�HZ��2 "c�����Ѻ�R��Y���d#�x�k��o?���͆��b�R�A��|�ʐ?�UiR�[[�Y��,NE�m%u�h��y�V���������D>�_�L�ߒ��_[$.�m�O��G6@i�)�L�ZQ#~lsӠp�%�q`�����@� ��Y B�_� sW>e9}�d�u[GVs��9ў�Z�2W��q!�q��̨^6ok0$�[����M=N^}$�, �<��F꩷l�� t;d݀=�OfA���;�n��2<=�������-�2�·�iَ��(Y&+n+�\TP=~U�5O4p)z���̈́/�{�}����]�f>X��Ü҈%&���Ŵ~�XGu@�3�� ���=��RM�T�N�c�L�ϒw�^ڲ���҉4W%=b�jP#�u��E�-M�o������JV�Bvx�i�a|Š�� ��XI2���W�y ��s]o��&�_^Lǡ~���"$y33��U�!4f]�@�t�-��aժ�U!{��B!�GG=JJpP��4�S/ ��56��^��H�d����h�Ԑ�̸���9!0�T�BH�Q���9�k�|9mF�vIg���jM�fh�������G��p>��K�\}���^x�S��o��E��$ ϐKd��4�r-��ԅ;C�:ϟ���tn�gW�,`�i�e�d�!���H�[�l�|��9Bo��>9����XU=Տ�wj��Kz�w�0niuU ���b�2;$��ɘ��N*+�#G9%mu�|$��6��cH���7�%w���R�C�6��w]�r���C�8�_��XR�����~WU�S�i_�Mf�}C3<����������u���Tpٜ(Cs,߷9w����>�7�)�4�_�\1��]�W<@O�h�O�Av���ț�����=����}������S���''��ɔ"���/S�[=��ߖ(ܣI�2��^Q�&\%}�fQ� *�t��"V�'������C�(C���8���uS�Ӷ��{c�M��G薤��p'�6, �9���O�ŕ������{ke ���V��Zմ�Kb0.�]�>RC=���Y�38�j�i쓈�i#Pj����.,Xv� �ňjV���w&8i�;P��ʗ���^�ʂDj�,�C REb���������M��q�}*��u^�uH���g��^�t:���F�!CVT%�~P���h���[�e;�`C5�Σ1W����f��j����p|7@� �������E�+�i@�p��a�)+XW��� ����:���k�\���7:� ���S%^V,CSӯ#�l�?\��.�{�����ͯ�� ����]V'���0ph���[��X��!:ؗh��n��CH���y4��KcS��-��pw�6���ֈ�d�B@��jt�߭���ҥ�C+�q�ҧ)�z�������+5��j�8�$M���7��*���"�#t��| �Kc�V�(�ff-Nޑ(~C�h����^¥�s��aɆ2���%��Q�V0&��ʍT���7=����g��� .�Dit���Gc6���ͨ��`ڐ�g̖|prߋD��l��Y;����J��(j���s����},�?���)PUf2ި�VP�I��ZG"�6��G5��S�F m��4��hJ��~�ȑ(���G(���� �n�ZS���/��+{�V5H�����c,\��+���'Ց�d������lT ��\�/��TK����fIW�5�T����?����o���/ۆ��Kfde��~#>d��� ��՜A��p���x�����},\��pB���xb*��Ű�vO��{�$S%��BX-`��|I����.����T��ti��2�$�&��o5�tӆl�ia3�z�U���K2��������a\����Ki[¡u�-?#��vہ�c�;�rqkO&�9��is3F{ǘ���s��B����fnL+��t_`#��ql�3�� T�[HT�p�� ��}���F��$���cc������2�"6���N.%ˁf'c��3�:��N���~s�X,Ny��0%HÌ��۽QB�|5g�L�[ ��=5@_lGu�A|�n<4�HF��8~�TC��Bv�5j�f|I槔7�'C7��!�=�A1<�!�v4U��F�qmBUOB�\oXw$`����=B�6�[��ˈ�:ex-��]6��3sD@7Q��D����W������&S���uTw�/������ЄG�ǭ�=����(F��/�]s���@���#l������g�I�D�X���. ��j~�@3-$n�Y�QX����-�#�������R��{A��NL������`}gj0:�^��[6N��ZDB@��Wk��hi���r�o}��W���U�����+��O��� v�~�u!� �������~��z$3����x��$Hȡk�:(�F�ᥲ����oS9��S�����p�f{Uwf ��<K���a|�I��>���DŽ'�֒�8���M����]�V��C.�"7^�-�)�/?��4�fZD��S���|}1������?���r�B7�}��8��}�3�CȢ�H ����8�NUmY�eaQs��X��ץ�Gǎ��-��BǛ���:�k,�8 Sp�)NB�_�q��V���,*���� +��ֻڇ���PR�I�.����T�n w��%�y����1��H4�ט�R�z(Z�����B~�Gm��E�F�0�[4��;.�TE���H}T��J?�tmg+�VC^@�nB2�vU$1C�Έ#�w��'�ԛ �7�<W�\�a&Z��-���`�n94� u{���+=�� ��GF�fŹq +�s�َ�w�;_��p��~�}�`M�� �U�4���l����|��z� ����r��t8!�A� %K&J~�3C������Ȟ��W^��H7���d����y��+�i�o���_ɻ�P%#��3�8�.��uY������� )ٯ�� A�k��V���;�ں><#���?����\��������5P�ģ�h� �*&�!0|��Z��������ʤf�&#ƺ���8*N�.-=�)�sh~��Uz>mȽB�qP��g���%i݅�Hٺ�Y��O�/�8<�he2�p`Y�=Q�N��M��f~�M��˯z����� �=�����iMh(�5۶ܚ�/�Dž�E`�$N������bJao�N�r��RԶ,N�jľ�^48�!��������3��q]���U�-��SqQ��C4࠻Y����/%�b����u��|�z��yy"M�\k��y|���Y˱�ſ���[�yK�}�� ,������$rS���fϡ��U��zZ�?�̝xG�~�ex�q��@/�[0dl�������T�5Χ���P��*v��E!��������՟�,��f�>�W (]kY� �P,H6�]ǝLh��MU��d��Y�s��|d�K>�E:a��T�#��l�g�`�K%J{�T��R��k��K���Bc�hJ��w�RW�����L�+q��@ƃ�S��q������Z@'?���L��Z}{���7&\O{{W_����wDQL̋�348*���2�L�D�`k^�mk�En�T�)��߲����U��{h�>F���(��G9��R���06�h��qB;��c�S₨6��3��0vz������1�6�$r������ͫW;��̭A���9�Bl��ϧ���%t�H��[�����j*�eF��2�z�:�2Z>���6��u~"�Tq���2����
Static task
static1
Behavioral task
behavioral1
Sample
5c7309e0fe5f12642dfa12f382d3b6c9c19b23ff98521678f80cd92f720e8000.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5c7309e0fe5f12642dfa12f382d3b6c9c19b23ff98521678f80cd92f720e8000.exe
Resource
win10v2004-20240226-en
General
-
Target
5c7309e0fe5f12642dfa12f382d3b6c9c19b23ff98521678f80cd92f720e8000
-
Size
2.5MB
-
MD5
01392f9851ccf9cd99f540d357f9a71b
-
SHA1
430e8bc6e147e287212454d26ffc4400bbbf4a94
-
SHA256
5c7309e0fe5f12642dfa12f382d3b6c9c19b23ff98521678f80cd92f720e8000
-
SHA512
7f04d25fb72f21d149ecb8c8f89eab844d9ed4d41a9148ff430763eb45deb8e7bb1ba4b611dde3b919d53476789ce143db900d39a8e242a592d0719db8fdfcce
-
SSDEEP
49152:P6wJ89NfXqXUVnVZzXUT720SUO685igjY8KshDL9v:NJANf4AnVZDUvnO95df7ZJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5c7309e0fe5f12642dfa12f382d3b6c9c19b23ff98521678f80cd92f720e8000
Files
-
5c7309e0fe5f12642dfa12f382d3b6c9c19b23ff98521678f80cd92f720e8000.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 43KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 5.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 110KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE