�4�I�p�MGa�����-,E��B�y!����_K�<��y{�:QKS�X]��f � l57#�ww �V\Kq8�a�!� 3�dx��7F����3�R��h�=�����2����]�D�$�NQ�R-�c�H�`+��������P6���bJ�U����J��b��~W��V6�g�G���ha�����Q��NZFF����7jЌ]X��cʖe����-_Dg;ݺ�*��a�mq���gr����ޖ���;0s��J]2; g��\���S����ot�ߏA�������Dea����tw��ݽ�������8��UV�!]a7�C�H8 ���[&B�I��P�<@��!�H����J�� ��g@Ҷ>x�;��z�o��H�*�/�d;����c} ��5X���$��� �5HW�`���COl�|ݼ5p>q���l7Ч�YD��@��Y���bQ�6oOb)��lԣ��JW�z_ӓM:�^���R���܂)��Ě[6�Q�J��Z���GJU�fw�����8-=�?>����_ X��Y�uI%����(�K: �]���#r��GC Qb`�8#&�E�A��id��v������hC�VܗhY����=���\�Ȍh�_x�p�K��g��LDBB��N��\�v�&�&��O?�W u��G��o�jz���m�u��&+�Y��030��5�w�~�D��<���r�2�-K�;(ʁ����2�躒F�`��%� ��Q��v�"��jfd�ؖ*%:�5�ȝ�A�8��<9��Uڞ�)Iť� ��z� �">��`��[naҰ䧜��u=RwB���캊�j]��OH�Cl=R�� t�����;�U��H��8��V��3S�d���$��{��m�Β�q�����p3�(� �<�2��X]bj�r��,9SLg����h\��G��y,�8����0���JH���������GH �Y�&|Eb�<�#`l���' �i��*��?��J&�~���9.e�K����u�1���yt�6�J��7����L5?=N�W�zP�$i͍0�_.R�天���V]��. � ��^J��j��!(7��������g�]AN�����;!�Sx3)�c�8���� �9�l�S�<���TM�p��Kdi���z�:)��Y����ʏ��L�:Qx�l~{�ڙ~��]�x��a;g��][�J��c~���aU����{��6����M�$ހ�/�p���N�+\�������9r0� ���¿�ݱ�ՙc��]PXE(� �pWl9#Í�{��W+#�Uc?X4���2։����86���4�a��k>��T���R�/���j���B��$@_��O�M�{T�ܓ֩�9��e���pw�v��L�5��;�?��eǞ�f�1il��pٔ���'�����/\L��|=�H�2�J�;2��Q��~�l�>�oȸ|ˈ�UB��ں_����|S+@_yG�\�{H��a6�=�Vݕ�B{��$c�b�*��v��^�c:��6���z˴�5ݽ8�����e�Bw��n.�B�Y�Պ�^���]j$h�')���|I�����[R� 's8;�xnń�n���Ú�?0���X�ӡg�s�G����C%���6�k{������E�`kv�3�"�7{t�ȵ}�gz���z�T��Is`cZr�nL���lZ��['@�n\���q�#����H�5ωEq!(�5tg ���t�O���w�Gp%��������sF�WʪvT�,i�I�l%��h�B�p.�3��xR�1�R� ��r�2��=�F`z9��H����w�f?U�7�S�����l���j�B`k�W��۪?zG� ����O[��|�V�2���� �(o�7�u�vC�-̄j��0��3��VS�A��2 ؊.�R!�qk ��+*�����%\k�����#X��YO�n�'E�� lݼUTA��)��l��^1ڑi� Ȑ�zi��x�# �X |�%��r�۳�u�+qK�5��?g�9�,`sT��o��ʋxu����n3��@n��(>�x����]�������X���m�|�!�*�;�����V^Mom9��Ȥj���c���NZڡ�g�I�mt�l�$o�c:E�)ńR�Q�~���؈?-��73S���m�\wg���,����r�`��t���6f�1�� o�$t���|0��l ����*�������W�������u��(�����>��+�ZA����?�|��%��9�V]\K1x���}�;,��7[:־I��YP����ts�E�PA�2rӹ;p��CTY�Ƃm�;IJA��C���c�W��(�N8�_����r|��=��o��j8b�vŽ����S�|F���^��m/��p h�~x}�q�8rDT����x��m1�DQ���S�!��# ����(o�Ow3��:�vx�D1��|@�~A�ie:R����7�����|� ̔�f�:�o���Dh����Q?Wp3R�S�nd�27�-3��"A�������d/)<�p����.�����7ڗO-�C� �ɶ�& =wan� �XS����`I����{�x���1zf/���S�<�Ib����;G�˼k�p$�.�v�5K�UO������K���%�J�1#;X �)���q�o���~y��?��BP��N�WnA�=o���M;e /�yqK;H���@@eN��J�d��"�jb$I��,�LSg0wC�����&=GG�*�ŋ�$NP�#&e�h� ��G��洨�3�*����?����8�7�n�-舌��H���� Otv��;d��y��%�V�gN��%�"�*&<S=x�ٶ:I�MaL�1��₪���G�v�<;w,�B����)�%ُۊq��[��~���Ź���F# 4)�99-�t�0��Q��U��NEE���=���w?�V��@WO��)�u�5�>��+vGy����V�9W��qvG-e <�*`��A���םD�B ZYdƗ&�/X�F�b��"���S�=����P6�mPgۈ��� H��L�*z���4����Wt�T2��� Ux���������C�!pC�@N=�BKB�9����g�a�3�T����_уZ����ȿQ�TֲTi��6e�VP�8G�p�.�Tbm��>����uZ���2ڝRx ��cE{Y�1��1��3��V{����`�a�,f#�OY[j�y37ˠ���[��������<O�1�{���z��}�������=�"���Q�_�� +��9ӏ<�e�n#�B`A���S�.u)uBN=�;��������A��H �y�ғ�ǁq X\qJp.g�\��[Q��a��۳�MV�2�� �*4N��<6�$�Ga�>3�����6��%��c�[wgG��N�� �8B9$
Static task
static1
Behavioral task
behavioral1
Sample
06c52578a220926aa5862a40530cf60b5fc039d7b857ebea1074c90935be5698.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
06c52578a220926aa5862a40530cf60b5fc039d7b857ebea1074c90935be5698.exe
Resource
win10v2004-20231215-en
General
-
Target
06c52578a220926aa5862a40530cf60b5fc039d7b857ebea1074c90935be5698
-
Size
3.5MB
-
MD5
4465c5f0eba6a94abcc7870d96ceae82
-
SHA1
104d32a8022909d9a0e1ae0bf8dedef524677acd
-
SHA256
06c52578a220926aa5862a40530cf60b5fc039d7b857ebea1074c90935be5698
-
SHA512
d781dea37b8bdc85f10a9ebaf3ec28f6b3f73d631e446705fd84a70ad84aa860ef3b36a025a90c74a52622caf49bb96b8c89f0100c5466bf494189f3c8d5ec7e
-
SSDEEP
98304:1Tnesfb0eZvobRx18hATF0hrclB8l5MGG77GBfWUdH4AT:1Tnp0sSRtTFxJGBfWUdYAT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 06c52578a220926aa5862a40530cf60b5fc039d7b857ebea1074c90935be5698
Files
-
06c52578a220926aa5862a40530cf60b5fc039d7b857ebea1074c90935be5698.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 14KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 17KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE