�f��l�`�C��h�j�� �_`���W�� �>��z6��(q7j�@Nj�<G�ZUҁ��&YM�|�@�ї%��ʫ&auȶ�_Ҿ J�/�ߚ� j��Od��nL��Jm���,�����a�O��/�'b�k7� ��eW/���Әӿ�A��<�Ŕe+%����G��p���A�>/��������W�?yצ�%����x����h"��b\d-��D�LOz��/���oҤ�^g�����g�^A[7$�>����=�<���Ə�B�#�ݯν��� ;&"����(��p8ֶ���?�a��,n�﹜״bk�>=K��yٴ�R��a�dh'=WK�*4~���f+v����/*s�� E�P�˰4�R�L�Aoqm�7��A/t��S���H�&��Z�Z�����ܓ��p�+:�Us1��Z��P\.��D�-+)�`4�U'1���dIO�Ƥ�7����&P�Q�KD�0�qT�V���L�?��Kp�9a>����(q�S�9�}�ܵ�cmW�����K�(CO�tO{;V�6�+&�ۧ���g��<�˩/`��;ԕ�.�F�N�J�u�sF�[�/��pd��PV� �� �"M�L���c�7%�f�l]NCGEAp�@���(��h����:�K�M ��K���@0��7�ʧ��q@D�mj�7�:��m�e���̾H4E7�&�����ނѫ�6>� O@zG�����u���Y�#���������zA1�0��hQ3���^Sl�'QHF|D��^tR�W��R>��g�Γ�ě��$#��\�(ߝ�z0T}�}Xۥ���N&����_@,�R/=�Ӯ�u�_�\�����Q�9�r��y�#��e�I10�+�v�P�6,=a���w�3wF�x���S���*Ϲ�O%��k�H��H,=���^Z�&CK+g�G�M��.����������`�ef�j�\�(ڰe���!�AT�?W��:��z��z�=��-�G:Hq�}��i�5\R(��+�D�f�iGf|By\c?��M5����ûlV�cK����O���(����}��M�q����*u� za ,���9A��1��\Wy�;�F�>߳J�м�Fw��?a��ι1���c����5/�����m2�a�=�k��/�zz$���lJ�1"���=��N��y�f�PI�,��Yǃ��.���1��`G�)�{5�D��=�s�1P���ABs&<��7W��QQ�z�쒦_X��"q|��jـ���w�ϫ;]��ˋD�U�E ��� jtW5�ѭ��#(�W>�/�����ۃiP���h���&9�k�W��5-!@e@J+�q/@�CB�۪�bB��<$+�����U�a�b=v�3�j���ψ~,���ҍG ���B�0Nq_��C!���� �H>6�NK*鋪��#���%^U�-�lM4ԁ�������2���8�}R�Z�����w���~���P�:Ih�����G�A&����s�@�^����-��t =3�N>~9��\;��������aw�+m�z�HCH_(��o�+�Б�]JR6�gA{��y`���m&w k��@��6�!�C����"��� ��W|V����vb ��x�����f4Di�;����-%Q5���)�6��n��A����U�J8g�Om21��g�rB��:L|q&p�n��ܖ��e�R�<���C� ��jc��Y���!o����A[��1���@�9k��75�lu?]��LvV��h|��5�����Q1��b��L�wR �J� ci�]hm`�@�i��N��2xNT&�L�01��[,�����l�yҦɅ�m�M<�0$�s��!��x��X6��KjV�f��A�}(W-�1pҚ�Z�pD*"?+���.ш��'�}�y�<B(�Iw�n`YWmT`�gݪq���x١ݕ��YjP<��F���N8N������Z D��e����&��kM�������Z��ߔDz�]��aX��q�u���o�á��t���_ԩ�YG��,�m6���O_GO��|>��7\�i>p�I���C.�Qx�Y��)'x��' f���A>g����]VUazE�A��r�X�b��$��?ϐ7��7�H�u�"d�4���nA^%�Dd[��S����!��(6�}e�Ng}�z�Q�����?\�^3�����O̾�1��c�žC.2��9'RG��` ��A5jc�re��L؍wS��F!Io��<�{0Z�L��ֶ����� ��+rrݠ�7I�����#� ��#�"����P�H���_��Oe���O>0Wi��К K�/�(�f��X%Na�w�t��q�+X��M7���W}Y;ƀ��L~����4Ū��BߙZ�dS@�����e�3��z�mMy� c��T�.��[�\�c>�7�撤d�f'���2X)�9Ou�-"��}�[�_e�Qv9���dI�6I��X�mT�,^��. ��O� E&�W�E3�|�) ��E������������)�Lv�(��C�&�/9! ��0�"�hߪ¨园��i1-��T7�8��7̱� ����=�+�v���'�8O#t۠W�<���PC���M8� K!Et���ԟ��>ͭNgj�P��Z��Ni��D�m��ɧ!��a��ߏ�k'���E��C������Q�i��?Υ��P-8�AčZ�+��;G�W��QT��2�}Cj�g.B�bTaJ"�S�l��$�T��Ƨ{L⤮�T�]��]�!|GԍfO�)J�^˱Nc������K*�"���i\����S�N�F#�T��X��.�Ln="�� �d�(3f<qz/dF�Af�?W�ќ}T�ۺ�`��5*9��?.� ٗ���^W�����G�;<�\{���Ρ��ژ��P��u�q���'�0.j��������ՉTxS�3_�gN��n2���=�V��=��>�-z��x1`�4�e��ӽ2���>D�À\�4�<.��I*N��2]�/}�>�N~����# �.���R�I��8J���;�n_M�A>�����aN>Z��W� (���_k�8_����̶�إ� 4�2�K�u& ��|���7O=&���uK�b�4�P�}7}�h��{�6&�W~��u�"F�#���@W�վ8~�LJ�L�st<���E����.k-��+u�(��>Ǩ�p���z�P��� M}�w�:J<,�Y�|mR�:��?)��*��oA�F��g7A)ˠ����R���fK:�܆�;2�CH�m�$ (R��#��(�@8���Fvp����T`X��E����zZ���Q���*&D�I�93����
Static task
static1
Behavioral task
behavioral1
Sample
c3672802acb4d7217ea230d091dfd486.exe
Resource
win7-20240221-en
General
-
Target
c3672802acb4d7217ea230d091dfd486.exe
-
Size
2.9MB
-
MD5
c3672802acb4d7217ea230d091dfd486
-
SHA1
8680e0856a0299367b678265689f59d7f8faa36d
-
SHA256
41026d76a76c6df1dd3730fbd066e2cf15d6cc79ccf198070d6ec6b39facde94
-
SHA512
db193f22e6a35fd10a85f00c2f1a43633c6a6ee0109221443fc4bd381420db0b5b2b879eca203d0677512528e42582175e61f6b0d16233c9be9524239725cc6c
-
SSDEEP
49152:2vDjPYxcpRmPEqtQumGgMZIH27BXeyvqnmVABMLpzi44EsW+f8Q6qf7TGO1Ypq4u:2vDjjpdaQukiFZvqmSBMLRYfz6q1ep6u
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c3672802acb4d7217ea230d091dfd486.exe
Files
-
c3672802acb4d7217ea230d091dfd486.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE