Zݦ��Ea���L�k�4�(�Ԉ�'oE�<i�ow9 �����h��鷁&s>��*�ȶ��xbr/gn��IH�j��!�fh������>k��+��������Jb�f������`��Y����1���5a��j[�\��"�C02j�HG-y���K!=��u�/� ��U[��"J����j���#T���?D�[�W��m� ���R�~��9��I�O���9���O�=� �Q^�4����/���T9Y�Z4��� Yɵ� 3al��?��˕�k������x9D(*1�^̱b��xJ����~�c�WH����1R�T������|�2U2*U��p�T�6���}�� V����.��� ��Ūr� h�툼t���ӹ��5Q�6�E���Ǡ!.�m�͊`S88�"��jQe��<PC�p\C���׃�B6��ƅ���]�����T�M�6� ����C��Z�E�bG�.�,Z 9�&�Z�?�ʹ���?����[3��M��� /�|�s�����JT�a��;mO R�D_5]B��M���x��i�w^���b� �a�ʷ��֡l��ꢶ�:���ƅ�d�� �����/��n6}��ٞ�a�q�Ԛ�� �ze�0C �l~�6�C/g`-{�=~�iH�z�XP�,�<О�w����$�0P���iu�x�Z�F�S� 2'�%)�5�W��^i�Y� ��$���T��k��|��95�ۏL�_^�i���wbb/fd>�ք���,�\��fVgx��@~��N��%̑����!i(,�.3U'��:JE�Υ�Sɾ�e �PQY��;�5�����iG0[ �5�+lߪ{M٪l��f�_Qa�A�f��0h��b�Jp�G���Z-�K�0�G���%H؇ܗTR2�#�M_���#G�h�"(-���>��Ğ�P�k����xcc� O�ޖ~�vC ��d���v��yaaN�E�8�H��G!Cx�����3����u���%�I]���R@r�ը�� :����.��G3����e�pBW?gHl�ȞA$AU$�CN�J.cDV��@�l'�z�-Ci�ѭf::����7Fj�����4�9�ƔT��ͪ��,��}R�%�P�������Ó�_q��y�ke]� ���Ňi_Q��!�U���3v�����<����f���љ��b� �/�[wA�X�ؠH8�Dz 4b����p��fѾRڭ`�e�'��duf����u�1�c$�pJ(a�fC�� ���)�����FO�̋��!)���)��n��I��証�i���,�bKR�� �Vbd~���6�w�H@��r>���:7���i��u�#�9�����F���z�?�� U(�A Ѯ[�sȆ9�2��O�D���YԐ��肤H�:�"�pt(��3_4�c����Ey��9k��6��W���b�&RS�*�҂��sy�qa�b�:?`q���!��T�-k���0tKwi�W܃ƞ����h���X��_0ZE�$v_����U���R��u�\8�Kȥ���F��>� ie�P�,V27Q�0ѐ&C͢�G ��l;=CR>+��{�&���P���7{S�%��ž��t��>���8���z���)V�pF��]�r[ߣ�H�4%����~�������K4��w�����~L�:߶#g��\��>U܈{u�_����R܍���~V#]h�n��X�Z�����L�PH��פf���뿪�O"[]���� ��m�q�Z#' �'����tMhW�3I8D�����x����PԎZE���T�: �-�Ɲ��$v�h4[���AE<.�B�4fg�kL3�C�@xg������S�J��m�kȳ�2�XLA�}"F��Ʀ�Mrg��rj9�z��F������&�;��L�Ӹ ����A�"*��5+&ԕd�_f����|����CI�DJri�`>�T�U��/O9k ��P���"`��jm�řSn\�W��:��7���>��[*���]���R62�_`Ҵ>�|[�WT x�6?��q�0���͟a�Q�2�� �s<~�C? S��!]y���@Vp��}_�.���ud[ BD)��G�r�@6�=�۾��rr�_C���Pa#���lS���Ǝ�@�{�����[���|�(�ύ�{T���Z �/p�ͦ���Բ���0�M|uﻡ7�ʂ��~���Q)�vT�ô�M>�'v�W�\Ծ4��oh�����8��%�Q(��)ݫ�+��L��(� -�ϢIG�_#h���+����߽b�n�����TG�^�Y�����\�i��]��Y8�x.,8(��dW6���V<�~��c ���te�nT���Ug<�e@����+�Q�=j � �rU��S�cM(����-K-$�d������sǯʦQ0�AC8�'�0�U�}��\���;���e��L���@!xشrd�P��Q42�{��$ճL����V�t��AG�jṞ�c�G��C(�=Z� �'�]�s�ߜ��z�������!٧>��,��r�fD}���HE*���/�l�4�O�����0��2���1�����Wy�P �A��("q�#�v�nHi�ji�� n?NM �m�3���"8�@SB��4��\4�V}��CaѸB�$l��1�$n]_�ؒ>�������e��g8�O%T0�v%�z�<w���*����5),���[`�P/m`[=���������}���9弅_�2��8ԜɃ���n������ɹ�����j�*o�z�u������L�/��Ol���M��d�*��Ml����31���}3"��|;��f�5#@�rO�z����¼�X�V�vCb���6�}Q+7��V�� t7��gr���,���@ESG���j�-��O���D�J��e|�,F�~��'�;�){�ʐ����{�f�>�v���\Rܯ��N�<�K�:�<P �k2uaVd���������{����8�vohL?��1�� 9dz}ډ!@��T�$�"u7���9�.�d_1�d�U;F:�����Z$�[�u���q|���.���i�,Y�b�$��F�w\;�*��&��л^�E(�cN�� �$MJԀ�ɭ!���F�]��>v y� ����*aٻ(�~�^���;h!��>��/��ӆa���o��=�1q�t'�J�m�r�b`�pѻQXʷ��*ƒ��2��+q�3��>2�cW��!��)�r�3��q����$<�6®�_���n_�u�9��N:{�Z��]��מ*,�j¶�;i��w���D~]�EZha?��(�ϻ}g$��ϹM�{*BwP2�h魛��^����`���T��U�=�`G�p�®�^T��Q�W�J"�ɴxWS(H�>�$�4Fܙ��K��8����Fiȇ���#t� Y�u�db�^8�|��$:�%�C�n�?pT/�V�S /�}�>����� 8�#��#�Q�K���`���n�x��P����7���ۦx�=zo�Z�qa���V��E���"�Is��L���6��`+�P�c6>����EF��J�UO��{�G���,7�����\{�.�;��6~;�7 ���{�j/�AD��C��^��shKݝ]qң�F2�'1z|~���5�U.0����!e~��Q��r
Static task
static1
Behavioral task
behavioral1
Sample
bd41f5612dbfb5d286a89f4f98e10aaa3cc00935494440dd3aa773ada353e675.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
bd41f5612dbfb5d286a89f4f98e10aaa3cc00935494440dd3aa773ada353e675.exe
Resource
win10v2004-20240226-en
General
-
Target
bd41f5612dbfb5d286a89f4f98e10aaa3cc00935494440dd3aa773ada353e675
-
Size
2.8MB
-
MD5
3f8601bc9e641e724b0838bade5e086d
-
SHA1
799f1202f24db4f2cb205e534857bae077a53ce9
-
SHA256
bd41f5612dbfb5d286a89f4f98e10aaa3cc00935494440dd3aa773ada353e675
-
SHA512
1c4c60e15bce5156f08404bd13ededec0407893005e27cf11fe9fed480efb52eb287534121718ce49db20cfa193971967eb611105c99f48cfebe5f4020eb9686
-
SSDEEP
49152:dNvToudpyvoTpJ8JL7+3xvX8tvjGwCLZgSpKwXKIL+vCLreLT8hyBg0NscsF+Mtg:dBVL2oTpI+x8JQLZTl4vqCf6yB187411
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bd41f5612dbfb5d286a89f4f98e10aaa3cc00935494440dd3aa773ada353e675
Files
-
bd41f5612dbfb5d286a89f4f98e10aaa3cc00935494440dd3aa773ada353e675.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 473KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE