�ka�=0��՜�:�+�'�s�����JA�J�UD�KF����<Vj���̎)q���w���k����=���D���E��r����+$-����^W�ѽ�ȏ�n3�|w�����-h\����&f�v�\-̖�#�����$#dFӧ��a#Ι�SH�H���Ff��D�c�N���H�E"������.��:�{�iP����l��f6q�M��������T|7�/�? �!z�F� �^ع��x����I��aI�P��,)�.��y�q��������,/u��r�����1�SU6X�Q��P-�s0g���Kq�k�]�]�� �����_m�h7���o;UW����D��?Q��R��ɭc�� Ӭ��ce\���V|7,��cƘ�I}��c�.��[Q`Ϩ�C��y��ѵ��V��*C���3���$"b�������Ldd��-�N�,�(�&R�j��2����\�w�k*�I��o"#-�0^��G��Q�c��Co�����֢��?������罬N�N.��Jr�������"� ��?)gh�H���+Bwij,-%����*��ܲ��a�&KY@���b��kO�2j�sl j���(*ޡThVĠ�����D��ȉI�+��w�&���s��*�� 3'����[����h�xy~�����!�$�s]�!߰Fsݸb������g��aS҃rG>�z�S4�2���o[�F�<E�EXL �Hz:�7.hR �\K����\®YW�� ��ᦊ���� ҇#&ṿ�J'�_��M���@�hw���S�,Uj��g��S�6�;VPſ��l+�Z�ic��l`3�1R0܊9���N��aޚU��� �a����� �3 ��j���"��о����lڅ��C���2RNKd"�fR��?�|P�iZ���D��i]��j0��/O�}v�_�;�Q����2�RpT� � �Pp�v�$�T,��� ��LPv���6����ơn���Υi�(���k�t�5w�8��al�}����L�S�(N��}IwAZ`h���K,��l�G:}����%9Q��jqn��<r|d�sF��$Xu�t��ņ�ӯ�1�qC��&��:{��+�d����,�O���!�y��+!�A�� B�=�q�1�}>�6|ߑQ��M��F/�;��e��1�IE����N}��%���?��'h 3�w���O�b��G�Ts�5���&o.����Ɉtڶ�ԽQ!ȅ���۷q��j(�on��d��ʸ5fꦻ;IH��P�� �`��w���E"*��@�WuS���c/�}�0���������'̲���.+2A��Ɖ&i�w]��e"�>�����/zaϑ���gK���k��6σ�]j����jg\���N1��v�K���]Eu�_����-!��+�����*#�!�C��b�Ҹ}�8 �ԃ�x����HR�r��,��֤��^��č�� ���%�I�<H��|I���������~��n��?rI):�QmQ^����z�{���0N��v��x��J�Bc���(������L1ӟ\�� �:ٮ������!�JXx�6_�{~S%Ÿ�b%t��J����1���V���B���X�mYN_0��KΜ���١2������NN �y~%�Kh,"y����?D��_Xt��/�����`<y���~d�)��̽�zS�l��^Z�K�c�9!� *�^ (�Y����&���t�Y�~��/e2�¬J]���z��IF��5��VG���pm��&��jn�h����ep�rj���6%��qY�|���z����[>�ks�K�/�Ȭ-u����^�N�]@�L�?��Y^ d/��p��,����}��qgy:��BO���c��$읈����T��N�XQJ��P}��h�s��DR4�X�v5�e�k,�5����L��,{��c>�]�{ۤR ���Gț�6DU��%!��TU ����9�@�ȯ،n�X��R�@Va/��zr��o$�Ɛ҃{����RH'е���("=�լ܉;'U��j�{+*�?�Oѝk��7Q03c��VjPt�#N��4r%:�?v��5��D[�lѩ�X�=*jδ�&����sL"}Њ�8��H�)VR���jF���v�p��dchPDs��q�l�n�fe�!�< �Of����+�oX��:�dy8Ҟo��=�8�_�V8`Ԧ�>��n6��?i<� KJ��i�hl𞀳��w��GW��n�h� S�>�ەq)�f��{�0%�s7�E{B8�aָ�98����,�ǿ�ޞN����Z�8-��{2S_�Upu��NT�9IA @^��������r�:��{r�Ȉ!��j���-��-�G�lix�������&�X;'�F��� �S��a��s���2XX�llU]��DA7`U�-��z�V��"���yżȨ��br_��_���HM � `�G��5H-�>]��N^'��#|�K|��p�ut���Y��-�-������~9���4�+̨�v���p���.&M�����_G�8Ɓz-eؿY���C�J�r!�=�I:�G_,�[`�1�u����}���{(JC��5�� 6)��\��3�g�]�)�{#ׇJJ �؉u�a�g�������j`� Z{�T(yAzDK�ssR�\�v|w� �ԋ$�uC)�������C�����#�Ǵr��������������M���V�G��wg���vF�x`H�5�I���e��#ӗ�"݃�R�[x��R�L�纽n�n+�ڞ�k��ʔ��@hB�N���3��#j���c&��3�Lb~�p9��cCʜh����rDSxl:2��-���� ���7�j��/�~g2�����$"V�{?�ܵ�<)Ş���9�0�U���>�P���8�%���:��F�`���kf{���q�k&�&�v�.3����>��j��c�DŽ�\�(�(��Q�>��n �N���4���:���v�G8l �-w�EQn�S.C`6��<f�@���6xuc���cϐ�0�� �.@$�H ����k� �����o5���j<C�M�w�Yb�O�o�/�5������W�������d����qE\K���j@�}2c�K��B(�q��v�Y��Q\o����6�x���""i�xz���H�E��7����I�2�C�=nM�V݊�@iE _����}�������# ��b�C�5�)�kXE��!�s��^�P�2�ƵJdh��g;�f� Q!r���5��A��V�l7M����B�*%���>`���6�\d�����=���8dEv01���F-�Xb�� ���WaT���C�ק���=�/�S��K��k�����%����q�����ke\S�Y-ʴ�~�[����<�9?���U�������ɹ��AD5� ;�� ���������Ab��N rR\Vs"�r��n�O7{�����u:p%���5��5���a8KbxQJ�A^�Q���K�����7�؟41�o�81��gA}Ho�q � ��b��ފb��-=X�=|�Bhdɞ��SP ��-��1����ۧ]Q���x^Q�;���_�\�B��?Y�x^d
Static task
static1
Behavioral task
behavioral1
Sample
617d419fdf328f011a009edbb7f00e510a657646078ee2b8cf86dcf080be3020.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
617d419fdf328f011a009edbb7f00e510a657646078ee2b8cf86dcf080be3020.exe
Resource
win10v2004-20240226-en
General
-
Target
617d419fdf328f011a009edbb7f00e510a657646078ee2b8cf86dcf080be3020
-
Size
2.8MB
-
MD5
d8c4a9e006d22b9e2fa85c4965bab6ce
-
SHA1
7f84c95ddc1f35caf5c4a209a82d487231e8ce35
-
SHA256
617d419fdf328f011a009edbb7f00e510a657646078ee2b8cf86dcf080be3020
-
SHA512
99684d66cd3e56c6a2e024957287ed0ea8235cc02b0a40c8ff0a1a80370e96d785eb4301b9a1aa6b4e7cf8672a24af92308ff1e5d5712bedd33df6f5162a5978
-
SSDEEP
49152:OUvmk61xTPLxZeYWXMTXCCXkD44O1dJ2iEk+OGPHWT91kKAOMeHH+/ly9FBVRTwp:Jvmk63PLx22C842eJZOT91kKA0Hetaj0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 617d419fdf328f011a009edbb7f00e510a657646078ee2b8cf86dcf080be3020
Files
-
617d419fdf328f011a009edbb7f00e510a657646078ee2b8cf86dcf080be3020.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 48KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 301KB - Virtual size: 340KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE