Jݢ��+� N5_O�m[(TNdպ�� ���-320��Ȗ��!���B��B պ�ݔ��Q�pv��6]�O�Y� ��X6|�� �H����]/�H@i;� q#q��>ҹȦ}e�x螾�ּ/V�h�| nۉ��n$�X� 쯝���p��p��aVA�z$C�(^Y��Cl�(!�*���{ף�!&���[$�� ubgfe��D��|�I�f���u���3ߑ�BH)8z����W�_�6�&�����/+(G�<��p �*ȑ���-�.8OR c�;�)�t�� ���Wn��&��^/�ׇ7ԭ>�`�B���~}�E;���*��м3� ^ �� �d���!\Eup��Rvy��֜΄;r�1�K��r(H�UO��?���;����'���~�bT� 2�"U47ʩ��l�^fH���l�[�`�t^T��Ҧ A��'�Q�֬��ah��tm�@>��~�"I:�Q�K�dvE�8���}{<j(���D'����$����c�^D����R����k!c"ѕ1A9@�q@nuN���ҌA�oT�� �P�U�\����/�5�լ\�s� H��za��e��s�d"���7��FF�U���Ͻ��^-S\��\��d�L�9R���"7<nD;�� ���ɿ�~SH" �Y�����t���^����?64����0 ʁ����o�/�:�#�U9� ���I�Hv�Io=������l�Bܳ��^�k�%�ɼ��̲��Ox�p���K�}_?sa�M$��z�pu.Ɗ��R���>e`�KgV2�)Ե|���?�/���-�`V��4��{c���N��R�-|�>�#.�ǹ�uyщ��Jci��R ����f�҇=��z:s\�4Vi5��|�L7֎�¶)֚���mĻa���[��t;�P�2�Ų��9��'5�#��L��<�S��>��Nn�v+�o��*�gX�� J�x�>�$G�@ IS�=̲5����v���Ѩ���7%�7$��Q��>��C����1���������K���Z��h@���{}��nC��D��??G!���[ȱ�if�ʘN����XRw���Nx���K'�� H���E?�L B��nq��X��z&�����4�g��4�/UP:�m�� �)�>�݈��ѽ>�C+7F�R��� ����F��cnZ��M�����t'�X��4DH��1���Dc~�({���KY�a�/M���?@��J8��JO�C��V�?�c;g2!��:�H��#��� �M���ee���_�D�i~ q�Hqb��d��ֺtz�!�Ña��jH����}I�����5�)s�j2usω׀9�J �z�)�-�(@�� ���O��3��t���o�U"�2?����bt��}�;$�r���ًn_Rr��fL��Hdq<j��u�fnq�~�3.O��J��ڬ��,�VNO �3/ �X`���/N�0{�{%,���rGA��)�z�4��-_�$����d }�s�Ϻ�������f�2MBp9dA���q�sAVjV�(uQ����u�2����Nٻ�6m%�^���v ~H�l�!�Y4۫�g?��M8��<-��Yq������-�y�?F���6��t�lE�������Sxg�u B{=9�\���@�=�Ch߹�?�[��z�f U�/>{h��m5���������af�!��sQ�r����O�PY�<�{�C��v�N��o^�{��"}��:'WX�Dk�;�A/?��d�1M��2�o����d�bTCHY�'�3a*���ޫ��6,CK��v�ӿ����g\�Cb�oe#���O(�|!9�����J�Q^�f�D�I!M\���u�ը����0�����E7NX�vV�� ��rvf��_@5�@�^�I(�!8]�/_i�����0��ě���J�e� �8�J����{�2�� �^ �UޗN�[Q��B�P�8m�f�ox������D� 7]W�:Y�h,q�£x-ו?*�]Ab��E=m��|\s`T�6 �Q�gi�v_29PS�)|�sA0����]E�7^�ñ�O��Z�����R!3�W������.�q�4{m �WĎo��� �wt^�/@Y#�\�KR�ɤ����袷JdW �獾W��b���qNzȊ���Rc��p�Ę���-,w�A3+�m�q�ek�C�)�����{��%���k� uLJƔ��I�����7�|�i��/+�J�l+�2� /P[���9���idI^���y�0�[JӺ���4_ ��T)��%Y��?�f�MP9�� a�t�d2�'�K��_� b+;��;z��.��rHU�[��W�#bnqB�lm���AW���JG�L��k�1F��� �:Ж��I��$���vY�b���Ez_콣����^+��gJb�֊^F�|!XЬ@��������Q�����Tp�o�l�°>����� ���y�iDb���Z�CV��p3Wr���p#�1"��s�C��)�2�@���� 07N+,���Ԉ����H�����,H �q�HVP��)+sq��Rr��PT�R�|���h�7��/�s�vBG�a����y�`gp7@گg����� y[�n��?�[��a�6�U3���c]6Ig�K��5��gԳJ����ӎB?���������vI}����g�j��ޢ��3,�7��`x�n���Z此��|D�Uz%�[�~G��p��#O�S�����D�8m}t*���A��n�5�C��\����M[� MJr��������#� F�N� >�c�_|!5�FJ��}gӿ� ��'#0��Ii�(e��]c�a\�Z���Q�H�� �4���d��n8�֊�!vEh���2��yԙW�J�|�WU��c���h'S5�o��B �����n��Y h����$�\]�Ir3Q s��<�Zf�<mi����Y �2n�K��;���v� �l9��^q�_O�����c�`��n�m\K+P�`��2��CZpi��[z�}a�������� �.&��n����D����#>��w����� �o��Yp#jP�����W� �><�G�:v��dAL�Tl�RbMX@��7�Q�CNʘ�r�����%-T�������9ҍ @£�$���Ѐ�v����g�_ 7w�Զ���������o������ߎG~���X��щ�B����h�GF�������3"C���q u%�2m=Iu<���0�>-b�`�����
Static task
static1
Behavioral task
behavioral1
Sample
b11745b9ee33c85330da1ac6ea027a74b54c1ebcbecbe103b4f72586879da996.exe
Resource
win7-20231129-en
General
-
Target
b11745b9ee33c85330da1ac6ea027a74b54c1ebcbecbe103b4f72586879da996
-
Size
2.9MB
-
MD5
bc40597df7fa42c4da244eb2c81f827f
-
SHA1
8fbbc67444d9153c4707e721320aa778ce01f585
-
SHA256
b11745b9ee33c85330da1ac6ea027a74b54c1ebcbecbe103b4f72586879da996
-
SHA512
869bef673da9e92923270d910c0da0b74d5223f1cc06fe2918dcbe8e8547cef9a61bb89ef3548ab4acc73ddd3a75b1f8c4e3911f394021748de26bf11a4ce14b
-
SSDEEP
49152:ynLwavY3QnF8DRINhU2JkXX5TI6yA3X6B78SF7A1PocHT2vy4sIQU7fejZEdi657:+savsQnF4iaZT1L3Xm8SeVJHyzsVUKF3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b11745b9ee33c85330da1ac6ea027a74b54c1ebcbecbe103b4f72586879da996
Files
-
b11745b9ee33c85330da1ac6ea027a74b54c1ebcbecbe103b4f72586879da996.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE