��H�� ҆��/괡z�7K���_�����:D��/�-,�g���g�B��d(��� ��[?�ewOj6z����C�����M����Si��h8O��0R�2?.$� !�O캍�XC��5hl+��F�Q�˔0��O�}���;h���'�h�QcQk6R�Ó-����~�[�bzG9���c�b��H���@ ��=���F��V����:�Bcjr'��38* J��{ ���j����V���u(V�@�Ҵ�E�?��=9�[�Ѓ�3�_1푲3��|c]a��6Q[���SF§ S�r��j�����K�=.��)�WJ ^֡O3�o�o��б����%�O=�%:�cMW��9B<l�B̹2�yA�;*V�(��qO�J���}a���<GQ�k����:�Cۘ^o���}:t6����mھH]�r���W�G(��r)��K5���z���~}�r��p�������n�LU�c���'��T�6��b��:Q���g,5E��4���2�ѵ]mP?>:Q��!v�]v���W��1�� �8�����o7zl ƻ2VIm��\3�r��I������.�����Zd�%[H������8�ℹ���|���D�~�e��;m����d�ݤ��)K�;w����( ����ẝ�k27=z���,��g� �\��%���0�� ������D�!�a�ǽJs��<��8R��<���5�H5���`�*wӆ�m��t�|j�>�Х�U;}n1+�gFr_b�٤wW��K��e��lm>/��\3r���e�~b�L�� �}��-��:ګ��B���J�⇻6���$|��79l������~�V}�R�8H)x��4+yV��d@טpPYo�Z*R��g�4�w��R��i=ý�ý>�Ib��e�]��Sj���2��+O���v���t�zbp6eTR�r�h������v �qy;֗�9;��-�K lt����-�����0Aݣ�-w��DCL�z�!qg����!_�u���}����2�8�u���W>c�9����+k��$��zз�̮_@瞆]`"=��`�z��)���R�d\0P����81�Q &%�� F�9L�C�j�x��҈*�t��~��|�bU �.V���\��j����!� �p]�,���-ϝ��~�:�4�T`�Q��}S��x��-�T˥��OI@r�,�_��637�����2�et��+-UӑEj���5����We>�h�Ho�V{>L�ҍSR�����͈r�M��cvTn�)��h�AwX;;��w�S������MȈ{��p�G�o�7��� �w���|c�{����5_Ӕ��T���/�e-����J�f� �W�;v��H(�@���� �h��N����qH��R+u��IL�J.���`�}��'�B1�T)"cZ�&�$�X�ܕ3��h�튤�z=|�p��3,�ߤ ��|Q�*���@�� ��{� �����D���S������fZ�^G�%� ¯l��o��{�e"�?l����E&�_����У]����g�4�]I'j�1 ��,,��Q ":�,AQ�.oC}��-w(Ro�=�E:^L?�JZ _l������y�C� X2��M!��]>}G�i�D� a��{l��T��O�I��G������P�Σ���}Dn��(��e<��{Ld���IPC�:RG����_��NaL���kҭ ��<�=��y 4Ƅg���JХ��e�T�']�H��x� �b'䖤p�����\�2�͊�Q�߰�3ۡfU�:������i���hw�{�`p���B᪻LN(����SJl��r0�j�*nx�<�(�>�1#.�˯�3����� �U(�h�&{���n�>����':GS�>���W-�ӵ����os�"ţ��f�dqY�B^��6)���qL`Ix*Qp��Z�gc��1'�ؕ6C:oꯗ )�u��]��c���l}v��ؘ��8/C�x�"��j�������Zb(j���q��ؚ4>��յOP�XT�tO�����A��0��E�����d�B�P�*��FƁ�<]����(��R3�8��v�y��QoY���$ ([_��� �'�G{� ��S%楑����6�/�D��+�ј��2��48Q�f�)�SԚֆ���cC��x1CX�[������)P�Ϭe���RG�I&�Ql�߭�]��a��k�Y�T��I(b��t6n����tQ�I=��[�����r^StO��n#M�嗥<�m�܄2�'���*�o��H'F�9쒚���rPtn�n��T��Ҍ�tq����Z�V���x& �Ɵ6����@����S�hmEb,�U+Â�1��o4�[�v���� �K"���1,H��DC9��F�rE05x ~�ޚ��n�%=��-[v�Ku�m��zj.clJ���g��:N����Q��݁[A�.��G���Y�B.�ɑ��bj ��&5@��렬��M�Ch+��`��ш2����L�d+���˅�)[k��1Q���5�0�E[FF�>%�mX�2��"P<��=�����&�e�\t��o����@is���@��/tg���7�b���:e9�h.�X�zT�� :��S� $��>�'=������=_��&Jy���=����Ȣ/�3��8���F�,=��/��������P7�c!x�Y��� '���b��O|�2ѿk1�-?D5i���2L ��a�����J��;y�mE|��hw�.��A¾uR��Q��h���D<A4�u4����i�l����sh^d�9��˴]�=2O�+�M4�M�L���_ۘ�NS�g�A����,�po�A�u )ەء�O�����c�Y����W�h=JP&�y���}�{z�����$Zu)g�~�J��e�c�he�_�MQVm:�����L�P��j���ȱ�ó6 N���V��,�f��;�l��Q��0Or0V����ޮlYu�Mu�KHm��X`{�����k�B/|�ޖ���<l>O�t1������Lx@}%,��? M�.�f��g��qi@$�{s���Ō1<�1*�.��1B����;J�fϜT1���_��!��x)�轨.��l��8�X��|��g�@�i��1]�QheieC�S�X��[V��}@��/���lg���4ڍ!i�P���)D�v��Z���?�A��<�����lk��#E��A�}�p@�}�f���WmD���(�w�O��`�:M�L�b#��q�ϭ����T����)������Q�����W8�1Evz�Ci^�2a�KTi�����Չ��6��[�\U��E0X���81�!|�v��;S�f� �&�Y8��4��.���j}��y��w#�(P�T1SO|�D���˭ ƃ��-��Lc��IT,d�uƲk��]ܮ,�����U��(`9��2j��9<{���G��+��q^솨���:�LTS s�~���J)��,��)��%-o`Q�K��DJ�7!F��S��
Static task
static1
Behavioral task
behavioral1
Sample
11d001668147c6ec2051950e4a7f2000934dabf81c4e63a42c1353c6f8b1b04e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
11d001668147c6ec2051950e4a7f2000934dabf81c4e63a42c1353c6f8b1b04e.exe
Resource
win10v2004-20240412-en
General
-
Target
11d001668147c6ec2051950e4a7f2000934dabf81c4e63a42c1353c6f8b1b04e
-
Size
3.0MB
-
MD5
c76e5ca6b80527f3efab43fb576a8c3b
-
SHA1
df710fa9a4773a132f0ccc4f7efb69da0974226a
-
SHA256
11d001668147c6ec2051950e4a7f2000934dabf81c4e63a42c1353c6f8b1b04e
-
SHA512
762755732207a86509ab059bfd2052c0778cb8077feeff9032d1ac51edb8f8979c2eb34fa12c9e25d76e83d37a642c492fa624eecefb3d005d0a994e5cd45963
-
SSDEEP
49152:Xs9iQltiV3s3OtzJkRaextsGmq4NWT5LrqwXKF12nKCi15r7/YFxWxR:89g3s+FJyaextf6krKa5ifYFxWxR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 11d001668147c6ec2051950e4a7f2000934dabf81c4e63a42c1353c6f8b1b04e
Files
-
11d001668147c6ec2051950e4a7f2000934dabf81c4e63a42c1353c6f8b1b04e.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 48KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 83KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE