Bt��I*I�;���[խ�#k�~��J@�}��4����?�@q������j�P`�<w�a�9u�s5�0�Ԩ���8=л�d2�p�it���yX˅�qG/�U��_�v��F[�����q� {I�I{�����jT�zv-`���V��N���zɞ����S51��om��V_���������zj(dJ�p�.�itg<��"8�6'&�(�Ok�L{��6��Sd�0�{-�i����v����r�v"d��v)"K�8F9@<��m���U$�9����1�>zʂ{k�4���jkUd��Z�aBE>�_��s��ˆԮ+�*l�}m�b[ �����д`t_���ub�%{��_��O��xp�A���Tv\@ �N Y��_9��P�!��ʅo��Ly���اH����&��z���cҚ=�9��Y�O�� g� �Z�w�L�]g�j\������d!;��9��2��lE���8����OJGG�)4�+�|@���2<�`Tnpj������8�BXT*g*��L�|�M1�i��>�{���3������������F�����#�~��|�vZq����)���QT�o!,��#�Z1�k�r>Lw����mx�1��PI�h�D���$��{�]�o&t[b/,���p]��m���ćf!G��X����J�V����o��͏�Z���a8�̆�]Ft0E�i5t!�WP �9�rbI�ll��N4�{��� ���i�O�B���%a�m����J�&>w'��8�r�C��-��jmC<���5��Ǵ��v���Z-5��ŕ�@�ȡ��,��OM4H�;;�%l���@~~5�@%mi�OE~���]q}v��R�ߣ���M�� ����e5H)M\o,u�o``��U�{V�;��m�8�d��,(ʬ5��ܐg��8��"��Ĩ���j����d���hȃ�7qL�X}i9K0�O�nR��2e.�+ۇs�⦪]i��L����]Q�5��+JE��Փ�R��C�ڳW��3���p�}Lq��:jA�C�wO ��(�&:hԷ��n��4���؉7�v�m�avsA���?wtr��(�b��ad^�<e��厲��V�(e��n+�����1��M�ohG��]��X�m�����ʦ}�_i��G��� �q�qJN�}�-��e�P�A<���%�u,Gr����BـAV��Ւ!�ƒh���?��H����f����`"d�b�|���X�m��{�=2� l�c�l���/��Қv0me� k�K�MzU�<~�W8*0�@U��-K�.8˿,�����%���_zr��q��� 4��}/V=d�Β9d�ӓ�7�+��~��l�o��{�s'����^�6��S����b?fW3��d����� �4���2��3��Y6��t(7����;>�� ,��zC�7(�x�q3��<���r.���v��U��6S�A�j�n�t���I��W�bHK\��(`p�2���]LsG��m/m\C�����a��7a����jz*�ls��%;�~�@U�TC��D�}�����ܱ�ׁ;G- ��5��0̪ �%^�������S'h�鸖a?�L��r�fl)m1�^�j�9�z7���>�,p%LL2W��Lx�'��u�zn � n6���� ���D� ��tY�P��0Y���T�s�V��6<��O�w<T����e���L�3Q�;�[D���e�W:����,o ��Y����}!�oӴ�`ˊGP�aB�X5��y���-n�xL=�h��9�1Z�1s_�Cl�3����i���ZP��h�������@�Ŋ��8Ѷț����8)o��OEߨ�]��r���9Pg�>n8YTXBy@�kq�A�Ţ/��n����O�N�Ɯ��ĵJ�D��!ȼG[�e_�Y��k�Ë�S~yD�� P #��v��G�pe�� �JV82�Pz�����6���a��e���bK*\A��PEo&{��I�e�=%$����?����O�?���� �@g8A�& ���g���_o�U!h몔�c�b�{8�<2@�8�?���V��5�����Lt;{���HA^a������MK�4 "��qO��`��N����X��1��E��*�jQ�Y�� �4y��R�����菣j���"3Ŏ��Ӵ���\Q6�j���"�^$��9������f�r�%��,Svm�yq,>�ƃ/I�8Α"�cϠ�jo���Y�t��0,��B����Yi��;����x�ƙ�7�Z�u�험�ͥ�A�qԊ֔w�yl�Z�_�V箓(��Րp�]2��v��� v��{��ɫz�V+.�"A���ϴ�J)���eQ���lRbL�Q����e�~_����<YóElZ�{B��%P ����s��/l�R�@~���cN�e30G&�'X���(���{u��5h���g.A�^��T��I�I��x#Q��o�߅�fc�Rm�m%/�]�_�v��z?���[�b���$�;V?L���_Ӏ�W��Mɝ�l֮�O�LK�Ne����s�7����e������� �S������]<̿�#���E��z�YdBp�R}�8�s�4F�&SO ^����C���Z/�.� �[O�o��8Vo�� � �� �N|�s�TB Zp���d�VL"�35%�ȼ3n����)ډ��ډ??$ 0}7�ix�py��gx��D����h��*��m9�k�;6H���� ��(��QC��4���R$K��6��gYT����F �MTCC2�F��Ժ��NA� �ϋ�t��+>琴� �^ɈI�$ ��D��1f,�׀hcJ�����^?�^��ՕO�<la��+B#�}�A)n�^�teؕ���E�6�0tv��a����T�v����g�erL��1X ��5n�[%�[w 9mqef�����]����'$_�y,Fp�p�T��{=ʤp&�`�`0.,�+b�� �K��>�� C=g�5(s�e�n�iG8�6��頇QJJ=��D�Im���8=*Q�;�j�#ڵH��榸�.�H^��Q���������j����¯U�� 7c���5E�A}�Пݿ�d���i 7���E>�����,΄���Qd�2��0�1H��n�h���Ֆ�8ǝ6�mg�N�=�o�ѕ>��U��&?��w;�Hew��!:��$n�����_~2 焪�.��E��T�����y{Xq���=��"���^(�~��`�R�v&H�ѳ�6҅Z�����[J �P����G��T]��~=�t�DQ�k���cxR;��ݻVK(���٫�_�$�0��qrٌYR{G �?2����U��f��a�T`nR����NN�[%�, ��@0��b ����S�1A܊������%l"��=�h�[�8ı������|jӳY>L���5Ԯ�4��dҹ���s:��E[�ͧm���e��c���R��l��P��Eq]�Ns��Q��2� �} ��&��5�������.x/�������!�h��;pN��H��\q��l��"��h����m]�{��u)B'>='�Շ4�С���1Z�U)�<���g�kj ���eP^*��u �39�8T�|=J�r��"���v3O��&X}��u^~0`�v�8 ��?��7V��YQ���v�놟�n���E�/0���
Static task
static1
Behavioral task
behavioral1
Sample
60c709c0b7d9e8be08e40235b2946df83a3483b75e52fd2fd16257c2518fe8d8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
60c709c0b7d9e8be08e40235b2946df83a3483b75e52fd2fd16257c2518fe8d8.exe
Resource
win10v2004-20240226-en
General
-
Target
60c709c0b7d9e8be08e40235b2946df83a3483b75e52fd2fd16257c2518fe8d8
-
Size
2.4MB
-
MD5
27f1737e83cd873dc41c74f4ee39137b
-
SHA1
e1001ff2eb4c0b791f8393d34acdff94a326ad0b
-
SHA256
60c709c0b7d9e8be08e40235b2946df83a3483b75e52fd2fd16257c2518fe8d8
-
SHA512
add7ba9285458ea8b4d49aba8f7991a2775874e90ac6a5cac750de352c7247caee683133b440f4ba5be39e69a50021e7f9ac61e91c9b698e536dbc591b054831
-
SSDEEP
49152:OYGztfoS2PIG4EMe6bj8tDLWBWHNTz1usJ+9auxgluej:RGKIG4EU5+rjJaa4glu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 60c709c0b7d9e8be08e40235b2946df83a3483b75e52fd2fd16257c2518fe8d8
Files
-
60c709c0b7d9e8be08e40235b2946df83a3483b75e52fd2fd16257c2518fe8d8.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 13KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 18KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE