9�4�nq��T��'�0t�����*#k�O�_�~��Lu���$��]u� �c��.�5⁸P 6#;��Ε9r2�$�a5��91�²B��C��-�ef�=����ܝfNuגX}"�Ԁ�ߗ�<"���~�1 :�k;�E(9�1¡.0�IȾ{&���r����ne�ZI���0�گK�j��/��Y��0��~��s�+ë\��(������CY� !��P��ɷ�wAY�:��a�֓���q4Eu�X����r0a}UkJ�n'�g0+�_����k4S�������u�3�ě��0�ɚ�zJ�"�I���Gx�X�\3j=� m���E�8��}���&�� �}@���G���B�t�!�d�sX������_E�&�Z���J�+VRD�*x�~N��y�}hĖ�o���iy��g�+�7G��w�i`�0���-��+� *� 1(>h�Ǭ�9�or�q��m�4���{"�z�Z$�Ѿ�i���8�lG��1�U��:�ic}������|���� j�]�ރ�3�|�G��I��w�v6X=k��i�Y�3� ��9����UI��͏u/�1 �;���E��"%��l�¶ �����@[�W"��Q��؞�yw����B���:�;���WV���+Gـv��]�*�|�g�rzd"�. ��Ψ�f;�3���xT|�3����,�4Ή�hz����1zw���E�eVۙ�.ޛK�Ǚ2�!K9���`��%��4j�fzH:22�d��׳o`�y��X� S����p�p�i@��@��'n[+����A�>�OT�N��cNGO���lʁ:�d&�p�9B��� "���*�k����6���-i~�:l��g�|Է��p�L��i��b.�*!�Yy����[X��k{���l�|�-��H��6�T�t���\U��ʹ�$���`�Kwn��@�^�D���d^0��pr�C�g�{Vu��T����K]D){[��cG�:��y4kլ�YYq�������_�#X�u*��x�>�X��H��e�b��ʒ����#lͩ:�p���x��������-~8.8q!�H�%����D��»�t�b+k�`�*5�Օ��� �� o�x�W������ؔ�+�so�G�ή$|���w��&�B�[����i�%�C#:�j��?(�Xw�S��\�8{�X��*�������Qe�tҪ��o�7I�6sȭ�k�r�iS�Mt���̣��S�9�"���vE�z�ާ�ٵ�Z�%�I[Z�Lw{�n�)���N����la�hU7�B��n������z�ؒPoKT�Sq�QG��8o�����5`T��lS�VS���.J�<��=8%���8F���p��00�'����+�aB�B;V��6�Tõ�1O��!)bi �#.�5��-�����ȁC?�:+���R°K��:c���$c\��r�"��t�K3Hu�u �-�s��z2�7����3jtp��r�av�<ZǤ,Z",��)�t:�����qݒ"r,�������%F�FH�����?S��2��uʙl��P��?����|�-ϪGIr(�р���2.��Q������W����Ċ �\��OB���ן���{[`c�кryK�0A����92�d�+�EJZ�Z��W�i�s&��HS�1���=w����,��P������b8�9�?mB�ƲT���'ҝS�F�Kc��fQ�h%���걚:��.��1����?�s�.���q�tzZ�?��8-�@�nѸ�Y?�l��T[��������-;�������en� �jz���I}{d[��gI���� �NJ�i�x� B*]�{���K�)�>��?I��Q�����[�#J8�"�DZ�b}�ބ�9�@/:v�/t��!��FV2ЯĮ���>p�^��.�#�!�ҏ�� �x�<"u�9�E��A�B���DU���[��i��C�\���D1��]�W��RZ�H�����H�%��?��(�7:�=.w͂�GmE�>�=��h�%Y� �M.=�Pـ!?մ6��ҩ��U�}�pq�9� `�����@�н�SVsEɩ�r��f�ҹ��~�6�`�C��kZ�����5�G@+h���YK������� (ua=�^��j�����_(]|��!�L�4����K2?��^[�c��^�;�Ӊ�/��P�/��^K>�P�!X��U�5�4��� cc�;c;G��#��;h�E%v"�Z��o����ط n�oH����7'y;+����B�4�e�W��ħ��?��+��˴�� ><%�(J�u��,�q>پ��=�7.0�G���B���$ڻ!�,q��Ĭ�Ok�!�x��4�`�˄ʧTt� �O�"�e���k|�n�}�m �~j/�Jw�-#S��뫶�";8B�-�,��A��O��({}ӝ%ӱ���d�'�"�Ԫ� �XbՏ���/bj�I���rk䵑� �� ��4��L����h�j�Lp�,ώ��<�H\��'ҏ����:M�BR�`���&���ZΛ��|��{��Ut}��~Ģ������eI�L�)_�ɻU�u�2�)���O��ƃv݈�-W�?+lGd�J�z��L���گy�� &��(���j�i�?я�>�e8�泓��H��̻[u��&����u��+0������Q��H�� ���v�h��6�� {7��[�����G>����(R���8�Z"�}T0%]���&�C��8Ұ����[��|��4�{��,��>NM���<������{4�A���q����Xr~y�l�MO��Y�<�����;�����|�qY^��93wb���-�o $��w�u��dz�l 6�a����Y��,�k ���O��c��,1P��>�_u����\����4�)7�*� �R�+���~��� l]��vV�������&(��]qt'0 �e5�D�l�r���8�����E����^*wD�0O�����kL3�p{H�GC1U��8�(��M+�i�;�Aҟ"]���1�wAy˦R�'��Q v����z��@�x$�'P/k���5��$QZ�k���Z�>����R2}����6 &0�ρ���≹��$��Ծ����Fc>T���H����em�{0�7�! H�#~@�I'�]"J]���~fC�1|���TVu7�����C� �������Sht�yZ��(�N�r���@u�2F(�Tđ:� �o}p�G8���*x"�$�*@ͪ���%q�p/�uz� �Y>a��=;���"��e�@��
Static task
static1
Behavioral task
behavioral1
Sample
d86bc35d05e98fb1d5edf6f898fbd6717e47f3a6f970fed1b50e2aeba4879f80.exe
Resource
win7-20240221-en
General
-
Target
d86bc35d05e98fb1d5edf6f898fbd6717e47f3a6f970fed1b50e2aeba4879f80
-
Size
3.3MB
-
MD5
1cde9c439027ec4880089ed21a21244e
-
SHA1
49638d3f2e861d46eb2b34699dc194ff7bc8fcca
-
SHA256
d86bc35d05e98fb1d5edf6f898fbd6717e47f3a6f970fed1b50e2aeba4879f80
-
SHA512
2a91b756f689e14e288a3f3ed6922294695da74200f3c44c47eb6bf71282c30cb656c85c94786458ff7975987906773cb9370c0c56169a500842be728726cbaf
-
SSDEEP
98304:uQQKVj71zQF0ZvpVyGsTkAiYmq9wus77GBfWt:1V9zPZvpVD+Xmq9wu2GBfWt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d86bc35d05e98fb1d5edf6f898fbd6717e47f3a6f970fed1b50e2aeba4879f80
Files
-
d86bc35d05e98fb1d5edf6f898fbd6717e47f3a6f970fed1b50e2aeba4879f80.exe .ps1 windows:4 windows x86 arch:x86 polyglot
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 14KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 17KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE