ږ��I=��W%*�R�e�u/�;l�y8��W�����J���u>ڠsb���,r6���� �Wl �A+�|���۳`��A�����Z�yIH�\������{�儠+���m��+�⠤X����U�A�|~ ��s�w����U,��dꨶ���=m���O�������4��4���͑#Ϋ�-S��Kt��)��;B�C6T��9��.ob� ��q k�j�F� B��-N|�HIP=��&uك���&�&4�����k�G�P��l|���Lq�)�b_i����d��VWZP0nP�Y��Bn��½M�v �%2є;��G�� �{͡��9��2��oN~3� � �ͥf���7�z����;Ԍ������Bi�m9���22C���}�m���ƳS��(�ߒz���$���MIm� t�v���SdK�x�*d���9�% t)6��r���z*ߛ∟rB�;����������LJo��� ��{�Bs @�������SR���`�E�vI}�KF^���b�uH�cH�,�y��-�t𪭃�5�c۽{�S��|CkA CY e�����V2k�`XZ{Da��&vu��(>{�U�� :?��c�|x�^��� �3��"f� ^�FEb��5mo��&^� �r����ܟ[{Ë�Vj= ��&��b�V#0%[�A#f�s�,[i�k�`E�3zc�:.����@h���&/L}~�:�;f�f�xp��h����6� �Q:��A�o���F��Nz��2�ߔ�� �IYD�8)Gj�z�*�،���D��FD�$z�Z��*��l�`>����:6$j# �!-8���V�e�bm����#������m.ae�������9b��Jd��F@ωt,"wn����'�U��s�J�x�;�$b���?���n��b��A�-��mxo0n|U���� �q��e�>�Z3�h 6+ǤE"�����1���#�1��dY�A�� ���j��ikSL�nmSb<�����G/�RW.@���@ )5$R.0;��f��|�����ch�y��-�B�B]�l����t�Н��a���4⎗9���G�c��!E���4<�=���(*�^ �%��рs4����l4�;-����_*�}�/��-$��<ԧ��������i$(r���7���%w�3R���9�����,�钲p��CS�($�Grϰ�gg�UpU��\�y��*pCk(�Q�aol�@�b��+�_᷉����)���]fH;�:�������B��օW��f@�<8,�"�-��s�;a�lrҬ=xp�ħv��u�pMB�^�xUK�u:��{�>����g$G�L��my�p+�BOiL��/ ��e���n�kM{���!��8j�c�Vf��AF(��w��)��������� ��W�m#o��3��v���"�k뤳/~bL�o�)�[ �N��-���+������q�e0EI���� �|�������Īq�,U�h.����#ٴ���j�&���=���t�m����Gq�:I����E.�~Y��5�QA �Z���"��:C>��. �KE�E/N����b�����C[F����=�̘�����:�'Ȭ�,}LU�d��Jj���uF�o�.���Z� ن��hf����3��%}l��/6� p��譩؇� �Ҍ�5�X�02S��T ����p���<�Z3�.SH����6�B����T���ܧ{��og��mc�ښ����5����ֺ���.h����r��Θ�G�[`_�A�%�R�v��D Δ�DY+��;d�;����鴨l��e�e����L�~1!=-aӒ������n(��lLʺ�ե8��N��%GK�;V1�+ъCW�[>� C��m��@�zA]Ǧ��KX��4�(��j�o�"�v_��4�v"cL�>)���Alj����;���o~5Sm �p&?lJ�>3��� > ^�Ҋ��nfhRϹ�J�����6�N^,�F�>e�l����C���Y��"}Q5�����1�I�3�lv�b� >ɦ�����V��� �P�%a@��7���i����*���CܨNE�/���z�]'fe�v8'O��1�N��Y8�/���|�L�֮��� @����2�_����3��(�SA��T�r��р����b�e��|�,�q�g������k���"o~ ��*d����u�!��~�zH/0��f���#~���8�E������$�ID�}}^D�w�nϱL�[ W�呺�D�b���T*��l���ec5K0&a;�˃������>�n;��s�}I W!.��l���z���G� 8�G:���������Kݬ�H�h)�u�ט�8���i�$.2&��O\�p>RM��~gt�5���Q�c�%A�xD��Z�9Iʀ0(����:��F����8�v�v@��k���Y>��}{>si��[�g����b8`"@1#�x��#:B=���hh6mG�SB����+��XB�۹-�?�1֎é���!���<�9�r�h������*rq��Km��Sxf9��h�gi@ނ{z���q�_ZIp^��na-��P!d�1������x�B�sb�l�P[��ZL���έ d��6r����^0}�z&�[�P���x=�:���jN�Q#�e�m�97D5~��j�j2 ��'�����D����O�H#K�RF�T�ڶ�?" `9��=P%�d9D�� ^qi��Ή���ĵ/�ob�.[>+�1�U>�1z@������T�ϙj��3D}Zñyv,n�r�Ĉ���C�뀀�.��e3�&%Zie�S~vIyʴ �l�v�����I5]=��V.�)�L� ������= �@�>�y����x�����^���ڔD(nhx�a�J��[W쌢F�h ��&z� ��;�SƜ��ٍ��!�9qC�����B�{.Z@��˔ϴhB��d���4�-�s]�4�{��o��Eu��mV�s�ڦ�@&��Q���,,^���h��-{���2ĵQ���������N����ȫm�E����U�T�kQ$� �?~�OG��:��� k]g�oOZ�ȥk�ryXTSД9�!���<��η��4Z\��{qw��ʉinг�A�0���qFm���v���q��s��g�;�� /OHO�������l�%h�Y �����J�X8�8�y���AG|8�6����<�X�I.��iX��(�)A�~ԣ�QIa/ф��������n�7uΪ�u5��b(HoEH�L_i3�V?�Q�/��2 �� �����1E4���~��[.���C��� R7)�v��-�o��N����Z��9#Ui��~i$7��|V������x�;$���x�^�X�0��<��� h�'@O���^MX��5QD���2���_��9�����&V�ܝͭ� ��q���C���"&�����lx���$��)��<���)o)h����5le0U�=��a6����t �&"�J7���RW��<K�'��K�83����� �})؟��Ic�n2�:�?|�,d�vaL,���,���h��"�|.��|�X�DK=�M$л���Z5���噲��\����=���Ix>93@ek��d�S�Pe�&��=Y��E���{�H�����c���������KV� u2��b�peh��R��Ȑ
Static task
static1
Behavioral task
behavioral1
Sample
ab36a6a069543c78541a97dc8486d90a406d519ab947d0dbe9c3a05807d7c6ac.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ab36a6a069543c78541a97dc8486d90a406d519ab947d0dbe9c3a05807d7c6ac.exe
Resource
win10v2004-20240226-en
General
-
Target
ab36a6a069543c78541a97dc8486d90a406d519ab947d0dbe9c3a05807d7c6ac
-
Size
2.6MB
-
MD5
fdaa788983240c0d1e6290979378f1ca
-
SHA1
4152b4a71744423a554c14a26d55bd4b78f7e6a0
-
SHA256
ab36a6a069543c78541a97dc8486d90a406d519ab947d0dbe9c3a05807d7c6ac
-
SHA512
fd10c91354171d3b6a67cc3a7d462f3d302f11d10c473a20744531312f2df9415ebb4494a4ce791cb75b8d956560f1a02749e084d1ea86f47dcbb7179c1a020a
-
SSDEEP
49152:QZrdJ5Rplp26MunMIi4Y/C0Ge8kLvJ/XoL9KYqQ31oP1XW1nKE8:4NlpdZT0G9YxU9KYqQ31o9kKt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ab36a6a069543c78541a97dc8486d90a406d519ab947d0dbe9c3a05807d7c6ac
Files
-
ab36a6a069543c78541a97dc8486d90a406d519ab947d0dbe9c3a05807d7c6ac.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 185KB - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 23KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE