ȓX��O�E �������f^��]�JJ)�?��|\��ۭ�����@͵f�Gi�.�$�8M��N���`�W� -ǺS�U��wM8�ے�KEG7��$D(�?|�cךeB���6p�p�D/C.���#���&��t~//�}Q�� �`�Y|�:��2k<��Am�ӧ�s"�CL�����m���l��nQ����w7�q s�L(�f{�����7���z��v��n6C�?����/�B��z'8�TF_�-.гTۛ��i='�f�2Q�'����[l�K>�s��b�p��������������� CJ�C�O��o�g�|O�"]�L=G��.4���FJ��&�"�{�xC�E��`҂q�n�~"�:O�d��?��'Jկ䍎O�\E����Ps|��̝+�<�Ym��%s�*��ޛ�+��7Yd��P��1��ee\L�@9G�F�+eD� �+,�����$g�NP ~k�(������}��5�9�y�B�#Gj1|[l��6a�r���ֽ�ދ�T\AӜ�����OR,&�a�� }�%���V��?SK��83+�j�H���q��O�B�H���9Z�u�!�)���3X����(���1�����7�Pߡ��u\ӱ�)���y�0m��>p,>���G�52�Õ)���Sdb���=�;� t7<�?�ۀ]�8�D��]� 5~����i��?櫎-��5��d��r�Q���Fڏ٬�:ek3�Ghqd��+w�e��_%"/�Y��"xmaUF�6�1��5a����Ї�����Y����ଐK.I�ٷ��fszޭ�g.]���87ߍ�ܨnX��`YR�f��TJ�2���UT ��]I��k��J��R�1;qza���Qk��.�R�>��u �r) 5H�)v֏��+�FI�D�L~�f����Sd�(�����DC���US�X��H�c+�>b!��ņ�W�V��g��Loi�4�d���?� �{�$�O���+u[y�3�hP�I�����Њ�BW���$"�� ��Z T՚2�$��Z�Z��RP���ظZ�y����Js�B5��_�Қ�����*$����0P�d/BԂ�B�ӂfx(��gm�]�"�gʏ��Sp��#|V���d:v�����-�%�C!P����Kp�>9,�\�/��(Q�%���^7�]��w�u�|�r ��':�Ϭ��Tă� &z��xM�<.��G��<�/Sv�`���������hZ ��Q�6JMɎ��)������a@� ��<���Ni�*XD�/�q���ÆUbQ&�Ah"���P�_�u}���0�����$����;�{J���d�<T���Vu�i�ˁ�<Tq��7:������g9�>��1�Ԁ�S�糶ϣ)>}#�sqq�˦&� ��A���g�N)45���6"����n�aV�07t� ���Q�ĴS� 9(���k��_��XH��+��;f��ʇG��`�lɜ�I��N 䀸"��*gv��3�Tnx�e�H�/��Z&nVT��wpn��ۄ�3�u���,mg�?N��Y�f/b���s�p�г�И��Gm�Nn5��Kz�'�� ��,Ј��+��sP�PO����n5���$㳾��$ݹ���3�(2�����C�ϻ6�m�0�k!V\x_�5=_PCA<$|���%�X��-����hi`�9l�N����<~���@���*츢$���e���qX����������{q� A�I� }1E���\VUl�<We�\L�ML9����W�s���Z�QξA�{s��K<ZF�*m���9ٺ�e���ć{���Tfe����������:%� �i������!`�1D���4��3��f�gw��r�Bh���6�0w���Y��Z�"�|g�N�"h=gk�G�����< n���d�Q҄�C����c�]Zz����ٸ�@���\m��&��s ����U��+XF K�#��-��c'0`~���˗�h?������Jo����� �,_����L�s����@X��r�������Z0D�V�R�@�>�R�����!�<�����M/����A "�g�k5��.�x꣡8C�|��-z�(�� �Y�-@����7�D����36 98J=�%VA����Q���������u��KM�$�q� P�+�I�����Q�B��+�|"`�`�OW����~��(��_:�iWu+h� �X�Vh�9ê���l�� �^�P�̶��d�F Ѕ�'�H9��y.�W��C �S�ր���b���P4��%��Ƣ�5T�� �������J�̍s���켛�D� �7��������2NDw|�I |-h$v������5�3;�P�1��إ?D��-�\�5`�]�Qἷ �#������;:��j&�- �R�$z��q�B�{���\��W(f~@�bS�֕üŀe������\������Pդ��?������V�k��[јS�1���e���'�F�hrqB�R���P�����Ȭ�OP���r�bi��c�pq��������$)&e��?�bl���ց��[�;Y�tU�����C�����Gɲ���p���떡����T���'���+�!G=�h�����o~Oզ؎�df��W<K�����Ǫ']�12l(�S?�C�x�� H���9��f4l�~ytq���E�].%�֛0������o�hM%��r����O R�)9�LƦ�.�)3�up��Ⱦ=�v� �T��O�<q]釗k;�1e�������'�e���������gNG�Sb�� ì���uI�W��Y^hVQ�����H^�'�<��������hB� u�m�1�7{,J�F���-�.��:�����ȑ��C��*�6������U�TZ��FD����n����Q�n���e��"��G�״E��|��r���U��$]F����t������Ȗ}�g<�zIZˁ������bA��S!XOK�4%��V[v.��c��fN~3v�Ӝ�9�ο����G j��/��w �R/������F�E�0�uE���̙��x�Uߏ�����5�t���;e���6��x@H�`�Aq�[��aa 䠲�G���,7��~HW�ݴFR�� �p#�e�Z:i��������˂�kT� T���b�h�AE�JU,���8Y���c�!`x!I�M���BjډO�� R��>("9��&w9��;���3��b�S"����g���� ;�7n$`�Ht�tmm|! �xh�E��M�(����ѭ���M�Ȳ/��Q�5�����p뾿N�(?��OoFWK�VGB�#�qz�8Z�2��vK�u&I��创g'�܅�r��������H,��'|i^i�%$�� ��!TP�P\��2�(5ž9��)%x��Є�K���J��/�%�q�+� /�J1�XB�*ӭ�{&LS�o� ���rΗ!���?+�z����db&��H��L�ao�I�Y�� �¡�`�4�l���E3tg��cK�+��4� Ȣ
Static task
static1
Behavioral task
behavioral1
Sample
72f728eb10da4c23a6f8d7cb2e22fbc5f2dac6090a71c0511a0d5c0f6ba93e2a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
72f728eb10da4c23a6f8d7cb2e22fbc5f2dac6090a71c0511a0d5c0f6ba93e2a.exe
Resource
win10v2004-20240226-en
General
-
Target
72f728eb10da4c23a6f8d7cb2e22fbc5f2dac6090a71c0511a0d5c0f6ba93e2a
-
Size
2.4MB
-
MD5
af58992019d482d9e9e1b8d460b986a3
-
SHA1
eebb2ba49fbf3bbbfb44812dded0be2985e993bb
-
SHA256
72f728eb10da4c23a6f8d7cb2e22fbc5f2dac6090a71c0511a0d5c0f6ba93e2a
-
SHA512
38b93992d3f51d820413c7aad6b2703e88d33ca23f7a98a7cc1cef2db0bf4a3d7f7ff1e7711e85a9bd038f9c455814f6c1d0581e6ae223eb14e5f5a375dd80fb
-
SSDEEP
49152:RN2kr6/MLFzU+Cyg/sIxQILycHYdTVkMYTVimZLWcfx4tc0DcqBRg03:z2krm8FzU+as7ILycH8hMFZLBpWc0DK+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 72f728eb10da4c23a6f8d7cb2e22fbc5f2dac6090a71c0511a0d5c0f6ba93e2a
Files
-
72f728eb10da4c23a6f8d7cb2e22fbc5f2dac6090a71c0511a0d5c0f6ba93e2a.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE