��"'�ӣ$�\�eq�rl a��<"*�z?��if�{h��"����:盶��S������ �e���?�{�>���$����P���"�_.HU����`�mo`9B����̯����0�dBƊ�rf+SOfؑ��NKギ\Ylc���P�u���U ���o!�E���N�JN^\IP�F���������፱{����O#)�ħ$�϶��T�E�7��s�� ��0�|�a�MG�5����V��Gd%蜜��_�@8�^�ݴ�*o��V�!�j�����D?->g��( �W�~.��=�ª���fϻ�l��;�@ 6G���ٞ)-qT/t��_M���au��2�&�/��-shm۵��LC�|u"����}�Y�&�4�`U�A��w�2b-_�d��'�6��I��Si:��{p���.�#ۡ�)\���1��^���'���%��*��%����QI�Y���"�����i��з��J���a�:7}e�t��K/wX"�#&l�JE�B�-gD�Ei��G$3�QQ|p��)���6Z��RN�>}�HK�2.��L �D��U� �0�8D(��#�� �:�.vE����������Oh�)�7�}�|o�V�¶����JY�ӛC�G}i2\J�sZ)�r��gx���sk{�h�U(w���r���`��̡}Q��������A&���ع̣-����̑ϮZ=DA�/fnUE� ��@���nM_���|%b�&]�tw~��[���U�Ęz(�#ɲ^��py�^vv!���yB'_'1j{�Ey!V��%w��N��Vb�����m���g|�C)�P��Ҙs5��`�D�Ƀh�(Dl��n�m�);�I"Y��e�N_�>���r��q~Q$Lr~oK2"'�%�Q�>^.i�ȟĢ�?gs�֗���( yj��]+1�W�rcg_� ��+Kk�d]�j�>Ւ{}���/�=0A�R}�M��ͭ��#�� `����602xO���qRt�S���۷�����-Ryk�8}����sXmD�>6�R�e%��b*h��D� �$nm� �H�l��O�Ï�Qjwg'�&C������u�����En:��DP��L�T\�R���±&�� \-��Av����x*>�A���i1������ �"M������cI�*�ΉwS&�i�Z�N�l������pRw������]���^=^>�U!��`L�oJ&�Ŗ�z�3i��r��M$�E4��x��=)��tϒs'AS�["��Mرį��lI�]4νP�T2��O}����e�;��3>��T�+���������I@?&�m�l��N$����Gm _Nd ��]#PJ�g�p�]�*�ll�/��� ��ߙO����H����L9�^���F�pAQ�G��kf\<'����`v��K�g��6���J��j1�`�{P@*����;t2��~���ҏC�H̀�N ��E,fJ������@Ob��:�{X����J4�n ���k^/�f*��t-ȟj�X�M��\��>���0��{'E�#�[���_�'�HO��N�:��H~�d2?�����U�2C�P�6�l�yw����6�����#9 �"���f;N�����P�=�K�̥k��� ������'��=#�_| ;v��t�o�i�6��Sx��U����BB\�<������������t0~��_�����!� TU��a���~����7]�����IHg7�`� i0{�0P� �v�pW�Y��|m�i�ڄ.b�Ț��3��g\F��R����\�ݧZL�ܴf�I�Co��u b�R�]HӞ��z��C)!"�m���G/ ����K�b�9N���5�p���l��^S�'�D1�_.anI�Lƨ��7Rc_�D�ц��RwQ���w7�P�l��� S�#7ƇXX���m���A ���X�����$��T�O��G�����#���br�('p�r�XL�HU�Q��� �f�\�Wj<�{���J+�`��_�¿jϰ��\*+7 5� ��3�Y�:xZ��Ӑb��d�ܓ�>�j���O����6R�ŷ�g�N����4����uB�g;�iX���c� �41أ�vTc�`�-a�R�Qs��¢�"N�=�[������<��'C������d~�ѷ0�)!-�@�������4���c��y�l"�k�(-�= Ҽۉ����#���"A/�/#i�:7Y_|��#��H���ɫ9oU1ѵ����v�F��;1�Z�zPH�4�供;��v�'B�զ�H?�H�q1���b^@���o�H ��ᒑ�5��r�!E>���?�s4��m�,c�+<sOz\1�qm"�i ������oR�5���ݤ�����_���J��������0A���^��4��32�`�U�<̗˗��Y�1Kl��9+�������ͭl����nTֽM����&��8�ͻl���\�"��ѩВv�������1��6��5�].z�|<O�`5f9Un4J0�}�V2�a�-�j%8������Џ���_��˃����c�U��^g����']`�>!���̗3b�H���U�*�� �|���C����r���o(��;>�Ο���;���j2���m�ZVz���> ����!��J���zي���JJ���~�S���cpƄ< �Ӱ� ��Ke��E�?#��e.���}a���)�$f�>��ѐ�U�[F)"��w��=��"H��]�.�Y��d�U��IDU;����q��{[a������bߥ0+:&�1��?���v¦�1��4E2h� Q&ӗC��d�C��V#ܟ�Ź�]��[��)�up�����ؼ� ��C�Xĸa���@X�S����6�j�lKP$������"��,�F���.\2s�++4�X�0&w~�bOи���� `I s\�">�����ak�NTU�A;�<o�N�����7h߬�1���V������'�V_�.s//�}�,�=PJ�ґa�5Md6��V;��\�������-Y���@or������!��)ޝ��'�����"�UŬ��ϗ�wĜ���Q���>`'������^ɮh�b;�5H��0&х�6_L���>������*5��$�0u�Lq��a����jC�#ܤˀx�L����kX���2����6zW��^��Fp���m�B��݃/�Ӧ��An�m��6���R �`&��ʷ�6�H�48b�ʚ��<�C���!�X�'���<�-�`:X����;LA)8Ne#��%�w���I����+�=3�� l�K r<p��w��17�P�[�D���i����,��
Static task
static1
Behavioral task
behavioral1
Sample
fb7a9c1ef9b0b7e8316eae65c17bca170cf249709cb8d8855fd22a0b73281970.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fb7a9c1ef9b0b7e8316eae65c17bca170cf249709cb8d8855fd22a0b73281970.exe
Resource
win10v2004-20240226-en
General
-
Target
fb7a9c1ef9b0b7e8316eae65c17bca170cf249709cb8d8855fd22a0b73281970
-
Size
2.5MB
-
MD5
aca74bc20ebfb298fc29f0a61de4a73f
-
SHA1
cef70208c5c687a90bc043c7ce1947d6bac03ee9
-
SHA256
fb7a9c1ef9b0b7e8316eae65c17bca170cf249709cb8d8855fd22a0b73281970
-
SHA512
4241c4c9a6540e1a414783be1a9a2d3a602e4f161a761155232b5f5e265fcfb26cee8c3718a7d1589ed3581b7cfbc6e5a4116bc0ef237d875beee55cafe59b84
-
SSDEEP
49152:dKjMkd5MbJTarRi28O9iCgXTG3j9criID8sBKRqW5RSv6T5WaHtbJaew:fo5MbxaruO0CgUj98iI8mBWjSSTcstbq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource fb7a9c1ef9b0b7e8316eae65c17bca170cf249709cb8d8855fd22a0b73281970
Files
-
fb7a9c1ef9b0b7e8316eae65c17bca170cf249709cb8d8855fd22a0b73281970.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 45KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 55.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 119KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE