�0CsG���#���s����������4#����b&�h����9s�:wwH���}�O��jZ�9�9ӗ��&|[-h�X��~Fx����}B^��w"$�D¹����1����Wg<}(<���r��X��]3_���c��XiCcyY�!V2CpU!T: ���+��`�������v���b�����y�@9A�����xW�,-+e#tP$ZҟCIԃ��l̽R#}������橛�b��=f�d�5#w-��K5��e�nV�k���[�]\��v"����@;��ľ4�K;�,h@[��{��H��d�t��h�0�!�x�DqKe�1��W�����:�\⺹Sb��uϰ��ΰ�k_ثi�a�?�y��'�?�>�ﰓ��j��}=3�6�����_|����&�BP���: R��}ʺ4�h�C^�Xw�i����� T�E��z���'2=G�/Z�ߜ>];UF"�������HAq�HG���C�O�B4!�<Iu����_"�rt_Vg�@|G瞁��c,y���l����oRĸ"ce]`aR`-���ik�W�^�Fb��3m\(�<��Yd��5��s)v.mvc���2|�{��*��=��(�:�H�ε]��B)Ng�s:���4߶�'�!"&��i�l� _;��0[�p��7t���Y���(��w��;��DD}�������;C���G�Bb� ��®��3U�ǒ����6-VZ��Ǵ�ݱ��<�l��m'I&����!���!�ܚ=�s��{�1")$;����U'�^&���d��Z��S��B�TR�׃��O���9�3� �������@2g�0��`�S�V�l:�hgIq����嫗�OGF��c��[vpۗ�W�"Ж:�c�J@-� ��P$�B�c[ݻl�:�1�5|J/�����\v�UR��� �w�`�ARIYμ���R�� < oA�)UvvzQ�c����L� �#�����^�(�;�}�;�v���1�}N,pJ����h�\�Ė���i�ί[�R$�6����U�w�n/����%���S���V�����������ū戝J��z">GF�i�Fi�F>e�Ÿ햝��V'����IĀ<SO�� !��=3�Οv!5d�����Z��ҁ���R�Ylx�a�K�I�$�|zA��^������.�g@�m�$Mh�=�d4��zM�G!gE�6l���<,�H����uC���ld��f>2-թA�&���B^�n��ܽ���r��>��xI��� :�.�����2��?��B��]�N�-���?���7G�\Ɗ�+f�Rft�O��a@_mD8���6��������Yix�uO~d��ߓ���b��� ���OT.G��f�|�\���hU�L�u�}�7FK�@:����&p�D '�j�,>��,T�Z.|/7)4���c]}vv�`�bf�9 �c�T%x�к}3�����y' �֪�~��,����p9��ih���?;�m<�.ǜD������X�4s�w��Uz�'x8Yѹ�Yo�:����Z�xv�Ñ��39�E��:�>o1����bͅ�S�J�BG�����C�X1���{�L���8�z"樊3 B��e�PG����N�o9��3giq�T�V��� ��+�ə��>��^�ahz��i�F�0�6��6��a�j�] �/�/�����?n�%"�jl{���A/�+ٶOQ�ۮ���{>��7 �%���m��uV���H@�,ݼbO���'K��h���#���G����/ʃ5p�?>eT���D��,d���vo0����u�����XtMy�Y�9�0'l�(^��h�������腴^;��T3�L�S�a=�d��� �Z� >|FMʌ����+�hx���bS�nm$��A{�t����ŵ~h^��6����c8���&,��NA��`z�'XC�� P�pm����c[���+ny���|��i�b�$��L�5&��+�Z�9�����H'��(��MM��>J�i����o�{ۙ��G�܊��S0�8�Z��� B ~���F���5Xc<a�A��� T ���1}@��L1�/-<媴��g�tܽ�uZ�"��t���~���s���<"_�2�������y����5�1,ѿQ�3:���r���ݙ�nfZr��B/���NZ�ؠU��1[i��1pÒ�}��y-�^�J�Į>�?g����MoeD�e:(�$���V�����]��V����<��<q��,@�|1��f�t?E�dHcZ~�埅�Y+eM%di�,�s�8�kRي��{�K��:g歲»�CU�}KF1��O�ȿ�}��}�K�� �?fؑ6� ݐ�np���ʕ5���BqE�v�f`�\�� *d9����w��}p��dv2h0�0�r\F�z�) e�4\*���d6PF��p��`e�S�(4)P���#*�]�N8ݛ�!L��kO ��u�'=�\Y����&Fь(į� &ԭ4�>��#\9�F�'�ޙgW8K�7�����q-f]��lV�j���&?�� �W-��截 ?WM���;��d�A�� ����Q�:5Ϳ�T�D�v~��]-��`�� y�ё���)�b�*��RrQ�HZ ���Y��6D�Q�A��^���;���X���E�r\{B�������Gy^��U4@E ��C�[��j�]�6���E����v�/�w�U ����MI��./�����j���q�o�lhG�����3ac� ��X�(ġ3*����ш�߽���s,����ռ~��k*-@�Z��֘g���ݥ�����k��<���!���v�64�T�Z��J#zJ[q�ܸ�J T�Z�vs��c��N~�GZ�����P�Zcp����H.�ݡ�I�Rk�!y����80D9~gk�2e(E5:��������I�p$�OB�Q���j�N=5���?H6��\4�ځ�4��"���1�1-���Gq���|�ȯJ�O�' �\�Y���:~ VE���Ia���ϟ)�X�JԐE���Z�^���~���?���h����a��Y�I�����h\����m���BeA,�kӓ��-��).�:��%o ����!���e���h'p(���ff�0�5���Z9vBB�@�D��_�x*��b^+���R� ���C�Gp�,���ɮA�j�È��_������!"�-�}��E�o u ��r����j�(-DFg1��C\\�cc�=TY�����y�����Y$���lףA5Cx�IH��:..��32���t�#��Hu1���+h[6�1���GN��a�F#���:zSl���{��:;�7���$�vZ�����ݞR���NU��7���;_��D�пD�▏�߸�R� ���2�L0���(���B��l��D,�!L��y@�ba[<�#J�~��������fF�tI�X1����&��竳��`6���v��C���ͮ�͗tZ��{G��O���T�Z6��ӝ�s�IC��F����:���+��T�[�N!}D�fCw��s�e� Pm$Z�������v��[ 2��p?�|�I!�Cg=����zEw-I��'�N�h t��z1��"T�����v�}����,s��M���E�R�9w�A�>���l#ҖEo*K�o��}^ѹ�R���𗠠�ϯ��mŢ�m�Q&Ѹ�?��ʱ�0��[�xh�<y�/� v⳾`��-���,Q�V�̶ .�H��J8ߕ�/ѐ�W_ �ϗ_�!ǙS�` ���QQ�2��R�.+� 5��B��[ x��*���ք�[X�U��e��i���YS@�
Static task
static1
Behavioral task
behavioral1
Sample
f20ed6da377b2070626c987b66b18ad0fb81a3355bf5459c7d96759419528ebc.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f20ed6da377b2070626c987b66b18ad0fb81a3355bf5459c7d96759419528ebc.exe
Resource
win10v2004-20240226-en
General
-
Target
f20ed6da377b2070626c987b66b18ad0fb81a3355bf5459c7d96759419528ebc
-
Size
3.2MB
-
MD5
0edd0a10dfcac2d44c579877bf35d525
-
SHA1
0aa239f6eb7af401359f61816d9d06a94cf63c43
-
SHA256
f20ed6da377b2070626c987b66b18ad0fb81a3355bf5459c7d96759419528ebc
-
SHA512
d9084e0ec5967aa89124f767bebda253fdb71f836ca2ed4b404b7ca56a3be6a0216da9357606ce5e37f32402dee562dc999d8658007cca827b2bd987f1d75b2c
-
SSDEEP
49152:rhpOONDeBZCs8UGAAO9oTs8WhIyvqT8A1BcDfLiva6FtPsp6TqNl0nmuJrvExfcg:rhBEalVAuTs8YIagXRswGHiEQmh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f20ed6da377b2070626c987b66b18ad0fb81a3355bf5459c7d96759419528ebc
Files
-
f20ed6da377b2070626c987b66b18ad0fb81a3355bf5459c7d96759419528ebc.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 543KB - Virtual size: 736KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 337KB - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE