U��^����N�X��]P��R�:E�I� �X��gBjh�@�*��p xi���BT�8#1�����0q�B]";K��h�~Gj�웋Fb~��rݩX��H�ekk ����C�S8]P�֬��g��*����-8�3X�1��/T'���}�d�����l8l��ί��d#eh*�(n����`���9���ʨ�� ׇ!T��\�3cl�8 X@!��-ka�'B��\�׀�`���%�(��>4j)FY�����q݈�*`-+���ζ�n7�m4|ں���"����M�Ȇ���;���m��r�\��4���l�V�5H�4�U@��}��F���?��ܯ����=��AlY�%U��ի��/\%�`��:�����8tA�Z)b.�e&�I��|D�6/%3��%&eۡ�N��p�-x���=��i�>�êsլ��źJ-�����K'��F'���aC�N�29��: E�K�y ��$��d�L�� v}�������UT�J3v�4�ϰ��,�SS9I @�;v2s�ߣ`����q?�VpC6]����}�Ō�&�_}W`���{^� T�J�i�8�����j��<�����pBceP3�{j<p���+���U�~BeUKMSN6����L"tӴ$Цe J-���Z�>ȡ�T��|/�&����b����0Ұ�.������e��U����랹� Ų%�<Il���;�w�����2/E�vT2`zNd)^��p<>p#����ܧ�sZ�Am��X@�})%����ٞ�g���a�y��j�V1���SP�-��{��8����o�,{��0�����E��A UY?z�hR��!���R�h] I�Kڡ�8��t��VUX��}�����i�K�T(l�۾�X����0�;���ߛ[��J�,�4okr�!S�e���v�˕�.��<�0��6 �Ǎ��� �9:rX9��p�[C�d_S�mu�Ϩ]�`��t2<���(���0�~����O7�)���{�r����Y�@�����}���>�Aţ"��?Ou��a����;�� +���TjNg�~�j@^P�_��^�:MFv��n�h_����������.�(0��Tl��ϨG����Hs�����W�3ƅ�;ܚ/�b.��tI��L�6 ~c�Oq6 ����s�NU5c�Ow����,��۾���z���%���ee�����C��3�*��8dF@����Ȫ�/�>���\�j���{㎢7�\ -�P�����/I�K��-�6�'��Z�F�V<G�6��"���o�Jﳥ�?���.�F��W�Wӛ����9݈�7��TZ�A���k�M`�Qϔ$2��/�����bQ�a������Tڛmh�߮�x x�zi⥚@�?��8�<�����V���C��\�_J�%'SAY\i���A���Rz Ga��V�p�kE TN�^�3hh��J�}[�zSuk|�̙6_���uz�0��t(ep�ls���7B![���ͭ�m,6KG�X���-�f�!̀�¢�ٗ̔F��|t�t l ���Es�Lf1�1��^���5W��LH�dl��w{;O���E�Ѓu��{P�H���AJ�O>a��Dzh�z2�r+;}�Ow J�?�9�V�"Qot/��f��QI�D���}���>E-�j����=6'Ǐ���9��\G���,�MdN�{�!_K���d�:�%�:z��ؔ�W��u�:z���ỻ�Ue�\�KO)�K��H'S�mF� �RW�7숐J7<W=@qJ&��:�@X�6b�sL�]Nj���yd�y>�����VJ#6b�/���і��'J�,Z����/`������M8��@�i4��~P�g���X3�����7e?�g��qu����1��H�c�@Y��p WӍ�c텦��� ��Y�ӿ���&�3s��iK�9��(�-������&�����n����e=���ht��ٕD��� ��./�otA����ةZ������v�^���+�����Ց�ٰgGZt X�/)i��x�\����0S����ϝ*��I� �h#ɸ����y�j�Pi�e�)��'#k��Ÿ�ה���!Yd�~{��ء��jg�����6F�D&���I���M���v^�(�%�"����˪�x��*6�$��z��K��GH®P�ahs�n{B��I�d�C�@98K���� ��a���*��]6V��B;�c����� ����1�CK�%Lɽ�~��n��7�����(i�D7Lr{��1�lB;.XY3b�5�d��X�Bօ�~�>[p��(d43;b��ì#���3����n�w�q����b��>�NFY��5�����op0���<�h\�q0H���&�nĺ�J�r���ʥME:�Fߡ�bi��I���! ���f}!F��3]M��L3�w�(́I��s �ƣ�M����>�Ol�O�Nd%�W�T���P�m�̖z�5Z�@� y'�[��DZ�6k�:1&e J����W^,��[@����Ϡ: ���lj�yyњ(OjӰ�7 .`�e2]�@�Ψ�אbOE�l�'����~nL���L�ߑ8�wT`k�x� �/�&nĵFz���>�p��썢�D* c�AY 0�[��1e���[�?��=���V��1�v~84���7�D�G�:�ڵ�?���*����&�~�vWf2�gJ>ا��&ê�����]4�^������)�I���R���{��k�uL�A�T��+�!|!XX.��5��H�p�mƶi���̑ޡ��n��h�J��V�~=Dϥ&)L�*h�sI�I`nG�P�Z&L��Y�d{-���4)W���4a2��C�]����IpVN�/z��Az�I'���o�ަ/Kl��mAF�@��`N�\��:~�,药�2�9;������~`o��#�����i�PR�b������-�|@��$��!��5$�;6,*J�oQ��p�a���%�NnY����o�[�F���n�a̭/:J(���o�?x��>�,k��N�������6���%?ېZ��"U�I�������^�-������d�4�1=.k;�&Y�)�Wƹ ��M-a�k�¥��8&,���9} 2<�YmMԓ�;��x����������b�>�ܟJ��0���y�H<�$^ȱ���1��������=#7�)�����X�rm�A�kn�&�����]�۹�|��%\ƿ7���Z�� ���i���1�ͤa�v��I�^�R�&kFo�Eշ݇��12U���V��V��/d.$�cJ5�/�x"wl����b��}m�E�yzJ��M��=�O�#��X���_��X:ֱK��]yD߰:l4�L���<��D]AϢ�U3�7�_I'��ɿ��3A��}��V]���A1��Ɩ���zK���{�Ӱ���"�J>�d����y�;�8}a��Λ����u��o���$[G|��e~[��kw5M�/���lA�4[����@ S�A�I,]l�'S`���V��^}ч��(�Kq����$��Hj��`���ѣ���c�cB;����I� :�B��M�9�/(������8t��� :��������5#u�"5��p�����A�8qX�VXl�&�k1���(<��.7B�GU����S�ˌ�/#�H�G�>]�A�`�ؙOec3M����L+�,�3����!:�;���c#c������R��#$Tް�tь�$�[�Tw��Оp<m��i�|Fڢ�i�fdlf���&���Z��no�rl9�\�o���]�I��c���8����٘����
Static task
static1
Behavioral task
behavioral1
Sample
e8a8f881aaf35b175cfe5b11e7d1e1c9cd411e6cd9c8eee2226a9bd8da6a45bf.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
e8a8f881aaf35b175cfe5b11e7d1e1c9cd411e6cd9c8eee2226a9bd8da6a45bf.exe
Resource
win10v2004-20240226-en
General
-
Target
e8a8f881aaf35b175cfe5b11e7d1e1c9cd411e6cd9c8eee2226a9bd8da6a45bf
-
Size
2.4MB
-
MD5
9bb77717d605afa903f3c5f3a05151b6
-
SHA1
8b695bd16efff8a483bd888eec5ab535cd3a3799
-
SHA256
e8a8f881aaf35b175cfe5b11e7d1e1c9cd411e6cd9c8eee2226a9bd8da6a45bf
-
SHA512
3eed79f6174dd517f39e51dfc24d1ccdf91bc05ef4b093651ddacb30db10ac8b2d3d423b3ae13b31275d1c1f59350f245736c1fe849a82b11515bb1ff56e77cc
-
SSDEEP
49152:EC8QSYQYz4n74BviUmf/W8ikrX97ZbDYHZms7KQBGH/bUJp:ECAYBYkaUmf/8yX979c/GiGH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e8a8f881aaf35b175cfe5b11e7d1e1c9cd411e6cd9c8eee2226a9bd8da6a45bf
Files
-
e8a8f881aaf35b175cfe5b11e7d1e1c9cd411e6cd9c8eee2226a9bd8da6a45bf.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 37KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE