@��Y�����&�0 �dT�ӗ�y��q �8���ǂ/��k\cמ�Ż�(�U��$�o��9�I�����f�jA�Vm�8���0܊ܛ{LЗ�g�G���2)��C��Zrb��e�d53�'�M�O���J��!k(⥵,����ѓ��ܬ�� ڊf��4���k�<E8Q`���٫��bFeo`ë��bUޣp��5�3��<t��ܱ|�~`�V���˄�<�p�Xا�o5ҁ��άR����E�͡`x��^8�|?�?��#��Z��+���L��Da�����]�m�?Y�����QPyA�ه1��0�>��9����h�;Y����6����4Au��L�|d�:⾱J�{%5���ԙj�`�Մ9M1Rt6�GzI�H?��t�㚡�X�]b�Le�iS���Ia反���"�4��fr�J�S�����!��NNVD&�����d��9��U3s�T�>acpu�雲��~7E C�s?nx��?���m�����H��z+�=�'���8Y���"�Z�j]�V�D`�)��(�����>�pf�%����(���><̨&OM�=���V�,� ;�F!m�|��͕�$��_[�r�OO!�]�Y({�Sh��0�bj'�/�6 �v]X��q�(|��~B{�U�x�C<���^�{[���t#����{�żN������y XO+�r�Z��M���W�� ��U��2�R>�{) �q��������T�G�����K]_ �:�K��G�uz�i�W��Yǯ�k����y2�1/��XT����~��YENy3�m��Ie�aTUO�)A ΨY�.ە�곉X�ǘ��?�j�3�n`ñZ��I)H|x%�5�·�+�p�b�"�=�A��~��~\�k1���ґ+�6|�ĩB5M�})�B��Dzp�s�Vb��Y#ߍƧ�_ې�_�]�Ѵ�v;Z��Ɏ���-��*Ė�R�O6P;;��5i�72Q��:���`��<G��4zn�� =��W8I ��ƾD{}� ����� !g7������.I{w�$��+w�;r"+�\��(d�r"":&}�C6ShV�1~����;�۠�DM����� ��^T�O��<�W���a2g� L3@`�K�!L�_��(#<��9m~�i-h�XB��O7m$�L� s�O�1e!�T���!��g]y!�U�ay�u�5���ַ����Z���H���S�q�wE�`�.+d��6T��_T�+r���m:�=��V���a�$߭�-���uԣ�� L�|V_�ԩ�M����j�1�l�ᵉ�|��2{`y�.�JX8��5#n�$�D4���lnB�y�<��X<= �����h8/Xf��H�*�<7n����^��nGL- U�: ��~�|����#G�7�kDGAp�M�m[̼q�E���?W���Yt���e� �sm�� �\�V`t6�ԕ���g�zT�x�SQ�-#tn�>p%�)��Q�q�Pd������\n�Ô�P��� ��4U��J�����VH�$��b/TS�{�Ti���FR�6p�8��'�����Ve�����M�˲���ɴ;���!D�.�WW������dJx�����#$L,U������T���D]������p�iR����,�i*B^n���g����֚N�q��Ե��͒��%��|�qL�{��[� C�&��X�pH=X�O)�w%RU�d��>��n�d�4 ��X?8d����<�בj���G�0��� ��C�P�ǻ�3�O#�lC}�!������.����H�e�?��&�pT{]�7��{H1�~�Ɨ'E��#�Ή��0Q �Z���!��PyK_���|U��x;�c�?����:i��2�1'0����'p�ӯ���8ʋ&|],�r� �u�AO>勪�$�G��oއ���b���'�J� ^�� �E}na�?w����6���e+�uf���E�:W�����pDh4���2�0#�axa��7|�{���#X�����?uI�2�W;�c��3HQ`����b!���T3ES�6 >f^�"�����"θ�2��WcŰ��BD�dM�M!�`0=�\Zb'v`)��/%����J�jw�_. `��;9���n֠p�gu3<A�!f�e��K'C2Ȑ���ڍ�����F�R�1�-%"�'f�y�U=�Ōy�A'ԅ�b�C'}Z- �X��"'o���>b���4�~ԋ�w�;�,q�25�c �!qk�9�n=A�np�.P/Ĵ]�~˫"3�Ea3#Č�fG���, 4r]V��Q{x��]�� ��i�6��L����wі}+�v�z�o���(�F���mc}��U� ��:+�@$�|(�rdI������UXB� �|�e~�}L��"�����nO�6� �*x��F�����2 Z�֩ b�z����� H����M�p,"ܴđk.H ��l�<�HH�I����Z����s��%���Z`f�J�}vsa�4C6�A�Z�9g��J(����"Q�M2v�I�{``������y|�H��m�>���k(6�F��u�����gz���������[��\%~��|�q'���l�l�T���@�*����Y���/Dc>FV�@Pĕc�ߗ�݊����B�Ư&�s眈�ٿ��5�k~�B|/}ܳmk��Cb�ޛ��E�$$�9k�o�l) ���NV��@���0 {p���|�l�/Aȧ���0|iz���_�r�]̚Qi���$�^70��G�G�E����Ϧ���V���F�R������y������[�μx���<�rܑj ��f��ju��ŋW~L�%���j�m%�M�X74��K���3����T�!���{K�vn�/w!`�e�_�2�֜")�e�Ψ�Q�U��#yS��õ�T�{n _��z�[2��&��э�IU��3�Ŏ�n�J�rd@�2�a:���'4hA_\:o�����x�f�I�}@�C�x����0�EGx�}������ܘrGk� �K�eL�s5���6r�� W�D�}%�p5�ڈ���[���:dk˟y{)�Æ�gf������6N������;W��|f������!o� �k�(�y��̟z��ex���������鈖M�YD��)5Xsˡ����G�|qn x�<=�j�Uhݣ,�Ԩ��&}`ۨb2�a��(5��ɝ��;����ߢ�q�]Ͻƺ�}�d����*h����V5�#��T�<3<����ק/���q&����0��r+u&�ڍt�â�`Ψ��`�A�[l� ���!��߄��f�U�'Mʈ���Ove�J��\���,�2l�E���h۵�~��-ᙻ���=X�-�S��I�#��c5�(6ւ�o �G���גr��'g&�n����K�!B���7D�#L�d�EY�+��_��F|���r�@,��?2�=(1���:�@3϶�����v��6�J �to{0m-�7�����9$���2�b�;������1O>�`�]�@������e��Y�wk�T�\q'��=0�W#8��V�� *��U��}�*���&Φ�ǖd=�����j�:ju V�Ϲ���CcJ���~��� Mv$F� "�খ_����'μ���ҡ��X!���+⡳�0���U��ןm��Y����W�� �
Static task
static1
Behavioral task
behavioral1
Sample
5b9f560ab3cced6b26ea7437b4a1fc3023eb6ddd484179ffe26ed7b2ae7be7a3.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
5b9f560ab3cced6b26ea7437b4a1fc3023eb6ddd484179ffe26ed7b2ae7be7a3.exe
Resource
win10v2004-20240226-en
General
-
Target
5b9f560ab3cced6b26ea7437b4a1fc3023eb6ddd484179ffe26ed7b2ae7be7a3
-
Size
3.1MB
-
MD5
7c2bc4f04f9414b383a1f894f7aeada6
-
SHA1
cf6bac67ce9aa51aa0918a0c798475865292c816
-
SHA256
5b9f560ab3cced6b26ea7437b4a1fc3023eb6ddd484179ffe26ed7b2ae7be7a3
-
SHA512
e74b6b9d3a3522c4765d96d1c1e3a0f354e1950d82b8b5fa7c372b4d855206a0cef58d7339ec996948c0e466488d39853ddd85c915f1384a22f7a55f6800ad6d
-
SSDEEP
98304:8DEi8MEMbCBwD6gjom5tZPTJbj7/GxhwLC:8gi8MJ8w1jn1dj7+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b9f560ab3cced6b26ea7437b4a1fc3023eb6ddd484179ffe26ed7b2ae7be7a3
Files
-
5b9f560ab3cced6b26ea7437b4a1fc3023eb6ddd484179ffe26ed7b2ae7be7a3.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 543KB - Virtual size: 736KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 339KB - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE