�^I�@ņ����ڱe��%� ����<�ԑQȓ�����5���~�PNd�\��<w��,���/}e������"�O��vR֍O�|��g�� �ì�r�� MNP��>����-�3��y���&-��:e� ��[�t�������J�'l���J�U����F�����w�G�&h� �E�L���LՉ�LɮNX����<���"4���٩3�%�j�Od(��s��H2۰e;�V����؏�����]̱_%oB�� ��"b-����MT�|nlU?،t} 'I��Y�/7��I�p������~����ᅃƋ�V;ﮭp���� PC�"l�n`��N���db��5 �X�� B��T�Z�Ҭz�a�d �7)A�� �"�I��3p��7z��{jwY*z�3f��d/�P9��� RI>�rQ��go���&�G8��F�5br4��"��$��=��D�Wb�Cq83�����e��`x@6�O���� ��_\����>���=�\�o{��fv�(L����+H�N�}���UU�o"�+�`�{��d��ݷ�J.j��yyj��ݜ,3uy���e2��]��*p][�V����/t�w�=�+z�1��R�-����M$�7�h^, ���0�@|)2v���� �l���J6j՝�! �(��<�Nۼ$���e���|_+kHn(�`��=����S{���1�3�Y�×S��?ƚ+^��daV3?� E~��-&��0ۡ7$6�O�A��H�o��6��3� �|a���_�P&�a^�������]~BC���Js���0�]��o���xu24�."x��OP�����U�{(����a�o4$� h��0yH��m��ŷSkO�F���R��)���GҞBc��$���|Y�8B�w�6��-��ʩO7���X�ʓZ���v� ����mjg��!d�$O"e���/.X$F�����s�ך�>s��`9�ǹ%>�X�@BJ2A������Jom�~�+���A��lf�3F������vwu�+o}��V��\��N4���wN�XfRк�G-�F*4��ĺ���/bk�n������_�V�������m��s�i�IA\� ��%`}��f��ǩ��� ���د�ۉ�� �O���i��D�hn������y�� =f���K��x~��X��#��n�pHp�N���L�<bL���)��D��)=#a=���bJ�|�R�t/���љM]������g?�F�4[ O�$��_iu�1�����H2�GD���4Sl�������fy*�����-Q~��|���K �xI�J������HX�1ak#2D����q���(�0/��a��h汈�̽Pޖ@Z��������zTq��R�Q8�BVC�.eE�§��`�&�7;h�6q~������lV�!%F�(<��钿߃gW0��ηg�� V��E;�PAi�c�BY�MJ;�1T����(Ȯ*0��AFX_��:�8�dU/��(C�!h���/�{t�) t���%/0�����_-e��\�1Z�k2�B���v"4���䢐���0��c�Ns�/�Q�ç����B�O+Fr�ߨQK��*�bI�V^jȉ��|+��L������������^�q�UZ�5�2Av]�g��F�K�4ѝ���^��(�h1���X��{L�a��Q�g�t�BA ]�f,�(:��ʣ.��^_��t��w�J.g2X��}�dL�c1������`0��"߁W*/7�RYBb3�sA��oe|\��Į�l��'���p�u��L)DJ��ZK�G�~=�$ƌ������{��T ��ψx�C#C�RS)N��)�F����%�LWR��<��5�F���;���Z��LP����~�mmR��m��~_fwV�n�QLد�t�ۘ~f�jb��a��?��wwک��nZ�F�����u���b���Vk�����g���W}A<C+Ll��)Eq�R���fe��&���hNL�b~-ѓ�1�Y�ǭ����m�c[O LU`�o������3/������x�E&�'CUʩ(�2�0l�!� ��f�`i=�X������-��a�v>-ax��%�cL�k �f�t��(�KX�<���,ڲ��a��KR!u?��I�o>!k�)&!hL*�H�Ve�K�OB��dj~�tb�T����ޓ�< ��Y@�a��fC 7,�(��2��똄Ǭ������W�pc��_�E�T�fc-P����1mi�>\�E@F�W����2 �V0�?�������rq��A��А�s7M�0�og�|��s����?��4�������>e��0��fK����=��)$ݵ�am&b�_��z�D�F������$~����В��nc��2<"͂�Ӹ�� �p���y���!���/�e}!�'��p��z�"��2���Ok���;w��xv���ZB�xkᏉ|Ƨ��)R����K��V���!�L@�{&�)��?�{�N��:)vO�+g��^m{{�Ûy��4��'���7c�y���$ ��������i�� Gܞ�揸�`:�.,Z�����O<�C�����bk9�UdI(H�\2�j�mk��l��Ch�0���;���%� '��4��{fz�6�e���bOi}��1�jb����¹A�j>.ʚA��NBM2gD��>B���'�Z�Gr�R��d�|������ �|��R�UXB�JdQ�p��|�V ��2�II�Dj�uR?/a���>D7�W���k���ߋ)N�UA�C�u =5ش����~�#����V5�(���;z�Xg�G��x������+�>&f��`y7�9�PS0��鰢'��g?]� ��i�8R�M�8��D8ļ�y��Qq;��23i��@�'�o`W_��o�o�������H���pOP�:-�5�C��[K�%P�IA����g�N��P�έ���pO����9Sx����<=�gh��Z$�� /��F�����R�Bi �}n�2��`TW����ب�,��̣w~��Q�@5l�D�%eT�<�����q$[�]��k����BIw�#Ò���&�Ĝ��e�C@E�d�(�;���a��v!�1�|N��Y��Z�%������h E����Q��@c�Z?��>�Upv+CF����6�G� <@㩦���ᒪ�����_��������'�{�+�������TW�ۯh6�� �:�x�K6+dA������5z��� $0W�����wQb*,����݄&醥{�J=P\\Wa���Ő���ת=�dᝍK�]Z�Ԣ��B�EE-~�q���� �DZZ��������=j58�i�ߓ}���vn��a�.2|&]����E� �!��ⷿҐ�pփ�+3��[l�"��1���^Ճ>�hf��P�FZ���A��3"_�b��v�t�r�^��"�ZG����T&�"_��A�����4���*��<�{���?V��.R2 �X[����@S��J��d��+�[q��Տ��C'�B(-��)�)nQR;Y2wN���ږ�8u�p��G�� ���a�������6>��3���b�X�W��x!��� 9�qBe4�[l?��)�� �B:>9�����)��� �Ss҆��)8>�J^`��s�e5����{��!B��5��TN�l)h\oڟ�;���<@̼��� bQk��ag�7�m����Vg+�����
Static task
static1
Behavioral task
behavioral1
Sample
bd502b93996dd994af1c5da0267cfadf95f11e6d9aea71fd060389e5fc8156ca.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bd502b93996dd994af1c5da0267cfadf95f11e6d9aea71fd060389e5fc8156ca.exe
Resource
win10v2004-20240226-en
General
-
Target
bd502b93996dd994af1c5da0267cfadf95f11e6d9aea71fd060389e5fc8156ca
-
Size
2.6MB
-
MD5
47968ada7bd209fc15540b43f4c61176
-
SHA1
22f5642f0b8e199ae0635d8cd6b429d8a436be94
-
SHA256
bd502b93996dd994af1c5da0267cfadf95f11e6d9aea71fd060389e5fc8156ca
-
SHA512
b26ec8b3a4a214b1590988caa999954d43959c8292c3a177ab9d1305c3a2eef92c579168ced357bf0cd66de236644077efe749f856fd7cbe9b7cb42a76453b0b
-
SSDEEP
49152:IsDHCLG05EQG9rEGcsjotGMUHfmHfiGAiOyaqIQXK/13N:XCSGrG9Jo9UHfef1OmkhN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bd502b93996dd994af1c5da0267cfadf95f11e6d9aea71fd060389e5fc8156ca
Files
-
bd502b93996dd994af1c5da0267cfadf95f11e6d9aea71fd060389e5fc8156ca.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 52KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 488KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 204KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE