� �H���* 9��$I8��ɘ({�4�-5�F�����x`E��4��kb8X��%8��`�j��F��z�r�}�7�ni�������3!fWx�8���٣���?J�.����z},�9�%�� E��eB��Vi�̨l��NÚ��HV+�=4d��]��cc�R�M��c�&;�7"�����w�����y���rD1�(w���@�:S���b��Y��qiBB� �A`���:dg4��a�}�G�1��9 �m��(�&`���h�� ����)L�nj��^@kr�R��zJ0M qA���{����YE]�~e�7��'�#�`_���*4K�Hr��*z�#&@š�\�D�):�Ѿ��0l�Z[zQ!�WQ��������=�#:�u�#����`_"-�J�:'�FS�×���ď�n����1�pÌ'S���� k"f�uV��fy��R:���@W�����K�q�څIV���,r��� �aa-h��)����e��,�����g��$��G�m_PNu x-�>�Ha����r̈ȵ��L�L������h�Q��P�}�k'���2]��j@��w���F�9�pR}$J�� T¿�q��,��j�k�:'�9�#\S�U)Gs��p���� �#z�o x�/9ڹ����Ji�����0^؞Ms|>�^��h͈�"��~�������G��T�%�y�4�LMu�EO��מ^]f�Bp*F ��+q�uI��B��ć}A����� �1*�s<Ƈ��a�����V�2������t�0Rc��F�M|�w�I��T�ʡ�C-P��|9���|1CPV�QK�����r����]�8\ �D��1����K�:�����/�7�G��_t�4�H��*��r��[K5�L���� ���mؕܝ�� KPgֶS�c�V�UQ4�&��A��C'�$��x8�MQ���M3�������%��k⪊����Z����x�;���3�X��p��o�t���Z��������e�MB��a��AF 8�a�)B��edU7uo���vE|�E�b�+��/5�d�{��+&�gC]�/a�#�'0PT��<F���^�|����~v]혃�y4&���R"��hx�)�B0(�xY2�s�����O����6�R�V��T�9<��{#� ��v?�X�w�W�,��]7���ퟧ(�lz�r� ]����Ad��; �U�_�(�ZY��9˓hzȹ�{��BY�zf,���ӧ��mܙg�Վ`��;���r��)�i��Ʈ���QL�p���7����{���e9`$C76�Y�?A$��`����V��cƽ43��{��5�����4��F,�}��e�l��.������JOJ��5Li���\�$�-��p����Nܑ�Ouù`����|����� ~��QP���4Zl��W��gb�o<6����N��9ޗ�6�@�:�Z;�B���R9�"��jRG�>�[�p����g��'C�Z��؇��-c"�#��0|`�U���[�G�a���/s��㰨��pA"��M��ѯ���fp�X�o��������h�����8V�&���OOo}��~���8N`㵣�Q��:l���Zs��χ'cZ�������F�w���#�B�X�(*4�M՝�g(�� ���Z[�F/~��7��� ��38[%6���g�~Bq�.�,�r�}Aߕ��'&~aĽق����!B���-��|��6�F�k�/pK_wY��_e����pjMp��f���?�W�j3��k�����j�f]@l�W��S��a��0t�eBS�q���w���I�6�qx��·a���؇V�`(�<"�.��͜@@h��F�7��m�g������bΡ����y���E��K�A���p�����}7\[~����fq|/R4c��qED���j�4bTG+��"=/��>��5{�o�M��*���饍m{�aBāx��Q����g'�*]���fFx��OK7'(��V��خo�"i�ޟ�:��p�U������9v��֓���ҿ�vu�6v�*��,0������d�:��h����%�ey���5�u�̴@Y��%Cy����g=U�o��+�y3�8w�m���z;�����{��������z��w^q:�h���vŨCt6v�N�]#��٤���op����1t� �t�{���2 o6tv����@(m���+*�a�]�t-I�{Uq :uf�r�m)���^n�#/A+�`�qL:t�Y"��e��Pp0Wg�c�5vnC��4,<ɀ�p��g�WcI ��%�u}:Y4��Tl&� <��=�0IԄ*��7�&�e��n��e��T���F6���*�Z˞0>��\U�����!TNª�&^��F���R���X?�K��>� d�="Y�ӣ�UC�3}�e��>�t������J�nؽ��w��㓋咟]��=��< ��m��s�g��lWR�ɝMę��"S����qԸU=�@%e&~W� ��o.zv�=��.$6�_4ӷ'��̌���_�T���Ik��M���舉��.4D��评G;*R�^z��F�G�j�<vu �߷gҽ��5�J�͖as�*��5��Q�f�u�^R��U�����-q^9�0��}l���A3���cl+��^��2R�/��� lԺg�ytd� ��av������� �e�9&Ї��vzv�U7������p����}�~?@�xO�%+X���N�[=*H]�����e�|����1�=;l5��6�V$��$D�2��J�H��8gi�gd�5���IvDMj�i{�=�V�Y^Y�7��G��9W.����~ݔ����v��E����\�3,�zs���)}[�����2j�i��ۭ�I�>:n�K�9���&��;nq�8iwJpӥ�'���\���=bc����3]F�.��iho�]�'�ιel� "`Kr��s���rl'����@�ܦ* �*/@>5�������А�kk�o�����9�.�qA�4��=6��>n��ߗ����MZ�Z~�ۄ��R�5�U����p�l@j�'T3�y��c�v��N�%�*C(o���/J;�ܘ9� U]8_A��Y����� ����f�N�"�J�7��T� ~�`�Y)�I�4�|Qc�XI��0����0 bK��(�}��N��YY �EBa���y���*<� 0�%(����� Q�^�97N��1mEpS��%�������ni��̎a<mO�g�����~_����6V8MGZ��h����ݥ6��@lak���#~��#e��5r�O��A� }A�/:{\��MG"����9�����=�R3����|��� U�!�F�lڲ�\��s�)'^#gA�5���/Sz���i��.|�Ud��$Y�w籾~��n9��{TGr`���qf�u)���0����۵�O];9��p8�w �ؘ����v�4C��?��'���m�j�וTs�5�l� :���s���q��le�5+&�ˇP{��������o���S(�+B��U��(ga�aV�]��ʻ_���Y����[x"^ �[ �5�g��R�,%���\��6�c�!�M=]�;���7���G��bt9)t������d��^о[V/ZS]��;��� �L=~�d��O�7~��9z_�9�7�-)���j��=����,���
Static task
static1
Behavioral task
behavioral1
Sample
c486c02faf15e3da9e9ffd8f61bca345b5ee5f1084c1236ef9529ae01ac72e7c.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c486c02faf15e3da9e9ffd8f61bca345b5ee5f1084c1236ef9529ae01ac72e7c.exe
Resource
win10v2004-20231215-en
General
-
Target
c486c02faf15e3da9e9ffd8f61bca345b5ee5f1084c1236ef9529ae01ac72e7c
-
Size
5.7MB
-
MD5
056cdb69e8d814170c27aeb798238d0d
-
SHA1
e256d1cb3b9136a9e45396645f90ba51b2b5b7d2
-
SHA256
c486c02faf15e3da9e9ffd8f61bca345b5ee5f1084c1236ef9529ae01ac72e7c
-
SHA512
80299511abe8ca16cc0f28fde80cb1e9373c3da57115a1a9ab2955709637493c91195060f61ea16fbf810c6d01684400da0e690abea125aa35947202dd3aa972
-
SSDEEP
98304:6O0zIWmizceVOcKf+TDteeYoMO2ho6a+1tZ2ZKUoquXgutN2ppkKl+gtZYOc7WUl:YXmiY0FKf+TMTXO2hZ1OZKDzXgutN2vy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c486c02faf15e3da9e9ffd8f61bca345b5ee5f1084c1236ef9529ae01ac72e7c
Files
-
c486c02faf15e3da9e9ffd8f61bca345b5ee5f1084c1236ef9529ae01ac72e7c.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 79KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 19.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE