�(�����J�$lZ(����DFzL��=x����*)��MphzɒT�'�ա�M�6%�a��5�-X���kx�f&��jy��kM�8�zz����'�H��[��8a�ղ���^Dj�� �Y����U��!��@�T���v�h��z(ӅL��nEq��C�5������}d��M����-g�_�HL�mg���F�\�%h�Չ���K�T��x����4>��ۊ��c�KK�� ����K��vB_H�K��Mk� F�+%\�m[��D���i�cuҽ� �m�P��U�Nj��Ys��r6N�{(Bz���}��CP=��AV��N5��p�ـ����B6��L3nZ���e�穰����!���'ߌ���_�b�5[���ay����3C�~[�$L��Yے�#X�!����'�Zn<J3({W`��V�+��Cԯd�i���tX��0EzC��d���ذ���e4�L��������?,�:bit�y��m�ݙv]���_�����g)e2"Y "��m���km�&Ƒ ğ��k�ˍ�ku/���d��*��H�*3#wGH��~��_� 6(8'�|�x���\���{��2�$*h�b�U؉O�դr���w[��.�}���ȡ{��G���?�������J���n���bC��k�,����M���_����gG%��QV�%��ĔT��hL���R|�zF��-�u௮G���U���X~7ͷ�����r=�&�ݝw�o^-���=a��p���]��ww������[��� PԂ�!M1���P�t���1Zv��5��^5a�A��j�A��?��D��X�!�@�r��j�S�����ɯ̅�(ͬ�5�O&]�C�@%wW�[��D+�.��:��Γ`������ĘNG]4�� �|�59KB�#�/?�I��|@�;��d� b�t[�]?) L̂w�b�GK7�d~5k�V^����e(��P�αw�Y�����^v�|o$��ŶS�c���ɫ����{+�`��hZ9D2�nk�����u!����,�30g̖�c��/�?�;��Oiz�����5��=x]��6ԥ������ZDc����AΪ��9�sR�������n4��,���0A} H���V���� ~�El�xDz�!O���7���r�ړ*U��ܶ���6S���A2��x�Api�eqr��1���5Dt���"%P�!����_b�L�|��K�<���S��ط�L% r衏��fY����эd^@�]���7�A]�z$�Q�E�P��oe�Jԃ�vC��&U��4F;,\�j��x�s���;�j�v�p�#�u�ϧw� ���������,�N{�ʒn_R�7�.{:1�j���lR�k?+����dI�z�X��F�ϔ㤙DXW�N|��e~w�5�'՟�s ���y-&�˿Љ�FHm7�x�{�nՁȀ�t�֍�p^�N�`����)~�V���O�IÙJQ �~�5���A6%B����DY�?�����/���f����3wZ��(�]�����F�r��:�?f?�d�=�ȹ�d�D�R��7���Kv\�T�3M��Q���L�ŏ`D�R���V���+ێ�kL0z�$�Mf��T���ɘg;.��[|�9��i����O�+>��� Gj�8&G�ủ]Dd�T��g m!]<��z�(C�Zb[W��ѩs b1�{�����Z�wzG�!"�5ZQA*���3�����e�Z\a�!��p¹�yP7�����%i@ɬ%��h���j �����N�ʥ����ܾ�����d�U��b��G�����Q�"���o��x�L�T��u�a��-���+eySW3����)@�3�j�R��� �do�Uo"��m@&8�˯W�����S�#���\q+���E�;�8R�4_A�Dq������>+Qv���o�tz��v��=Ye��o�>�6]��:� ����Y��PA��`���%?��a� w&�#\���5!��oXQ�;!�O4m�Ō�*8�u�G\<ʈW��naHu�| 4��t^l����&]'������J<���S�!���������42�~��4����bw����=��/1B"����X����:z�U������z��@���r�7��r���,"����Ȅ�D?z�$a��������I��\���IX���Lfn �I2��b��O�pIό��G�a?��!L��3ȎJ���>s����+r�F�U�+O���A��%��~k�lj�S�G9W�B������R}^K}���ӊ'�9E���l�$S�e{`��\u�&�W�++Sa�f���䲦{gj����=v;K�f�I0��<��Asz-�p�N���n�H�T��U1�ey�!� �����- SD����<S3|�oy&�if�?GI!#<��e�΅���j�����)������a�뫫�/���ty��ՏxG���eW#K\B�V�����9�,���T=�2�o��~�9�M���mu���w���.�)��# Y�x>�Z�AV$Y�jQ9#1�P�:�Hfa:�|�G�_�7^Å#�u�Rͮ������`a,E�<ΟN��6,��Q<��w�`���3�������@��4�S���RyX��C ��y6��>f�~���&1��L�8�����V���^�*�e�E|}�.n�kc �q����j1h#�HF�1*��܊�� �zլ�K�t2����x#����'y&PO��4���V�jBt�9������&NX}I�W�~gl�YxG����EY��-��̷!����̧�k�v�BPW a��Ijic샓�.+��E���/��/L���1��XD"���k��U�Y������ ���^�p�˥�HP�@���{�ޗ&"joS���*g��pC`�;p�:���`�g��)GI2�"�{�B�Q���t:#�3�@�Ao��Ƹ8+�U�E3p�:�>����8S v�T�%-R�[��h CA!=�Gp��ſ)[��l`�~��`K��*��M��g�w�R��?�8�OHbP֨@V`��Ԁ�iC*�+ �q{"�D(S�"|��P��ݳ��'��~�9�ףa��y)�S��F�h����\B���~XF*VP�tWpȐ�F�?NB�.����[����҅��(�56�K�W-I �J�/��<�C�del���"A?0gg���$8�?�=��Z�K%�;%i��}Z��ef"�LB�\U�^;c��ǢGv�X���o�3M~IL�{�l4���0���x������Ǡ���cd�Γʙ��½�]v]�]8Qg[�-�-#34�W�-w�`����WS�ӅzÕ�� b|s[J��DV� B~Z0�<ʍp�f�`mK/_/�լ=�`26��/l��B��+1Tŕ��U~?aa|d�k�[�r������$e���0eC�������}=��}�#)�����LC �� �M�M ��4��!+������kt�y?4u�i�y�O�@��ɗ�d�I�;"Iǘ � �"�jM�K�*N��������_Js�|�g��^��n]ɥ4ڹ�vhB�=3D���onӨ1����VqnČ�~x�y� a���=�����J��,\d(���p�Ԉ&u@��i:`� �ZS4�0:�Q:ľ�̑����i:���痱�����W(+��|?_u��UA�qG����}�Հ�b��:�� ��;��6j�4%������)T�����~��`��~��8��)4)�N:�Z/�t�$՞����K��髰�蒒�zP�w&�,�%r�
Static task
static1
Behavioral task
behavioral1
Sample
4c3853da778e280c8871cd0ddc24f0ffa8f655719d99adde9ff9ad0e84af3e13.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
4c3853da778e280c8871cd0ddc24f0ffa8f655719d99adde9ff9ad0e84af3e13.exe
Resource
win10v2004-20240226-en
General
-
Target
4c3853da778e280c8871cd0ddc24f0ffa8f655719d99adde9ff9ad0e84af3e13
-
Size
2.4MB
-
MD5
8488049f5ba1f94891505ccaeba6ef30
-
SHA1
447380ed702740a5fa0108b44d4413a253275695
-
SHA256
4c3853da778e280c8871cd0ddc24f0ffa8f655719d99adde9ff9ad0e84af3e13
-
SHA512
18325992c0d90ea4929a77bf9449eb4e042a23363fd37157ac9aa5e08f39c7fb4f356f6824ecb397d0b41aafde08db5a3d6292b9ce549666b2079274b2ccc27e
-
SSDEEP
49152:uE31G6KwsNtRNzkV9GUDxk9KOMVhwrRnJVVynqR1BWfNu4wd9dx:pv3CtYE0VhjnqR1ONVwzdx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4c3853da778e280c8871cd0ddc24f0ffa8f655719d99adde9ff9ad0e84af3e13
Files
-
4c3853da778e280c8871cd0ddc24f0ffa8f655719d99adde9ff9ad0e84af3e13.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_BIND
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 28KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 204KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE