=ɥ��m9� 0��g?�^����Yi�V����A}v�{H��2(�]�*�a�!Y�g��&�@Ky�{�ԙ,:5�$�9��`�<�c�q�������4L<c8<*�LCP����)���;������o2�L�s�Ȳ�>�to紉�i��-� 4��X����<͝��σy�|�/����m=����s=��*�ĎD���}ט륖"�F��v����Kc�@a*gx�y��u�/�Z#��c�hڃζ�6�%C� ʍ�QVk��r��%q�g��>&���ͩ�˥�P�g��g 3T�Qfk��q�z�ɝ#�����}�Z����}�tR'�����IX�,+6���ԗ�4��@%�t���7�n!����{ ) ���<��FYV����{�U�K^���[S��o�{*�xt���д��nf@b���tM�=N�3a�(�ߛ蕶T�Y�kƻ�t�HZ7�{��t͖_���9&�S~�h��H� �� -��[��XV髮����r0��=#��ڧI� �~��-s�9=��;��o��i�]X^8'E�>z�'�{iXK�����K\-b��@���#BV�j�-V�k��q����?,YU�NJ� �]�(SRaZ�U�w�æ��+���2�nC�i?f��I��ߜS��@�: ԗ�九i�qA�݉�d��\�����u��̹0�D�VbK���$���� �<eA#�)J��P���*&W�9� ����Ys��$��`�P�����}��S���!�<^l�^ VY��f�>>��&V�&� m�Z����k�(p��7L)Q0�O�?`x���B\Sx���h=KaU�+ � nȾ��M%1,�����ԷnH����V����(��e��P,v��s�ke|K�LȾX>�·W�7�7���������v�5��~}CI{��%�^�Ӧ9Gq���"c���-�^m��zö �, �a=ض�!Zp���qSB�����ZU�+��@����d�] ���(}*�CeW�w��J���>j����9_�A��B?�2�'�Fu+ף��D~�������(%3k�#�r���j ��{J-אUb7�+���Q�5��:y�y�����w�A ��%q����g�B`!=��0/I�+D��fӐ3���������=6��D8`pӽ�>c5d���k½w�mC�'OrY>9B������WfM���0C��8DIhC|{�oqm�Ϣ¯fI?P��iƥ���*������{q*��� ����Ԣoy���vEր���jZ�Q�D����A�$�y�m��>�Z�+z-�cqC5b*l�*S��ю�[(6�X��3�6#��yu��zi�$/�?1$B�hҡ������.{��GZ .�/!՟���`�Mߎ${{E�h!��dC���+�Jہ8��W�����ln��>�;�~�����=�ETm�>�Or ��BฐR��,��fs�X}i�_V]��^�i�(�>���IJ�:#+$gQ��<>��v�n��uڤtSF�xĊǮ���g5��%�#;�C&��^���j�-���^$�9�1�b�M�R���Nu�*����?g��RB"l��^���EXG[�dp��1~�$���?�zq�Zr'.�dB*9e����;�T���R8����]a�f� 4�6�<���v�M�W��Ȕ���ݨX+�o��稹Л��`a��[�,|g���y*<VlTNRRÁ�Bq�����L;J1��t/�9�duvq,�zZ٭��$����Y��W���t�Yc8T��m�g�p�B.��?ڿL��y��eIX�[㎮ѷ��2����B��c��5�@�b^�fwU�*N�� �J岆OhM,z��[e�0�v�p ��Fm�G[�{�5�F�W ��[�O7��1���h�=I#^'Y�I��?��!���F�%��WO��M�p���Di.�䛵[)�� �S��W�CxgD'1�V=��n*w�v"���ٗ�z -�����.��^�R�%`�:�1Dc�8����uRF��E�#��j��8��VP}�&�U��\�/�#gdF���MJ�44�p� ��_�f�v#K��z����d֒�5���tHEm��~���i�';3?���ƻ�,a��h�'����5s}\�)L�����M(��2m^T��]���}�����\AS�;��%��z['5�Z�<���X�ZP��O��7����N�G�x�4�`��B+�;ѫ�As��}��8K��Ԟ�)�V��`�'��:�Q2m9��y��fɧ.�X»�Ѯ�J�%R�\v������"`H��TX5 eb��С4�; A�YdF0�6k[?${�x{1�@W��W)&��m9�Wo�gU�u�c�*�&�F�Ě�A���kLsI���^�v����6���c_p&�ۂ�����^mm�A��p��-��A��"2Bn��<��T��������]�b�� ,����$�8Ȑ:A&5�>��疎 2>,�M�����u\��<�=iYc`�=�5�5*Q�:9:�?=���p�n�����|a=�po��oc�4Y')��V2%T��/׀��� T���e�6�t��>����<m�D��%v1��P��'�U�����%�?[(���o�k�K���gv����,�!��Q�A���c��4��yڴ��s� ��>�vS� ��䕛u��w���w����)�$?XE���6��y�g��V��hB�^.z���T0��ha���)}6�s�<�2d��5�t||g�j�x������'���u��i��eJ�ao�7��_b#�T�˅��Z(�~��$5!od(|�ZK��SȻi]���^��t��r�r�*CN������� �e�b�h��#26���d4tLI���[.���CU��f�?�T����P�R��F�b�Ԃ�ziS%#0P[�� -y������jE�CD��J~g��v�*gQ�����dQ���d���Y���&֞ϭ���.��SPt:��X���)� �������Kw��T���;|�����vĄ�W{��ٺA 6��W�ʊ>��,���U�ч�M������K��-V�@8�w���I;>�7b���3Էgp���~����F�n�фZ.p��=j=h��&Xe�j���گ�g��Y,�.f���b�+&| /�W<��i�Ƒ�z�pdލ �[ñ)����q?]��S-�rrfRǚd���M���V\iM's0dQ�S&��'����MՋ�����Z ���V7�_�y5��,��y��i����9>$(G��H��F?��y��c������>U@��������!�5�.�K5� �H���r��z�h(�/��������j��B��5/�)��D4W���,laܠ�`���0��:*gb����B*A���]j��_���a�@�l�h���.נ�(���\�K�m� � I����䍸�"��q�M��|��Tx ]Z�y_�D�Tڮ�__Fd���:��WK%����~���s��s��:��`����*5Q��/�%idƑy��ǐMqEт�j~X�-�n�6������mڱ�
Static task
static1
Behavioral task
behavioral1
Sample
ed34e473822c14632cf71d683f0ecf732b8b831d9953e23b955d3c1c0c9e34f4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ed34e473822c14632cf71d683f0ecf732b8b831d9953e23b955d3c1c0c9e34f4.exe
Resource
win10v2004-20240226-en
General
-
Target
ed34e473822c14632cf71d683f0ecf732b8b831d9953e23b955d3c1c0c9e34f4
-
Size
2.6MB
-
MD5
bb9197f96c616226190718024949d584
-
SHA1
8881eda5c885178a02ca694c1df5175c95591f8c
-
SHA256
ed34e473822c14632cf71d683f0ecf732b8b831d9953e23b955d3c1c0c9e34f4
-
SHA512
f06f6ecddd6ca45ae692e52fe2e861a7c3d4877684fb76a7e62808b36f9dbec2baae7f618559ae685e5f9dd467f45735e1ffd9cb43706f8b5b7c8a50068bed12
-
SSDEEP
49152:lLOZ3kt4nNbnR/K+hKXUN2oJZegaCR6aQ38oaLtn250tN9ceOPldtcQ:lJKn1nJhk2DeIQM725ZdtcQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ed34e473822c14632cf71d683f0ecf732b8b831d9953e23b955d3c1c0c9e34f4
Files
-
ed34e473822c14632cf71d683f0ecf732b8b831d9953e23b955d3c1c0c9e34f4.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 185KB - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 23KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE