T��M�!�`�6S���[h>!�н��������ϐ�:����'��l�j��Mcz;-֯�i�P����ٝ�TЩ�/����уƾX5�x40b����|�Z) ʽd&�&?| ;���*�`��:�Fxv�-�i��T,���ۅ����x܋ȼ:rG�gU�q�$����oa��]7#Ϥ��d��7�2K�ꏊ� J�c,�p�p��,3܋�r9���G<�)r�S�0h����9�Ъ8�7��̡gڧyD.tv�����R�6������/UeT]0�1(Q85�\��.���� H"� ���/Y�.��pM��rx�Z�.z�����17��ȍ���0� �r�rE�ן'ߚ0�D��&Lq�-<{k�7;*��mG�����l���LuR���vF-���\պ�l��d��:�l��Z���qDV�t��@�%HmDW��B�+�~���ANzW��u*3�vzDﯸ������zO����o<Uv%B�v���;��7�W�������%H� Ʃ` m%�jc�^Z�sn�߬{���}kf�6�8�CeQ��qBK��AQ� A`��^��V�����ZrN�Y��w�&�q?Pu�� #���\g��U��ܒ���F�P�����F��H�R���A[7T�,��a��Ġ�bQ@���J��KgD���y�}��V�ά�?��MS4\O?'���2�q-�z�ʩ����憭=�ýҏv�9�k���d���Ҟ!�o��d��+�"�MR�Z�h?kB��t[m;���a��N�N��vv���F��Y�(ޞ�.)/G�W�j�H73�����՚�����q���Ws|����A�ȹ�lerՔp��_�Ka_O� ��y�����Ԗ�g�m)�4]�j� ��q�Y���QA��*��>�{��Z#& �t�(�;(���x�%|(T`E��ջ�1~$g��YǓ�5�� �zMɈ��LcZ���ӛo��S^�&E� k���^+-���Y�&�=�G\�����,�QTxY��ʄ~�S�e�|�gz��K6۰���D'vNL�$��{6�t^i�i(����e"��AFR���h�pǗ����Or���͗(���LT>��E�9��ϕ��,�<�k��w�W^s��.�"��a���w9����f�!����_���g��#G�H��C��m���G唾�0�,�a�p����G�IB�=$L���}�N���-ږ��\I�Q��2� ��ǐ�X�Nk��K������^���DGͣ��n�~� �*���s�Z<nq��w$8ܴ���<��.���߲�� �,�<��\r-�/u�I�Ռ��Y���7���=*��9�����cCsn�A�&n}"Bh��F�K��Q=M[�W��a���e���?��a���$�ubDZա��c<aְH 两^v����;��;��v�WI���qe�|�j.*ƫ���<a���$����g�U��tBK�0G�/c�Q"��I�C�z��50�&�h�I��3������`q���^�)�2S_�n����ġ��:M���y����O���`X��>U�m1���=_��D�F �ۚdT
Static task
static1
Behavioral task
behavioral1
Sample
ba506d12334610298fcae906b1231b12.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ba506d12334610298fcae906b1231b12.exe
Resource
win10v2004-20240226-en
General
-
Target
ba506d12334610298fcae906b1231b12
-
Size
11.1MB
-
MD5
ba506d12334610298fcae906b1231b12
-
SHA1
e1ae1cc4efb131ef932f0bdf36ca1767d669e04f
-
SHA256
094d444ce9b0117aa912ac4e38559992cc61ea08346200cf639ec483219ef3bb
-
SHA512
5619715f0445eeda986afc4bc8883a3631f7b8eab587579f0e9e0ff6fcddb57c977eade6144a4709b1d086c4b7951110e5051c1170e45b8ded1b3f734ffb81ba
-
SSDEEP
196608:+Ot+N4TgwQj9uJCgE3069sruJZuGAgyc2apjCREy/1U+0F6w3+6oH6:+OSBwUuJY3069srEAs2aRqMT3v
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ba506d12334610298fcae906b1231b12
Files
-
ba506d12334610298fcae906b1231b12.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 71KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 19.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
hi.pyc