1�١t��Q��N��g������pR��pF7�����Mf��o�qA*)'�9Z8ٻ���|�>��Q)�`-c���`ի���%¡T+TxX�Ѧ49C��E��@�B���:�c?�w��a�@���P �D���E֣��N�1l{aA�`NȮ'���m�<�?�8�i[�)`����K�H���y�_.���� E�8@��y�*�pzb��a,~�Bz�1q�jE*�T�H_\���Y�V�������:�.!��Q<�-Mm��Q&��W:����]E�wps5sL�cp�MJ?��y�g�w�<�,�I�����;��D�DR��-�PVv�ʹ�v���[)���[gv j,W.����<#s�N�H�J����}�9� /a�}�PT/�jg8�l�hʷ������B�����P���R�pI��Dxf\�&�QAB��-GH0���6q�$I��{#�Ou���w5�\�:ur�+���!?� �s�i�WC�����5�>��l�<2ٷ\�PS���M� �]x�I���~�vY����b�9�)���/�t�RIK��Z��Vx3V[U�\1����d}0#1F�y�Pʰ���%FK��r$��Qw���I��o�tU�OD:��XoI`X��,��i��2u(W�,���v}<m�t��}�gY@�n�N��NEu���Ί² �w|(�Z��^0�7�d��*���UF�E�)�<�;Ւ�M[D�z[���Nt)�\?��G������s2���P����QwNg�N �� ����}��[���9e���᪵��I�8�m�VWh9�l�:����Ƃ'@B�BZ�"Y��dG1E��p� %b!F�P��&PgK��Z�So����c!^`��6�L����+����b8[��vY$�1�Y����^Ʌa��YA�e���Lޔ�5ڟu�oPģ��;w��ΌN-&�묫�+}��]ޓ�?pn��k�x�k��}-a�A��A?�=�Lm�ն2a�Y��͜W�R4����y�e5DiI���M�T�ꈎĝM�o�n/��Y��&tO��JZ����S7Π&��5�l�a_��'A_\�B�CU�b�ohW1�Rf�?"~b�آ�S��GQH=���c&�Hw�3֟q&X<?����2u��na¯N�V���ʍ��'6�� ݞ��P����k���Q93�W��մ��W$*hk�������=���S�Lv����b���K C��mI�d��"υ������e�.����ڃ:ԩ����R�����|��vyҀ)I˓#��%��Yڴ��ٔ 5��?���r_�6N�W����ٻ�"����=6K��gϷe&�܍����+0�B�����hw�Mp�I�t��1uj� 4"�ߟ0�O#c��ke����>ӘxLu'�W�K�Ƌ��R���dh��߹�h܃�I���p^�F��>�<a���7�(�JRt�Em#�J���3����i�A�}�� ?�/�5l�>�"�O��C)9ɚo���{���i(r���J�V�����0-������7G���F[AM5�C���ϻ�f-Ų3���<�y��D�BW̫�Rz̓��Rx�x�3����`���w��Ǿ�펒h]I�i�Ч�'Es�d� cs�V��Ckj�����X7^�4�1�@�3��+��Dh�Ѹ�@���ٛa�+f�������8f��\7��[C$�-%�{ptDT$��N�2� :�M��ݶ��|�ܧD��v��q��T�����9���F�� 6mee����qMwP��y��PO�"<��7�%C}k��N�6B%�������߬�8a�C��1��Y�wӆ���PTM<U �4㺐��a�V�ROf1�{ك��\q\�>�t�.{���<n�1��v_�{��S���,�>��}@�k_s��H�m����##o0� ��XB�m����(�)�9�ɣ��t�]������q{(���0�����Lc^���o��(D'�3���\�-��d<R���Lkd�Q�G����%b��q3���Ӌ�"��NX��a��N�>�oK�)[�X����*�/O{ǸT��~8,�nb����dB:�k �ۉ�?���V� ����6��Ԇ�A�jf������ \���ܜ��D)��AÄX7��6����h{���c�1�P��ց�L�Y�����W;�3C��K�4�HӺ<��.�D��x������r"�F�!���Q���WO���6���̣�Ǣ!T�l1�A�M�����G�� u$���S������ 3�x�TA��<|A������ڵ8kc�����i^��qo��ssy0�x���� D;*({�̖���#b��/�x��G7kt�tUWEYEi�9"̟tE0J��)��8t ���_��11�~'����bb�ι`��q\����p��~#������oy�} �o��Xf\�s��bOӀ'&�}��A�,F�;�5FVAG=��f�9~��!E��J��x;Z�٥pjQN4ێDx�5��O��O��?�6��8�5�qf+]��q�e-��MT6����>2S%�v�o�6l�!���Ѻ���lc�����f"�6�Vc��ws�w4�����l��jn� �4�/LP� ��Y�Ŀ�������������'C�G��2����8S���,�9G<k��%��qA\E/U�ׅ��f�%< V:՞��T�R��$�*��|#�E����W�`*�����n�J��mg1����L�;�� �K��b����?��2����g�"���LFC�Ty)����U6/��6����0H�c�n��&M�Ҙ���>���� ����/����v��}UiY�p��ya�$=��a�'V+�^_V� �B��Ȓ������\+;Gb�B�*� ZPh��a?~8�E�jr�,�~|�~ �1���#+ON�R�/�����} ���Y�B7ɻ#x4���w��b"G�nDGNpI�M S��4l�픜 R��5'r{w[���a�^����e���-/[wU�i����l����lf��y*���dG���P{u��\h�H�鬘* w��]�L�j�┭�b��Q���H��,+�^D�{�?�>��,��-�a����������syD � $��*hM�� �:����P�Z���/�_?�I8k�L�Ki�])��ȃ�Yy���D�a_��W��$>|������n��u��f$�C��(�9n$��S�ɠ�� ��\YF���L�$�m��� ���Ŕ�RC�"��ӱ�o(EUMAV����EMP��Y�E��U�$��4'W�g�)~�_Oy �L}��a[:V�ݾ�C��_��������%��s����H�l�������\z� �7�f��PJ>�9�1�r�z�$�f�� ��_�]��0P����L)�m����_�hq-�OD�S�~d6UF�Jĺ�z�y�%%�^F����SX �f<`�N���@��5�a~���ý˻M;|��B�m����-{T畠����^��`zJ�:��86*c��39�ه�SފƘ�x/waG��~,�> N�.�ȑ�%"^�����0��th�2䲅8U8JX�>;7���-BM���!�a�u��.���hԞL9���&H���<4e�۠9�<�J���qf`�쩰�
Static task
static1
Behavioral task
behavioral1
Sample
f6c964fde46ca3df5f37b39bf0d2fd8dc652dd9dcb73d3917b63b16e353ab167.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f6c964fde46ca3df5f37b39bf0d2fd8dc652dd9dcb73d3917b63b16e353ab167.exe
Resource
win10v2004-20240226-en
General
-
Target
f6c964fde46ca3df5f37b39bf0d2fd8dc652dd9dcb73d3917b63b16e353ab167
-
Size
2.4MB
-
MD5
c686724ec6a175fcea4e67b64e415b42
-
SHA1
dc084d880c250a8346b29a983a9aaa402278fb9f
-
SHA256
f6c964fde46ca3df5f37b39bf0d2fd8dc652dd9dcb73d3917b63b16e353ab167
-
SHA512
6eedfcf1118dce5a25c7ffbff5bbb491733a022895c62e3f99795c144deba18adbcca75b8c80be59a87344c6aaf73f6727e2dfb60157cebf9c55a4f4a7bdc304
-
SSDEEP
49152:BQs0cMeYPsV5KpBXnTXq7fYvy7rBZ1r+yTzeSKI9rDp+J:2s9MJVXrq7f2ybQwuI9rDg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f6c964fde46ca3df5f37b39bf0d2fd8dc652dd9dcb73d3917b63b16e353ab167
Files
-
f6c964fde46ca3df5f37b39bf0d2fd8dc652dd9dcb73d3917b63b16e353ab167.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 3KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 30KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE