E�A'�"��)1�/�P���e��@��C���1wp�'�L�9w��������8�g��h8�Q��^u��7���N�p?�ˬ��l���2���g�����4$�f5/&�Bs U)>#�]�Ҡ�l���j� ��R�&����Q-[�O��.:���J���J\�����c�fu�*R�6'���k���ȟ�?/fP��U��H�Q�ƃzZ8+ԣ"[.W��](�e�덕 O.Y��LF�W,�����[P�bZlC+�ؗ���ŢN��J��`/ >'F��0����V'��_��R7R�e�T!!᧧sؠ'a���r��c@y��OY�m��Ά�m:;��L���I(STtoU[4D:��y�wp�Z���?���K�8�I������Be��0n)��Z�)TA;�nԴI��.F�T��=�5®J��?Q�|��,ߏ��<<W�o�Ŕ��<º)a�~�ޕ�P�L�'&��δ��</�HG�\K��w'��!�zh,H�J��bPPul�u XL�Q� �/_f��[���ƣ��Mf:Ń��V����# ?Q��R`y�*b��[�c.��1�{���u�a�4���u�ሌ����.P˙y�S���8#�cVy]� �����y��b����z�Z9�b�D��<����̇�J�]�� g�k�m�K�%���Ŷ�;���w�Ԍ������'�@��m��}���tDr��026aZb����L�V�\�����']��#zoiA��ox)h[���ة��=~�$�����0��R�Oʦ?I[�$�s�g���.mP� aA����ȧ��r��4����d�l���^��~��)W|��vǃX�*�?��ۡ��k�p9��5KNg!�ʗ�H���}+;}��{X��X�Mb?,-�����1�i{�/F{&$.3RL4U`���MH�r�B��,GՑp�.ݞ��Fk���%ժǟH�5����'��7 ���Ul��e���`��kLh<��p.ňa����j5)��!�M�����Pl u�7^�sz�ΩV�q��� TQ����˝ۢ�:a�4o04�!7��_��/���c�|&�X�v��eጫ�]Q��I�>QS�[^�7�cIfA�mw�Fs�Ш��e&����X�W<�m��z���Z M���vo$���qwZ������XoR��,����������7����]�R��:���%��5�ё �r�eff����#ޤ�a4����B<��~Y��ν��䚲���3dc� 7K$v�$���0ީG�9��ׄ��?�Ҥ��ۣ`�]:�+]V��&0���T=���G$�n���!��Շ13����n��K�$��~JFη�kƃ�ɖl R� �<'Ѡ�0�ncs4w ��av����ќ�I��e|Kc� [�mJD��w�A��ҧ��O���m�ү��f�H���@ �zo���\{�jX������^g�E2����^ ��I�Y�_���j�F�_�pX0a�ӠL�j�[C}aݲV�ŝ�'.G,��,���RZD�m����z�z�U����G���X^ͷ����? N%b ,?>�t>���8y�#���y)��2�L� �z���7pM��dI��h�u���M,�{�n�����;YЉΏ��`��K�nNV�V�Th��p�r�4k�ܸ)(���gM8� ��3fmˈ�y?6�ey�P�A�c��/��~���o���\�<���9{��Qh�zѥ`Lʊay��%��? '�5�1u^r�>8}��ο5#4C[]��r��Fҡ��Ldԙ�Ld���v�D��'̺�F�H}z���I��8�&7c�O���3��ռ�-�Ƨ��5���>P�g��Lv��ͫ(q�hAm��'��`�l��'?w�P���=���6��Ae�)"#���g��,�4>�F�1��O�m�q�aj(�%k�[�ſ'Q�H�V��C����h�������2jn�qq�!zˉ$�2�@L���I �� j ;�6�l��Ƙ�a*�N�!Sf�U�'���N����4u'&��a终��� VDT|�#��Vf�B�D\�ֆ��H����<9ad�S���=�=y$B�ٮo6)�����͙������i�\�̈́�����6 }]\���曤qI�(�x IJ�p�Y��{<La� ���P��VGǶ�ٹf��Iky�@��`)}�"Sn�Pk�������.b��hhl�o���'z-=1�����1�5��s�p�`P��hG��. �<7�3��82��~�)��J�\)|��_��1w8-��� ���D1h�ö[�V�;�*��e@Ɠ���?w8�(S�����Va%ڲB��������p�L���J�il�o�q�Iv���&�@em������ +qli�و��ٵz�^;�3B2Z*ِUZM��Q�SB9� �-)�Ǘm��[Y��g7+�n78��L��$�]��`�q)�04��|GkVӎ��F�����`� ���z;�{c� o��O�[��c�����u�vv ����W�a��˜���A�,r��LT4�����h��9oP�=������ˡq5MP+4�b��Q/)�=�$��f��^���m�(���l��O�����Erq)�k�$�r�����N�fV�j��EZ���(�'1h�y0��Y����c|��_�'�⪪ܷ<���f��R���Zw���Y-N�M+F�L�< VI��) ��I�����q�ƀƁb�20xM��YlRO�#QQ����|X�D'�"�� ���M^xb�c�m3YX~��e�Q��\aXL � �X ���]��;� O�I�6�J�vn��HXȂ�÷�b�� mj�G_�� O<���mv4L��s�`4�oD�ҤNĮ���.�h�����|EZNg���dN(����fYM��������=j���7���->�%5�ʫV��Z����ϛA|��o5b��S���<�<�d��1i{�b�w6.��%�~ �;�I�ޓ]�-.p*���'���Il�OcH���S?>b���PP� ͧ<D��{E|`E潲#T�Y>L�f�z���~Z5s��&7$�-�i���ץu34��j�����Myyn"����O�L#����y2�m��Fyv<,����0��c�P��C֣S���Y�S�����l*�%˼%���&��e�}|WR���ˊyvaHg����b�**~:z��k��� ov�3!8iO&2�)���A��@zB���/������*�p��s�Yb�v�o ������d@XK��pj���\uks�K݄���xj%�wY5������sž3�ۖ]���R�����n&zlW �J���ڟۆ��Gv��K�b���1h����~�ӫ>1?�%9������&(��q=�M"M�j�A�.�wI%Qyurҙ��-R���$��$��k=8�<��?�@5�\%vd�y��i��
Static task
static1
Behavioral task
behavioral1
Sample
de4b2212bbd4a3dc3fbb4815976c92dc3d7284ebc3f689bb1c8fecbbe516ab4c.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
de4b2212bbd4a3dc3fbb4815976c92dc3d7284ebc3f689bb1c8fecbbe516ab4c.exe
Resource
win10v2004-20240226-en
General
-
Target
de4b2212bbd4a3dc3fbb4815976c92dc3d7284ebc3f689bb1c8fecbbe516ab4c
-
Size
2.7MB
-
MD5
96201cf7f2ffdbfbd3f0a0b4d6e217e0
-
SHA1
a61a3c2de6704093a3c8fe4afff4eaf611f41eb1
-
SHA256
de4b2212bbd4a3dc3fbb4815976c92dc3d7284ebc3f689bb1c8fecbbe516ab4c
-
SHA512
1b5b02320cd1cabd64c8662966c6af76dd7390eee3a0150d0efa59fe003d1c84ac0baee5252265442ccfd3077baab9641f81d7f2ee5daf12c37b82bd9d66dcc0
-
SSDEEP
49152:7RAfdz0pns+zwenVtph8SATIJiBxLFlomyk/zOgL0u8xbNVC:76zEs8wenVtESiIIBxLVTzFCbN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource de4b2212bbd4a3dc3fbb4815976c92dc3d7284ebc3f689bb1c8fecbbe516ab4c
Files
-
de4b2212bbd4a3dc3fbb4815976c92dc3d7284ebc3f689bb1c8fecbbe516ab4c.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_BIND
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 20KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 204KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE