y�s���J�����*�@��K�Ç���?�ĺd�������?�%I;�;����@�G�:l�=c��7#�#3���~?9�3���b)�q�+��8[���K�gC^aQ�: ��H2�G���9���PfkS�U��4���FNh�T�0^j��aݟ���K��4��I����'='��o2��0��:�)1k!H_.�������0g�#jvsP�b���j�K���iB��e��ظ;?N5���:��29��Vl\ymv@O�\8�c;F�K�0���@=m��������d9[3�ι���&�<8y�rx�斢%1��|��`t�4��d�-�� U�7 l��m�����3$�>��|�<xȩ����0gq� �GIV���^���u� 0ԗ�J`��T��x���� N`MM1\!��z+��@����j����� ����� ��=X]�g�; |�D����o"2��J|R����k^�T>O��N�ؐ=�"����_B��ʹ��3! ���d�����n<�V�NL��l�*W(�0�Z*�,ۓd�V�bRq�(]���ͯ�Kހ5yyH����:�I�%�+A�#Th:=�[��_U�>��I��&�y[���߁�)K����Q�2;��"�[�7&1S���vIԓ��������kR�*�?��푉't��l ��ֻ�9�VnO[6h���5���SLG�h8f:�2 ���U}>,��ϗ:��è��O�Wځh�*�bCp���W�Ɓ��"�"� z�r�kÙ� 7�8 P��Ƈ��|��+����FPC#?'�iaHZ������Q�3ϲoX=�T��@oա�Z�kw;�9Ol�,�#dO�����v��hG���� hk�1c!�%���g���?h���G�G<�{�����bȌ������ �X�aQ������#��+�ӌ�E� peH5��e0 L�H��?@r _���J�����i�@��^됯ɢH�]Mu��{��c32D��@l9�wuT���O.Y��!���:��D^Gֹ��gצF�WS���0w||)�������3/"Ohg�bc�c�xd&�u�z.��in�*�b���h�������Ў�:����XQ���8����AQj)����*Ͷ_{oZ�������S���W���h�V$���"�)dkE��67<��Q�����xT�� �K=˨sZ�E~k�]����:c�n�Y��*�f3�,��� �$[ pb�>�B�L��<KM!�A�����h0 �����'��,/ ��sR���E��� Ը��*𪙪��6���6�t��5�Ǎ7��ٖ��K翌��9J����}��$��;�+��LEw��v�:���< �X���n/��8@_}�E�a�@�V��KO�� �6h"l̻��u�'{��-��/�*�hŧX��AX}~V��]F}(�1q��&r�5�����x�\�2��jA������ij�> (TI6�,,,�O0�B������$=15C��Ot�G����DHm��XtDO��Nt�H��/$����P�"@�G�����.�lǜz ����2t'$���(b��� ����@8��e�����b�*m�|j�]{��s����p �1+K��*5��4��_iՃ��x�Wˎڢ�q����c�_K�S1l��@ϰ�:�e5��fSL(��dW���+� >|���}|TFfj�i��jЂ,^��}����2P�"�O��l�g,�Q�\ޖ����Any��?�j]z1:=`���X�8�(͓o��/w*g(�<9Ї/�B�S-�z�`Ț��(�䨌���tC�ݤ3Q�7F"���n7�OS�H�eB���7��5y�3���f7/�Paj��f,��g��7�ł�f�g�K�������d����� 蜇y"���vB.��ѡ�q�l����~�s���ܨ�0��{f��A�'�����6���Pqoj��)��vؾ�7�G;u�;�����:�K~���W������I�*��Ku���Xz�K̈�ۼ<%M��%�ٌPf+::E���^����ꕸ@~����G��ݏ�9@K9�b��]�ف��W��4�"6�]�0wtA���(�9��w�<H�㯕��0= z����� s83���՛�M������n§�177!����D�~&���pn �\�_K������X䴔�ņ����ʿlE�>����O����G �a�X������r�H����d0�"���>���p��%T�08�G�������G��v<`���n�S?�a/��{Du>�g�yؠ����W��jwi�Q�:}�5�u���Y�����c�_��F�:�M�HU2�цT��a�/�E����f4˵F��DQ��k&Q,|f��l�[����=,����<V�dq �=�Q� (Ǖ��K���� ^oUa�6�?�h٬��$���?ppJp���{1/�N U�Ŋ�<5Vr�R�|�)3���hyη�Qn�¼͔�hݍu� "�]9�4w���`�.Lw����B_x���OH)��U�-�mIyYZ �Yz���+�ܽ%�[�4� ú���iHKPGf�ܟ��1�wy@/@�tJ�j�HD"Qm�s�r�e�p���X���52�y�Q���ia*�$��6��I�_s�_u8�[�Zd����ĻU� �(��W*�}�&9�2�ږc�ɒ�*1j5a�����%��g�z@b��:N��Ҙ]�}G��A�Q�V�s�,�ä�l�sbt��hq�?X�wF��/Qm´<�)�=�&oH�t���dc�����P� ���1|&��݅�Q2k�;�[Db\�٭���p)����L�_����CE��;���w�H�-���K9Oq�)�@۲>�S�|;=��_5{�TP*���_�䶔������ҋ�p돉�,al����(��~���o<��ڳ�: d��xL��f2:ɬ'�+����yOעHA�%��t���?>���z Q�#Z2�5�[[��K�G�(&Lå�MR�N8ٽ�e�.OXΠ�*�m�K��ʦs��5Jx�Y!Ri����Җ���<|~I$Cɝ_%.\.� P /�/��ho⎆�M�
Static task
static1
Behavioral task
behavioral1
Sample
257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe
Resource
win10v2004-20240226-en
General
-
Target
257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab
-
Size
2.4MB
-
MD5
12401422f17474568a97ad7cf387d7d2
-
SHA1
9f815c5dbe67e1ab23e5cc2bfd10031af8615961
-
SHA256
257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab
-
SHA512
7e0c61820ce6314b6cdf9ab188fbbf87595619489d00a53a4928f5172462b0b4a09aaf794056e7c52955f9bf65cdb4fca11b096a8646534cae5995b6165fdd95
-
SSDEEP
49152:J5OWSx+u+yOBa6mKcsdonzjcmp207yWNAJHmIcm1zCDts883iah6oasKx4e:zOnGaqdozjcmQHWNYmIcm1zC83ia0x
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab
Files
-
257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 8KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 84KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 204KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE