r����~���y�����,U��Q0���1�e����۷'�V���0�mQE���k���FF��;lyw��yG'�W�|�$�h���G�{F7�*�N�(4L����J�E"��mW�qbQ�����"��L��&�)�g@pZ[�L�����Q��eE4���T>mO3Ν�s�Ul.9/f/z�-2k�rb5}g# b������i<"��*���)�' K���Q�����_�a��PM��١㉾�=^�� �s��F���!l��V�"��a^���K^G?�����h���WE+�ȗG���� y���ὣ�FDv�"��wK���bw ��>�e/Z�K����}���܂1���v�1��`������ҫ���B�ѻ�Е�I��-��K�T$&B �c:�$ ��1̮ͻ퉉�q����!V^A� �J���7�k��S����f�唶�lQ)Gd��L{P��ǭ���ir֯��1�*A ��q���!�]?�S�ΛȮVJ�ps"w��q2$z ,�L��?;��9��V���E5;7�$>A�Viіy��J���M_��Sk�����]��0��u&��(�T����|��Z��I+Ȑ�9���~�����Ow����ʣ.�����d�����h��_��F&A�)`����������_#|\J]���M�{��H�$��(*�iɺ��y�#�z4�u��\am��<B훒�3�^+$������g�����MG���b9N8]�!x�Q:8 ^��vKy��@��uf8�.d�ߔ� 6_<֫s!�cz1��>��X?I�$�9oJ��ʮ��W���52#�\�#��]�6��`h�?�ʯ�Y �8�"5�M�8aɱ�)��{�n�9w�EDZ��}'z�ƶ���PQ��x/ ^���.�8�kws ����������w��/j�.����&z�A"�H��G �D��L�u��6:���:�ٕ��e�� ㉥=��2Tr�����z`��ϙ'i�s��r�Y��%���X(.��:�>|�{V�`��fb h/S~�;Zp��ϝ㌼r�H_KR\_7Q��d��4������uK�Z�7Ȫ���o�����h[< ��W<2UU��q�C,g��Å���W['����b��Go��l�U/�"զ�ㆂ�F�X��m���=\,s���!I��0%�Lɵp�������#����H�RW���L��}�]�/[q�3�"r9��w���ܹ��*x8���4)q�m���9[r�ؐU>� PJ;�����cI��H�3ً�Զ�����d�"Gʏ�s�>�P��E�^�6������&g���^�6 [�S;���/fW������X��J����5�WŸ�`{�������I�`��� jF4���JkK�0S�w���M<z��(뵘����v펉�_�ڕX^Z�[Ƃr�0k��; ,نx���o��C�� ��#i�&{���pZ�[Wjr�E2J���~�ij)g�h�4���=�l���Y7�M��x��zE�V\>�50oiё��;�h��\���e(�����PJ�)@�@�`D�[<%ɇ/ ͔�c� ��~��,[��U^��H���)��2���;w{�7�Mmsu�MW˱�#9ɧ � ��L���b���MA��X���=���A��p��A��ۓ$��L-����H��q~��ckw�Qŭ1�=w��-�����@yQ��+���Ol��p�����DMҕw8>M;g��pȱ=������[57�j�B�Ja{ywy�lł���u?G{�M �'^V�k�f��,juE��˹��JS�h�(�f��y��8� k���WF�������jӋ�c�%���g���2�Ƈ~�^��b�ə�������9zk2c��jD\��;M1yvRU�.'a^,jt���eς$h���{{�Z�t?ļ��h��/���H�Y��yɜ4��^�R5Y���M��A���6�%p^���6���<d���'�X� ���KR�vf���j�i��d��6�ox�z�JZ�(C�K��&�!9����_ �4����N{�r�g�8�C�Eh�!97���XNeՇ!������l�����VB�Ҏ���$}�V�8�ħW�8͙f�gNH˔u�)����#���@(�3f�jߪ����Ǜ�w�G�7B������0�QD+a�-�F X��͎ےS20p��`_��c�.��?ʰ��q:0y��ca��A'J7�3kz?�/dBU�zjnd�2f}��P]�m6]��,�`���F���CE�0�)���6���7˟Q�Rb^����l�P��C���i��Ì���N���� �ա��B�a�\7�d���v�;P?0f*Ӕ��m��<W�<��F.��op��C�P��N�����-E�m ��x� r��YB��]���=x귓�x.��) [9�C�!nЅ3�q�V=4�qdUŔ���F���[�����Mg�'f��P�nJ?ָr8�����&�6B���ߴE��W�{��S�S�]��w$��=ƍ�B� 7�96�tֺȘS���0l��j��:�oo��k˄\�i/�%#酁�55�99����%w)'2U��ۿ7x?M�,%�-��,_��2eo��y�}y��2�=i�d���Z���c� ~1ܑ��Ve6�/wk�V��%l/�-I��ʗ�� �>��K�9̀mfH;SD���M<��S�D4�p��>n�m��LE���Ē�2:��ħ���#rF��!����K�9n3�˄rQ���(����*8$xе�*N��Z��߬�_۔;U͜���M��2f��<!X\��o��t���YpH �%�)��*�Z9W�,Z��k{�ĺ0��7���ޠ���p%3���蔾��!K���<�Zfl~��`q�}/����8j�����i�6�W�1� �bdž=<y��29gn����n\bގ����j����9�����Ł�늸�kO��͂�Y�� �8ݯ-�ﱄrI��d,����R8��j��v\]��Q�ZߡS+�*�u��;æ���)�j�@�>�t�~q�s��D��C�q�<��?��G �4��]��ֱ��� ��[���J�Y�֏�����_�V�)��)oDZ�w�7{�A7��Zُ��5ҜX5R���t����JZV@����.�yn)h~��nZ�9"���'��v�S�z�Xj㘀맙������x��+!������P�(g��&��xb�"��0����lᮃ�ٔ����־3��P��KN����,v��*�ܬ�lǙ<�8��ծ̺h����h�c��&���������`>l�����ݩ{��O C��&C�*��� �ڡ3�ȣ=,1�=c��H���Nl�x��"��BB�V���M��L�f�0����b5�l�f������w[�"��g���/BP���b�t��n����*4?(��������f:+.x��y���b��"339#��e]AL���9t�n������&�@��l- ���|n�d�|�=�&�wR�������9�x�����e�5���Me̿�uN�G>�t>��E �:�2S仜��f��4F�+�;hQL�ʲp��˲\4o(7�h����n13q����Q �mA�e4�|��xQ&�r�; � �m��͙}Ɲ�-g���(J����oxzm�3���~l1G4u������箱����U;�Ò����NQ���*9�K�4|�#긨>� ���>��cl� |� +�Kp�2J�ۻ́z��6%j��#T�lfvhlKi�^ԅ
Static task
static1
Behavioral task
behavioral1
Sample
120893dadb59b6894d2b2cd14b78192d43cad25bef17f8bae97820f36f1e12b7.exe
Resource
win10v2004-20240226-en
General
-
Target
15699655525.zip
-
Size
2.8MB
-
MD5
57c30c51c14e3fc25ed7aecd4b5f93e1
-
SHA1
62fb5e41a3eb135a3a41b2353167eb6624b2c05f
-
SHA256
272175adb1c187919a76d2aabfad4a085d7ced576ecc6f4c063194e7bafb1a60
-
SHA512
eff9470c89ad880a9969818ae4ba1fd67d8c56ad8ed03260d3bcf09c639fcb0d2809ffef0628df7e6878aeadf9f347421f60ec822e9d750bf4e07219aa01e77c
-
SSDEEP
49152:qAO3LBkQXOgo/bWaskl4yNcihgSxqusH5NQAGkommAZh08f7w+1c7Jy9UI4lq7tm:atkOOggbWasCciWSmH5q+hB7L1c7c9iX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/120893dadb59b6894d2b2cd14b78192d43cad25bef17f8bae97820f36f1e12b7
Files
-
15699655525.zip.zip
Password: infected
-
120893dadb59b6894d2b2cd14b78192d43cad25bef17f8bae97820f36f1e12b7.exe windows:5 windows x86 arch:x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 632KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 77KB - Virtual size: 316KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 433KB - Virtual size: 580KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 75KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 570KB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE