����y?�?�>�Yq�~%� v{?���uM~���ὙΞ��lA p�a�� �o(�Hc|Y����N�l ʑ=. I��`s^u��I��i�X����C��Jd��_hX�����+SkZD.�rSN5�`d��"���Q���R���5�g�:m �hu����k�B���r�G������H!$d������eR�/2pP(�ä+, mB\�ӤW�n ����G���Ի�1_��Jf0��Y��M�#o�k���� ���$|����߭ݰ|��#_�G���n� )O)����L����jv�i����FV)�����~6OQyW'|rzD��!�NPl>�"y�\�G�p�������G�~+à�!�ӽ�p��+��PY���G�(�ջQ�����.d��D�`�5�C|�q���xC���DP5ʤ�|�_p6t�%���*Y��y笨$�+�(����B�ťp�k�N��Z�����A�kV:�.O�&~ l��;��M�v���=^-MD=q�p�n�����t�w����?�V�OJ�c7Dv�bW��X���h�x��S��(�a���F��!��ǧh��0��x �����v�6ݼ ��i��o1i9�U�����N+� l�-���AR'B��� BBXs��Z�e��ew��X�j#N< �]�Q7�>5M�~r|��N�cP�jǙDZ��y=�ʪ��Y�\��*>�{xM����`ndm�"�3�I^e;� u,����K2��� U|����2W ��l�r������LF�t����>w��Z#��Kӳ�E��n�'����XERoD����:Պ�����o��s�@������o���Z��E'}G�%�+ޕb�ST�C#��Iҷ-n�(��;�\�(��sq�����b�^&E�AN���f�?�ޯ�i �����Y��D������2�v��C+fi��٣[5z_$�W6�X���崼:ݎ9;�Qu����p\u���<7��鼿~@������fAܮ���z?7�u�B��Ҕ�^���w�2�H��`��ɮ�h��>0���}�-� ��|3���M5:Ig\]�èf�魍GmƱ��ڶ���� ������;���b�R�/������5��oiʐ�p��::�z�c�a�����n�Oɚ�� 0���o�Wh�n�y}�:A�'�t��})Z�R�b(��(.F2�{��\=�dK��\T�}S��T��/b�~�F,p��������c ?���(�+ _i�A��ӄ�[�[��- gED�va�!8hh�2";�uzb��P_ע���XK�M�)�ER��/��T��Ҫ_:LqU 5Gr�j}�CN�y��9��w�1��2�CJ��o|��OVF��:�u�gEHZ/! ������O�[�R�-Ng ��D �,�9�&2�H2�>YL �?i�^˞�j��x�_�]�J���MJ���U����U���!� \IJ���������6�� )� EH���'��Y��J94�u��m�܍��è~ɴ2h l�S���tXZ!�^�S�#� -4��94ՠK�n.��KN&�z8�N�����:�+�.]?=����հS����ef��BS�%c~�Aϋ�n���O_�*C�P�-_�����^�X������هU��'�2��i�!Hu���� �p��� �Ah����o�t���ޤQJC��=��Z"gv6�X��Y'A1&#�k?�a�!F����ɘ>b%�e�+0 ���8S���"��u��6���zK;�A64�Ɛ��~V�ckH�D%+T�����o�C�6�So�-�!a�@87��d��TKpYdR����Z�q?j��lf9=]��(C� _{n|Oe,tj弳*t�� �:s�kq��6��e����o�;�d1�|��l9��:�hU%��f��86�J�r� ������?�.Fb�,;B6b%��N �uik�:�r-��L�k��MKcԘ�������U³�d;��A;���S0��i����s^���|݀���D�8%>4˘/ �8B�k�^ڍ�(X����1,̘!s�*�G Ἐ�cY@p�0����3����E����í���1���*�z|���(�Xf�s�H=M?�@o���D��$͆����6Xڍ��#��;(�89�W����~-��Gxz�څ��|ϩb�P|��D�bT��� g�Q6�4�a�U8D%@��U=���kY��j�b:YZ�t�W�njR��?2L�9Ƨ�L�.����w"< L��� ���8]��J���+��dl�wv����^ң9M� #�G����9�%%����s�y� �&��:�u��e}�}��7����\���4���f�bo�\ �U.�y�Og6q5\��6�/P=W��L��pFH�:��v ���� /�7��V� ��i,������I͆ڂ�) 2 �l��29� �m��G�t�T�{SLV����fT���.dT~m��9{��z0@��^�L^��7�<��r���}��FB�b��}�t1�o���/����QyM� � N H=c'�H������Y����2�W�3���>Ug��^ê9�lH������TLS��[��'��W�&Bj�m*0O�x&Z�R2DY��v�?�i8 ��P��/ ���p�n�$|���"���4�'֗�*�ծP��V��E/�� �!���B��",]�+Vb9q�N� ���F�S g�Ҟ2����3����R���GXf�5�ȵ������=�؋�+<��y���^|�s9_X�m��3�Q+���*_����j��2�m?l�C���υ>�*6'�����8#p���Rf��8��HQPSG����5�ה ���3 �v*��>Gk��P�g7�c�n-�6�p|��A �Ozw������m��tϡ�����x����#P�akx#���L�������([v;Ai�#����Y7����?�n]�|��/�K>Ѯ������^�$�\.��h:6y!�����زѠ�#����9�2��X�͝X��� 1x��."��ܘV�&ae55:�1?'�5�tYK~Ü�ח��ڦ�S,�n�w����Ļ���W��E�W�2CS0��1��u6]M7#�K`00U���|j�B�( =��~qS`�3%��i� FH�-�V+�����j�¤��Z&��1��`���o��e;'e�~7�x��F�:�V�>$�f��0�?Lz�RN�_���$�`b6 ��� iF7-ҿ8&�Ƙ� �4�e�4��À�~sV�~�ʯEթ��F��ح����a,�lSs7����VI-�{�XN�S���:7@Eg���iM�;�Չ5��L��;�����Z�w>\�S�k��!5���z6{\9*�w6/d^�Q=��` ��5W�£I��$�8.0f�꿣��F�,Y����9�"�!�M��n�7n�3]،|�x��4�͚�һ��ϡ�#"D�w�@���L����ʧT�_ڂ����E8!�l7���Y�~����샷�WxqFU���=��m���a_���N��K����D]6;D�J���($%���`��kg'�:9#2f=pC������톍��*�<K��/LG��w:����̣hw���ҵ�o����27��Du,:k����&�Еmlq��x�����\Gޒ������ �R(��78ހĺ?#`��T�$\T���C��]
Static task
static1
Behavioral task
behavioral1
Sample
dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe
Resource
win7-20240221-en
General
-
Target
dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff
-
Size
2.7MB
-
MD5
f86ae0ab21191e40ccad928817144643
-
SHA1
5ac604256f9e7c428cbda9b31b401f9715f44646
-
SHA256
dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff
-
SHA512
807b4e5c831a1c3a5541edeee21b9281599c19d9fccbaa1f3004008ce544fb19edd39ab8a4a25748b2b14770f76895a8d1bf82e0cf2ac52ffbdc73d1a9be1ce3
-
SSDEEP
49152:OkjRhlIBG6uH6x5Ipt8/AibVeARh2gtpyviyMqO2BwLJuwJCVhrwGaX:OmIIKO4HRjjv3KuMDFQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff
Files
-
dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 38KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 30KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 29KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 186KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 157KB - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE