xm�W��|k~os<�ZLJ�ޝ֍P�o�� hC]�����3���F����g~3�v#�%"-��4x�[�����r�Y�]q67��v �^�ZJ�q�e����K>hŏ#�yD����'�V��~�)$�����[���{���O^!?O��>�C�]���XM^z~Bj�9�p.@��v�Bj5�p��R|? �E�B�.��e����'��(?7��k�Ϝ�^V�D�&Ƭ7�����+Fb$ �Q�=��>c��k��or�5٨�O�W+Cw/��+L�W(p�Ѹ)'s��:S�xA(�p�����P����X� P���I �[��g1��a��� 5k5/�(H4��h찋��(�{�r3��Y�>���0N���,��O,d����̮N4�S�<e ����.�|u��|���k�] Yem#qVy�?4H���l{8��,�t�e��"�IX������UCM��}-\@7h�O�-կ�B������~J�=�}oF��A�Yw�����5�)�Ʊ8{������DB�J������3Ά�V��@;�[ k��4�1�ڒ�텖�3�\93�2pN������E��s �����g rS�S�����g��χC7K:[��s'�q�-S�� "�������/�D�Q��J�B]P\V�] SLHop��p�eǕ��%�n/S�ކ�����%;�n]��0�\���N�G�u�/�= �ngR��cC{~�|ʬeMZƋSE�qȱ��8�:|���O�W=�9���x9��hǚhr)�����EU�d��t��u@dԴt=���70���@�ԳK�<h$*U� �-7Kz�o��|�<�PZ���t�N:]�'A!C������A��PN[}�Q60��rF�9�>����Nz��Fy��F}�]dQA�S����8HEo���8���4�憁 �>� ؿ���*n��⑭����x����$&�`�N��I'�$�Ĉ��8u�}��`�Wֱ�͋_[K����-�y����T����e�1�]�Z?�X�Q})0)��x���'nT]NYI�����H�-�\���6ǝ�� ��u��ĕ��������n6��>��:-B�«ե)+S����ҡ4�� H�0+���ՒCD�>�ٍ�m�LQ}��_��F�4r���ߋ ���,�q2Eg����n��TKED� y��4�S��&����ea����d�Y�����X.>�����ͻk����X���݊bU$�|��P�mƞ�,kb`jYe�D��ai�8nR�(�p�<"�]��d���գ�?�.L�:�v�I�~�x$rAz�B��T'B�𬭢����R�F�酿�I��r��W��N��o*H����W�Z� c��=���v/Bst��XS"cT�4��8]1Ƭ5E �Y�[�f��GН����af���)/�Z!Y��J���/f�/��JOo��:R�z؎J6{B��T�OD�{�����W�=���9vI���^4���@�KW�?�8�4�x�a�� +onS��{:�D��3Az����g��kn �t�Yt�^�Ȕm�0�N�^���"p�D{�)m��SF�7��ҩ�Lu�4*%�!v(��9;/�,cĚ�o���U��3��`�� �+�/����,���h)����\�?�l����RF�U�˹+�Q�6l��%d:�l��y�Yi����'#K��Iʽ�"��0��(�$�D�!k��}�v�����Dݲ�����xk�v �s$9J?�Eޤ����|{�s������K]�����<K�T�E��C �����2CӺ���[9ϝ/U���5���W�]r�$@r��2������� �$�l�"*�m���-���{,ji1^Ƀ.i$�yF,��p��O��w���Nkjo|��Ks�ը�5 �N�}�v�� �O��z�"�5�)��[&�~��]�m����Vd��;��:aB�q���W>�獡|d�N��+B��u���/x�n\� @��g���b��t�U�5NR�#R!�����ph�5q߹���=OzV�f���>l���U�RD�è��'J�}�z��$��`n=;���a %��F$*j�Ϟ����'���R$_xٜ�vkIN��ir���o����@|��ܴ8|W��!�/�F봛�~n| ���8uO�ӹ�:�[S�!��U\7W��|����R���[��z1������?W�Gb��_����QA���\���(�����b����Ϥ����a�l�Vv��Z�p��r����j(G�E�!Y~���o���P�Q�҇�T�u��5�յ7�����d`Ѿ�3a�y�).p����%��-Pe���"���l����!h���� <m��c#/yD}<OlA5[@�h��D�;V�Mz��x<dH�IC�f��h��^Qm;ΖYBI<���.l��k$Im}��Kr�LR{�����*м����Ć������{���������e�D��1����Zf+\�����0�;!�y!Ez��r�bl-���]�t�r����}`Q�wXr�s�t��"F�Q�k2O�:��ianv��Ϯ��<BX���<R"�M<�0x �w�-����|����p?�m�tj�O�2�����M(ί}IP@���f��2��p��`B轞�ǥ����]��J����r�Dð�2�������� ����.�6䠀�q3�o� �yf�f���`H�Pdm=_V@�9p�Á����;���}�GjS�d����p��;�Q\����@S����Đ3��8n��]9�,��q��@7� �r�����bD��C&d�s�ή����toI# h�4i,N?���@f��u`��/DG�����\>/ɴ�n6��^�H�-�9��yEĆP����vg��ە��$k!�9b#���qBOw�}6c��״Hy]�5�x���ʒ�wN���9����r�4���o�냨x�|n����qd��$E�uc�����n4�E���ahL-�#kw��K�n�eqp0��������# .d"�� x���_�vP�f]�� Z�G♫�y����[Ƙ���O�L��[ZJh3�2�3�L��{1(7�o ^�B�4��?v"@u:�l8^U�:uMS�̫P�S#��1�!�co�F��Q4���5a�ʮ��1����!!Z�?B���Ca\Pc�q|�bD4� 2�^���m�C�^��/���=g�$q�9�'h�ػ��M����xh�n�a�W��U�~C�� �M�� ���n ��k����a/��&En�D�.�*!�be��/}���E��=�@���Kc�xz�P���wZk2']No>�QpV����mb��ƂO�����3Y�1�~rma��ِ;&��p�G��0����]�j�:C*�&{Z5��"Uv����W�= yx*a�(�$k�[���0�-�@M�]�JT��p��E��W��z���F�N�?�1��ї��r���˭
Static task
static1
Behavioral task
behavioral1
Sample
msedge_protected.exe
Resource
win10v2004-20240412-en
General
-
Target
msedge_protected.exe
-
Size
7.7MB
-
MD5
e1b9d6f7442752fdfe79a2ef028ff8f8
-
SHA1
aa6805656a9319336f17d38f972a5eb24d56cc8b
-
SHA256
f68c15017e658bde9d8f5ed67365b313d09d9e55ca408410eb958852281f4593
-
SHA512
1c330b7ad99fdbef0d0db9ed3677a38070494a7fd2e01dea81d5a00c710b339f4966b933fd14433f082a1b4bdfc924bf7493ea7aa720f24d2b81bffe826819af
-
SSDEEP
196608:bvpWiyvk4vkkGjc7dxiTO5LdjyNeBaZx1F5CqkChIHEmRKL:bv349/3QewB8Cap
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource msedge_protected.exe
Files
-
msedge_protected.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 312KB - Virtual size: 648KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 53KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 32.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE