���d�b��V�e��θ/ß����`TB9�˼�=����ϥ���e*���G$C�b��#[�ҰL�gf� =��NpW�]O��rxF���m���D�R�{�m�L75�Ѣa{Kq�`���DX���9�}@�L��+6����� �L���pf-�����t�r%P�V9� ���R��̺�� 8pt�z���~�c�[f����k���c5Copov&S&�cq�������J[�(�٣.R��"ُ �)Dž���ER�=��a�Ko�!zc�E �1������0k����z��ۇzH�e�+U���g4�W��Q�����C6P�� D#��IwA��FK��9�*%3��dMv��/�!Q@ا �w������J��� d��`�#��@�8��=?��E�HF9eM(en Y���,�g�+t��}a/�Og�@uwA�-���jmG�a�f��M�Wj�©k�f�m{o������'�lI���5e�H��,s�p �x�qL�9Q� ��ј�@ ¾G�TΉX��[?�㰇���� &�r�T8���I͠D·��pe����O^�T��r��Q,̙��߀ǰ��]��5z���[s�'���o9�=�4;T �Q�د ��8-6=fM��\�zo�g^2\^�R[o�� �@��j��Ȯ穗4��?س0���ya/�!�ܴ����id��K��ɞ��iU���A���T9����C'DL���������pU<td���eז�����IRDǦ�ɪ�y]��V[��:��n3&�aIݶ6!ID�H:�6�r��"�Gz � H/����b�i-%����dFi����r�z�����}7�;��J:h �����I��g��'Ii�w-4x����.Ї��d�X����l�_'`g䩐����|����}�e���;�u��l��`AZ\�w^V,ũOE^�o�������O|>z]2����5��`��8�N��������4�����B0>�ߺ(I�!�6��Z]�|��BB��w�MD9��i^�Q��S��3\�2�!ͻB �q��4�.�"D�:�kVPw?�3�.ه�}l�sY�˱{���W̌��fs�?��Z=�h� m?%���a�1��;>S���&�m�{�5 ����b�2ϕI元�VE�6f.����-bA���Xv�ƈ ����|���Z�%��2Cv��J�hʶ>���� ��1'�����\F�wg��nCHd�l��f�ȶ^�wG�"t �="~�@�5l�b�*�3FC3��)����ޠ_%+|�;(�SD�m�߯�� O���9{g�Vq#�CEMڙ������(Z��l��SW�J���$T*D� ��\�ǽa��Jw��R�d�ɩ�O�� �R� ���}{�w=?�!!a?�;�%����j�Oh��a`��Fh`�"�긁�/8�??�Q�� ���#������� �#�����[|��)�(�נԟN����7�����3a�e�:��̤3��p���C�����\�R�*�}m,[�jP�X����8��Q>q��:�Ik�<3T�8��ZW���ThŗC� �C=~�PX,[ \0~ U=��"�^���,[��WѱPϟ�4�G�Y�8q/ ��/��%p�^��F�SVϢ�0,9#X�v�Ogd�#�H�9R� ���ܤ?����H��Q���!6�V{�;#�n/7��|��B�K�x�9G�~��C����ǖ�U*���j�Qx��R& ��N���>�^i%@d߹� ��To�{";fKm -.7U0���d��-j��[H�X?���<?� -R���>��>fM_�7i��}[���S}�Ɩ�gj�(�--��5�����>.�%C��s��,l �Ѩ� B:˴��.�b ��D$W����P'��������(W�؞.H�5�(��ȱ ��yOt��E��ae^{6��O�-{5�� �X�b=I����Y�"-�ܺ�ڤƷb���t��5����ܝV�����I�T6nr�WZ)\(�ul쥦�&�c ӟ��=��P^��G|&�P3�P�^]_�1��;lß����:�z�×}�����34��¼�b��?� 13cdr�(�RG��b'�Rz}>�(��?V�@8;8����FE��Ĭ�M�5����<cMg���;G߭� v��[v[, �F��^7Ui6?�H���nx%/������]e!د�|�6/�!y3-Z m���"i�?����Qz�*�b��I�p�c��f�`�X��0 ����(^���e����Ӕ��`�4����(oЈ,W/-n)�%=�ɋ���#g�c eEI�`�_>o]��)��RC�P�5(��������SA��h��7�$}����pꋡ�*��D����"�Ë��K�Tc����rjQ�P�n�24� �֭�&��&�@�5(��l�^kb[�>��Q.Z�+1���5օ�EL���^��*"��I.��U�xs�������N�NI�������G�A�<�LٮTy����9���{�����Eݜ�ߢ�c��,��{�zz�����nG��t��ʋ��o4��G���k����y�{��i�9��x8y�* ��i���`YZh����Z".�4+̅l?oɧ%�{{�|���O���� h��n��(�o��Fi�:+BU&�]�#��zGk�v��d�)�uxR P(��I����m{�`�[vH�#%����3��UDA�a�� ���:F�Ebn�' )_Ǥ��ݗ��I�6Fɒ���ꌀ�1�F;�crQM�܉*��ޏ�@b:h)�S�@{A�RRBc�F5���9Jj��S'`B�Z#Q�x%C��U���j��#��CwW���W��ѩ2-UB{�a�o'F$уj)� KZ]�?J�g~-y%���5��!� ��nR��&� )[�͌�.hZ ����.$GIL`8R��B��:�!���2�I��Wx� y�����r �C|)��L�G~�A�������+���w�Z�-d�u ���� ��bM���1c�� (:�OѵZ�\0��a��)�� ������%{]垺�x>;=[_�� �v�A�cW̹u�q���I��6<OߏG��W�Y�+����
Static task
static1
Behavioral task
behavioral1
Sample
03895f09a0506412b70891e678d70ed6af9a8c96215f662f2a0b1c9bfe533c91.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
03895f09a0506412b70891e678d70ed6af9a8c96215f662f2a0b1c9bfe533c91.exe
Resource
win10v2004-20240226-en
General
-
Target
03895f09a0506412b70891e678d70ed6af9a8c96215f662f2a0b1c9bfe533c91
-
Size
785KB
-
MD5
0a55bb30db743277ba74435472449aa7
-
SHA1
c0c04af848e64c6be2e42d150686b8180b6dd24d
-
SHA256
03895f09a0506412b70891e678d70ed6af9a8c96215f662f2a0b1c9bfe533c91
-
SHA512
3cb5f5d165593c9f701b7c0ebc151e428f9b4cf7088b8f45c685282696b4891a7e9801fb00d6e6f8763c3f99d2cad465e98d03dc155eb416b8d0172e3ee84953
-
SSDEEP
24576:zMkcwZChhO7nk8iIR7Y0aCO5W+YUI1jEUN4jO:zMkcmCm7BJO5AZ1lN4jO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03895f09a0506412b70891e678d70ed6af9a8c96215f662f2a0b1c9bfe533c91
Files
-
03895f09a0506412b70891e678d70ed6af9a8c96215f662f2a0b1c9bfe533c91.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 949KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE