�� KB4�M����"&�Iƪ{�:@r��ME�Vv��Ј̖�4O پ��E�����-�6�p8�����/�i����|7S���4���be'�����h�j�54�Û�1W�xE� KLk�C�'+�(�F\�����Hm��W� �ћDkY�C�֣O3�PU5~=1�J���8�9k��G��;�^��'��bU0pf��o�hǬ�W�zJCaM�������`���hpM�N�b��7�K�k������]��;sy-�z�ɯ�-���D(cP�̣k�0����dy�"��x����BO <��`�G�b�w�l�u����J@�8�ֽ�"R���>S+> �Z�~�C8��Yg��f�[��K;���>B "�*@(���f�>�h'�h����7v�!�Zܼ�'�c�w�ij�����N���{F+-]~��.R�mR�d�I7�R�F�o���D�F�[���q���bL"h�E�Pv@��A$��O�7���CQ纐��&��i�%#vIZ�r��B��1p��ٸ7��[@�#"W�>vɳzf�����A6��g��>��tʰ �"���1��0;G=��V��?�ܼ��г9�ҒY��u0p�H�� z�午�k!a�te�*������R��V������i������Cv�9e�)B����#�>�Y;�����-��*^|G��C��%f�]�E��;�O:@w���E נ�� �懞*1����8mBZ�K���� ��eF�R�aӾG� �0�Ҝ7���"�� yT��H�H'E���~H3��>���؝�d��m�QU�r��W�:�G����g��_�ν$�$�! ��|z\���<3�V*�1��V_X�@ܦ!{+�G�0��N��D�`�@B��9�)�*re�g���G:�A7o�����Q$����h�,]��_��s�\�!�i{��6�����V�ً�w.s3� ��n�uP �K�=W�Z8�І���"�o�p�����־� \�\.�_��hV�R�,n��4��?D�z��u���^���c�RBY��������~^��.�=���2ۏ�]M_�D��F��k�����$�� y@�������8V�j�n;z)MT���V8� ~�Y�R ��0ҏth��Zp�ɕ��vw�3�ɹ�SX���ZB�0G�}2:�Â���ߜ��� ���%&��Y�� ���9���^}y�H�%��>h�E�ᛔ�l˰�t͔z�c/���2�|�ι���]K�?6�R�c�d��f�5G|u�cۂ���� �H�n�����I7��T>X��z���4X�b��)��9�t3�W@��L����6���T?�lʙ�$3l:��Y��'�\��MؤH�:����FH@тR�t��,�����K��� /T��� p��u�l�t���ȁ�o��\,�E���9���q��Z�; �oЍ���T&���ZC���!��W1)ӳI��6l�02�R�]�t^����c4�C�J�d�@��a��'��ߐ�kY�41op�j�>��8k/i ��Q�K����v��]��N�WA�[��4��x�#���v��Ñ��0�b_e������s~^G������%==�fG:�쏮��`�t��2���ڌ��G%?g�I�╽Ӟ�[�و�������yਅzSF���h�_Iɗ�]և{���O����Y���j���@��7A1C}�E7���VaՁ�+D�o�vdeL*��S��<H�^� ��lkzS��ؤmod.����{����{�RB[���O����<�7ibD Rջe���lHi�Yw{~�d5_�NE��[� �c5��Wv�(h9,k5QU���BXz��f>���Ň��@hp��̗�Ra��!d? ��"B-"�Ȥ�]��b�Z�4'�FWLY��챸Ԓ�ΣZ9�M��X.�;KP�$��J��K�p��P�M���x��5�Dp!:������ېV�|��ժB��W�%��nZ�W ��^c#�?iRc+�}y1��$� ���2���_P��?�K$O[`Z%q�J́����e�1Tض^(?��R2�& 1(�+E}���*E:��{��2��@�N���bjjS~������i�);���ty�uZ�5/ӑ0�t���o���������?��jc�/�Ԟ�A�i��(T��|LsOo��;%�#��t�>��+Ȩo~�%L���(~жL���u� 8!�W���s��'s�GwIjs2>����Ge��C�5�� �h�tVL!җPe��m8���� �����y㟣&�w��6{�A��9t�d�fzu�dxXng{��� Rp �%�ER>q�j��$:��8U�;����֭N�.T�/Ŏi��4�O�n�k\Ĩ��ZWU�8�ʯ(�S�*�,&�R����B�)h����<ƴl|��}9$b��fɽ���{�Ax�d'�^X;D���b�n~L���KIJn=ڂ*����4�(�Rhn�|��ڻBXw��Y�K:L��Ԣ�'����V���,�!r����P��W�V��5u�Y/xj�s������&��A�g��!:�,�8��~_tu�ã ZP��_�nt�ۨ�澈��m_A\��[BF-l�T¥b�דS�$�n��a3��Q�QgG���{p��jJX�D]Α�����ZCRe_�dm3����7�ȓ�6�9���Z�rf � ����bm)��<��R���`�h���}��b�������;���\�=,j)��7��x�[(XG6�ĕuдUQ��E��;��o� ��tGGÏ�1������_w�iv�$����v���Xqm�;�м7�����V�1/՛\Xb;��k*a�v��I�8Q�a��I��50�:���9&U�T�`g�0�R�=���������Y�Mys���t�8��n��'IBE;����[�PjA�2}Յ��/�q��iv3���fs��t��?�C�W�C��0��5ƒ��P��_E��A�X9��?�p:�o��vI�.���YҪ/��AG�r5��"(�u`D��n�������3�%����E�ē���� ��S�X��̄b��h@��O�������U0�LG���+d�MT�8�o�2^��el���fQ������CO�� �C{�Y}_�z�) ���i_i������l���rx�>���CH��썢p��p�oO�3�� �q�6LΊ�g��toc}�LJ.<"�f9?��Q!�A>Zw�>}�2&�7Z����_L��U�s[Q롅8^3Np���<�� �5*3�̙G@���~\{Y�b���hoW670����`�&��w*��l� Ảf��I�]R����:�xr��DB��������:��-��W���J-�p����M~�k��D�%:�Ľ��1�_�H�BUz�B��N�������5�)��-�O�r���B����Ab�'���6�WQ]W��D�
Static task
static1
Behavioral task
behavioral1
Sample
f5d8f2218fee09b56869ec162f63f8315be4eaef745fe107406e54bf81f49638.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f5d8f2218fee09b56869ec162f63f8315be4eaef745fe107406e54bf81f49638.exe
Resource
win10v2004-20240412-en
General
-
Target
f5d8f2218fee09b56869ec162f63f8315be4eaef745fe107406e54bf81f49638
-
Size
2.4MB
-
MD5
0cb9dd5c420fcd1801af43aefb99d4da
-
SHA1
2506c767cb6529ce04093984ae28971f0ecbef4b
-
SHA256
f5d8f2218fee09b56869ec162f63f8315be4eaef745fe107406e54bf81f49638
-
SHA512
d819bca782e98039da89896152a0d723fc89e4c2ca9b04e88dbb4ef3e3a2a81eb9068af0229751a585e7ed906a846dd3638729c694a5a82288f5312c84588d04
-
SSDEEP
49152:JmPJccOFn8ebaU/GyVwx9pCueEVynE4voeQ2GM5KpLY5kYFax:EJcFF8oJ+x2YVELvDQ6SY8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f5d8f2218fee09b56869ec162f63f8315be4eaef745fe107406e54bf81f49638
Files
-
f5d8f2218fee09b56869ec162f63f8315be4eaef745fe107406e54bf81f49638.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE