=8]̩�ۅ����KgR��u�0_�̶�lh�u�4���=;�Y mYNr�z�F�6`������'�+X���Ȥ�0'�Xnc�����!�� �7��/� <�2��W���|��j?����g����5�UѼ�f�ծ;�����q�|���1njA�H����~������J����oW���8Y���Z�e�C�1_S!�C�4�o�kcfp����('b5"$*_L60���LiB���rc 7� �p)�9ܳ���Qq/���-�7��*�8�op�W������k[-[|�8 w�T�� b.I���cw�q�aT1��2ց����?Sh���v������Q�>��4����qԈ�������PuY��z�+�G.By�����T��}�.!&$ �P�����^k� ��@>g�^��'�k?~?���a�f��%��A)����p3j�sn�.�u��@߈�k�N($"�0cy� I�*��c�����bӞ�S ̨y�����.���.(��J���3q6Qк�.�NY��vf�EA�)�N�vF�ĕp?IE�0��������9�������z�O��}ၑS��d� +Z�Ӿ|Gev(-Vur��{G������a��$� ìt�a��#�����&�k��q�`�Ko<�{��9�V��8ن�C�zb�m��������0����9hS����3�ECcz�n�S�f�/F�.���\r�_8h�cw*�j+�9e��T4_�/q="|�7p)������=z�8�Te�^hB`����m2�1, n���7����p a�EH�ow�o����9d�W�aļ�wH�?�vA)���J�����{�W�?ɔ:���RhGZ��h=���FAuf^2��G��go�X.j��,Vbvpk�$�;F��.�Ŗt����L������j�4<dŊ�l��0%��3V��p���9���Ѻ�9����=7���&QC�X�_�\��M98b����$���8�o����|���듪5�2L�4W���4f�j��2��D=X=�81�fɒ�H�/ן:��\̩����߭�p��+A�N���%�i����Er�Z���@'X��8/ ]�-�lJ�v�.7��L<��w���Z���/���̀�/)��� "g�Y��#?���t|�yOI@�{�#>Q<Ѱ�@z�?�7��!�$���}f�3�,}E�U�vTh��h�e�Ƞf�>~ō�܅�*�"����_d�B�YK�\����N��g$��%8�磊q*� ���k��/~�p�L��v0�!��������έ�̣��q�2/����1���z��X�o����8�*�Y`�*{������#�(紌���1H���0���᪫57��W���,RB���|b�!(�b20�� �ƍnӢ8�5^��P��������p{E[��j�t� `�@���;{ ��X�jm=��U�b����Ƥ����q|L���`e�A�'���*kW3ږ��x�LX��A&�������F{0�v`��ώ�7��F@N,�����B�ˬY�u�Qx�`��1q6C�6��Q'��\�)�fN��S�_���Y#m�鼏��,K��ʑ�Hp��m�����7�����?]�Q{�<��<+��ȗXZ@vtF��f�4]���&̑�1(�߂��O:�+� �dxþJ�V��W��xCj�ٟ��a�M����J����thb/9,�\Y����S��o�U����}�a�G`D��<���.�_}�89/����+acE���-��c��h��U���[��9���"P�H ?�|-�x�+<R�6��P��Z�l0F��qk�Z�J�+���o���%�r�ف�! hc4B�Q�cb*<߲����4�.�j6�NJ�ۚtj�A�M6B1"��΅)�q���gΖ T\��jF�7r��v�Ĺ�����4RM�+�nO�<=ZjFA��n�w� ���Iu��@5p�U��/�����>���VШ�K%+�|���5�u0�!�����\e���WG��wi��n7���A�h ������H�!���s��5�`��z!_���-"P�"���'{%Wp��3v�}-��oˎ9��<��;�S�p�=���Su� �\+r֪{~��T;�\�jƢ��i)����'��h�����b���i�ʟQ����w��#��t������˷����#Z�;�f�?�f*���H��ʓ��ڼY�$��^�ʕ������W��Ik~�j�qy�ۻ��%�=-��0��^��WeȓV��+�T4#�Ǹa �جD\�O�b"�?�bӢ0=$�Ё����z�M��=HM= :H���t��Ĉ��s��06��V���������E��pɧ�$�7bUc�3�R��P������b��ٟ^�7&�9��qV0����뻘�3�Y���.�D��W�9�Ο��1ɱk#�h=0�OQ/6h�5p~L�Õ:�R����q��-�>S8�64�[7��z��hg�h)�Z �#r�ڿ{{�>�J�i]p�\��I$�̯-]�:�^6�A��)r�o"E-�㨅qr�����N�����^j,�?f��v�2�q�'y�g�R�Q�L�s��ϟ���ʥ��ؘ���B���dQ�U���C0��B�<o�����y������]� 7 �����:����V���Y��s�^F�U�ܾc��p2~�UU@�4�i��: �';�g��Ӯ�G^�G5��dU.̉�xr < ����/m�]��ua�̼_�hN�*A[�#7Iw��BC�Judߟ�5�]���f��a&`��V>M�/l�uP����>��5˵C �}�In����^_O��F���F���)�ޥ�~F!S 8��6��jS���mN4K8l:]r��������D�d�0��V��;d'%6���ٴ��s�F�\}}��U߶w;�<��EM���dEA��d�'W�{��1k�O��˺��u,-nx�p�4��:ث�ۇ�%�I�����{�vϷ��n�=�7��y�H�7�.�M]��h�6=S -�"ܲ�Z����P䵁����:p���Ue��i^}�V��/G���A�\(cm�8"~'.�{�u������ʠ@I�L�J�S���E����0z%u��m2��p���F�q����;g����tݯ=�.������g~�X:�/bS���2�w!>�����Ű]�����8x��/��dA��|W;�Y�<�������>9S�jP���fJ��p^� ^���%0��ǷJ`����メ�ى��P��>�,=�jY�ĕъS��.F���e�-n�����0cD���J�x���Ӿ�ও��]1������9m�m��_Z@���C6A9ȩ;q�`��\��f�VT�����]��o�N��i��{�Z ��y��@���ű*c��oR%���0��$!{(7�ΔR�a�i)#d ��� ʼn���P;}� h!��˱VY�� g�,� �Jfk ��� �.[3!FKʁo� �-����V�����Y@���m�3���m;
Static task
static1
Behavioral task
behavioral1
Sample
635ce02cf64127030b05e3206387a7a1c624526a7216b06dadfe9dd3d9bfb14b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
635ce02cf64127030b05e3206387a7a1c624526a7216b06dadfe9dd3d9bfb14b.exe
Resource
win10v2004-20240226-en
General
-
Target
635ce02cf64127030b05e3206387a7a1c624526a7216b06dadfe9dd3d9bfb14b
-
Size
2.4MB
-
MD5
bb52a2476fb3b85f4e12f5df5269179e
-
SHA1
b23674d2bcf92f1fb129e1338108ede0c4dc6a7e
-
SHA256
635ce02cf64127030b05e3206387a7a1c624526a7216b06dadfe9dd3d9bfb14b
-
SHA512
2ea38002acb199303a94ccadbf670d0422624917d8a3e2e2225c0d378bc22166ced895dcc16a86fbc919bf255e13873c67560fefabdadd0a9e5bbce523650ced
-
SSDEEP
49152:4yjJo3Qu5f1huesCm9q00kk/8mkobfuIvJcUi4XCZubs/0E0Ay:DajoeTmR0F8qbXvJhXFs/4Ay
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 635ce02cf64127030b05e3206387a7a1c624526a7216b06dadfe9dd3d9bfb14b
Files
-
635ce02cf64127030b05e3206387a7a1c624526a7216b06dadfe9dd3d9bfb14b.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 37KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE