M�5 UQ&��g:�S���r�q�Qt7�� �=l���7����y�Z��|������oG�M�L%@,l�'���8E�Ա���$�M�)V)�^j�~�7�v�M`7�N��p ��荰W�����PX; g���_=�"�p�0�"RU���v}��BDJ`gs�4ڻ�����d�F��:;0 w���$�9�D� }�?;��U�Ue�X�=�V�]n��4 �i��{��X�cV����Fo*�N0����5����X�$D�K�c���M����OW��ZA�*��"�@Jg�1�(�8[��8�OZ��Uf4K�P��"���Cp��BU��,pM�J����,2߽���_3S����b+DkKp^_¼��́ⴹDw�EY��<��ߺ�閔i˼>�{j��ܕ�̬�������{��Q(3� )8�/>��B&E��;. $E� ��)�n}��c]��{��e�0�w-;�s��[�~��k ��V��r��A�in/i�C����� ��e��\& u%�hq�*�����k�W���p~��/Q��6 .���v�j{�;�+S�[b��D�慞�G�$��q %�����wC��{� ����j�*��&��F�5���%�ap��XFH���uκ$o �Ob�Kvr� ߌ���"�.��&ji��s�|���Hi�ꉺ҄c"c;K�V^�w��I��X�1g�(�'i�9�C��x�X؋��f[}�S!�}/^�JW�İ��"��<�ǧ�%�|�QG�T�8�ұMZj��5h+��Jj�p\�l�f8�rM���ǽ�p���V3g���K���R�}4"�Gy���S��&0�%u������7��]D@U����c�1����e��� ���\�<�n>�z����(��j��RvW�ߌ�W���S������锖X��WPٍ&q��qi�a���+?';�c�08y(�����קu��o-â��O�F�ɡ�����4���l%V�R�^��Rh`* �n�c�X��2��C�2u�Pps���Z�u�x'��e*��q�j*��Me涰%7��qڎ� d��5��@�K/�n�[g{��=��S�]76��W��N�K�_�/����M�y@)_^gJ1g� ��W7��hl/Iɒe:�hЫx�%�����u�]mP�m�뤫; �����9�R����`�|�_d��߲k��\��{jU��u:iz���˶8��40�Bi=�y�Wh�P���de�v�LU������&��/�Ƭ���)�� �GVF-�<�dA�t��%6Άպ]v�$��C��(��� 7F�ԩϛM]���-_���� ����C��Z߰4�H�kz����G�/��@T����m��J>��v��c���4>�����������v�5��"2"s�4V��~���JX8��i �]/���-���K�{k�����*op���[���=A�1��Tb�� ��'�%�`dD��6 �K�����PB0"�&�ƕc�_g��P�2 +����&� �� G~OZ�����5�c ����[)-�� q�����c��-���Y_��Z��;-V�9�����6Q�[W�į:4���Z0��,�����Ab�tn�t�_<��D��Ռ��H���O��-���-s+7+��W�\)&`u�{����qN��T2�J��A8A�*���*T���n��C���ڽ�bк�\m���9��E����1r /"��./���.�tZrK�@y��Q'[p�%� �T[>L(SB&b�T*���88/����P��H�!�T�,�� ��Vș�n��0�쇤���J�*I�mIӍ|�_H/���|t����� ���0��Հ�\�s�]0�K���S'|����NQ O� � ��C�b.�%@�z������J`G2|�`���L���6�P�P�$�O�����U_��"W���臧�v H����8~�;�MT�E"'��Sr�,�d�<��M��T�N���)/7��i����;�:�ym��Q�����ڟ�����`Z�@�����ԗ�(V��y/�,��q�љ����ϕ�������%����P��/|ߩ�_N���4U��PB�yl�?fݏ��4� ��ue��g�>��� t�i��͋����u%�ˬ������ D��5�lT��if�1�yx�5=�:��r�O߶��{UN c(N��<{�� H�y���.aic�ӟ֞@/�hI��TyՀȓ�^"����p}A��� �|Yi��@���.�5HУ���<�D��ZΛ���x��.�L�|����Th*��_�T ����dF�7����{���G���� �J�&�n{1X�PErƕ#'+��H3���Xz`����YD��t��������Fu0T����0�I�S����0<aJ9V׳'��X)W¥�ܧ7/��S��sT��9!�~��ok�,)D�e�d�W�#\��9��O`_D �0�6������HZ������F��n<�Hp fwU�=q��iM���`\�p��&�i�*[�m�-�)Hk� �2�i��Þ�H��𧵖?x�mN>s��3g-}�ԕ w���Lx�����_»!Ik�h�9 .�����ʹ/WP���숈�s a������Vܤ�r։�#�����,q!�jlB���/�,�{i��R�o(��~���������`��j��������1~�`�O1��?��ğ( ��c���OH{��j�/��Q5r�h�������=� �Mk�F�����b(s��;ݷ�A{��Ǫ�1u��W0�H(�]��0 �K���\�F y�ȇ:���I��x+���N ֪濢@��M�r�E�]�SNZ�Z坦������[',��F���UBC`A�۸�ʹ</��������ݥ��������>.���������nܯ�ɛѮj�2��$Ē�aHHdCX�����J�@�gj%�d$m:��(J���Aݶ�E%�?�tğ0�[a���(4V����V�@UQ���SXjͧ�{o���������u��V�G+��j��4&�r�.�9����M!��m�@Krq�[���6
Behavioral task
behavioral1
Sample
e062e33ba18d32e07d930bd5df403dd9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e062e33ba18d32e07d930bd5df403dd9.exe
Resource
win10v2004-20240226-en
General
-
Target
e062e33ba18d32e07d930bd5df403dd9
-
Size
132KB
-
MD5
e062e33ba18d32e07d930bd5df403dd9
-
SHA1
9d10f2c05a2f9319783dfac11bf00b8929048b00
-
SHA256
e79b72088bec3f905e86decc2f11cc2121059a71fc4541743119a99d23b09de4
-
SHA512
095a32b7970ca557931e39aa151da15ce176efe66d5cdaf62fc8931aa678bf86cfb352e7e9a91f5063695f660ff4662a353f857ac4a40b9b747b22622506d2b1
-
SSDEEP
3072:5BQs0LOFco2XbHRIAzX9YxPw1WYt0/3XeVH0+L77dr+7v:5SDscPbHGAzXih5Yty3uVH0+Lvdr+
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e062e33ba18d32e07d930bd5df403dd9
Files
-
e062e33ba18d32e07d930bd5df403dd9.exe windows:4 windows x86 arch:x86
8cbaf46b8e7631e4b81a8e2fa8d53da3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 35.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE