��/F"/э.�A*�Д~�]���^���?�4�X���M�=$P��I�V�k��`�~Hx��oɚ��gYB��%����g�ȦE�]��Yh1$�O�̄��b���"��z�b]�� &z�W��Jpc�.������g�i�'_uF-=AB{� �D���:/���v ,�@g�abs�W�9��H�j���֒��% ���D��7��������j>�Ǒ��[`}�D�|c�� wS�Z�>U���_B�>O/MG�tѮ�J .��l��k�/�a�WTx��V2�8�kc�ς�c��HC��٤�@A��uI���j�Ʉ�Yn3w0!5!G��E&�fZ^�S�@o��P�!9�j9J0�mZ��h�����h���lX��Ąj���������?��f�1QL5�s#y=�TШm�3��r��D�W$������Og��� ��Zh�����jk���\�(k�(ݞ����2�� V���k���[+і����|�칉B���{�`�������*��]4BIޒj�Ϫ����t��;��`-�6ў�*B����go��T��~����[ԹJ/0*KbM߽�l���ofߍ6�^o֓�\`2��#�k�Tf�;ձp�>W��;ێf�����_�y� �g ��[�7T�jV�����XGj�?qW<����z��' �5�s8��3��O`��[qp�n�Vi٬Ǭ�[�-^5���y��hg�E}��~����sdeX���I���ga.�`��:����"��[.��9b�sFm�R�A3T�b�#LX?(y�wv�C��!��@��ѻ{��[ʟ:L �i�vbOv<�x�������b.�{�s�+?i* �l�vԃ0����%��%XeU�&�䘊dMdzrp����06��B��ѨYHC�j{���p�E6��v}f�������R��H5�cN��Lt��?C���X�$w�5GN?;��8\ƀ�5���:�>��'F���HQ���$�}:T�W�� �|@�!�R�3jE�<���hَc͜I>\��~2�&���,Ja\Z�b�����2�Q�r�rG�Z�h�(�[^��Z�2�3L� �W+)\���jf��6؈�1r3g5$�e�-�S�=�d�& �.�ή�=�v(��RX��Μ3-����)i1�T|d���A��xA�_n"�l/3�� Z�j,���/OZ�q�S� �Ynl.;�ݨ~H��v����⠗��E?�����+�H���� ,\=Db��Hz#?�7�G�J���UI.���g��_@O���j��r`��j����k',� ����%P�<=3f��b��?x���k�s��\ѧ�4�ӡ�㧡���Ɠb.��P�ɫ{���'Ǽ�����:+6Q��2/c��;��͒��b��Ȳ�|�2����K���ZN�� �P�!��跛�d�6��Ff��Z [��8�:��D�e��B�o�ۃVx�qVfq�Ε�E���� ����y��ʲ:�gYa������$7���c&"�>� ��dJU`B��s� X�9��E9�l�=x��u:)��虪nG����֑ϣ���0�b3H"�SkF;��ed�h��̈h��_�$��[4z���x�2��^z��}[٣'��Yk�W�Ǚ�1�p~Y���y�<I����MK�c᷍,!V���L.U�o���?���f>�S�M5���&�������c�"���+(��l��i-��HL���?tn�B��'���qql����i��˞�3D��X�E���;\���Y��He��yq�~Âw��m _PT@�b�I ��PNѐY�J��i���Fe�����a]q�>[�1��-�9�l/��DV�g�hq�����:\G���W��a��@㓺f��@Mɡ� �-��}Gϛ8�7BeB����w(����it��Y�ց ��/�Ƙ��e�Ȯ��%����:���4�4 � ��^�s������)/S�Qm���~����� Vyf��eS!T�"!�'G"`�RL����$�_)�)���˸{5�%��h�CC�i���)^��D�l�A���H��vі!.��e#�"Ɉ�}����q�C�L�����`��`�T5� �!�[�~[h�f�[���o�Z$���'ߑ���~j �U+�߹���*9���+M���N�^_M�q��c,4�0�QJ�s������|9p��@+y ���֔) � +���D����Ϩ�զjx41�����o���.`�=��'$q]��)��WG����Xn�S�1\C�ƾ~d9��!�=k��,�������M8���އ�H�_����C���������̶���"��Zpl�\"$a#�O�4I�ˬ;�����)R;�?�e�*�2�� �c�+H�e������N��Ӷb9]��l�g^-8(�A���'���l{9..2�YR��9l�H� Xw� g����$��ڴ�������S��f+�Ly����L_�6ɮP�U4*P��ݏ��f�f�� �e$ax#u�0����f�����p]�������c�I;Y���$ܮr3f�����5`�%�)�k�eϕ����P���[��P��0���W"�F��9�B���Rce-Uí��c�r+x��K��G�z4��BR:�*�М[t��;}����<HϚ�����)6S{��W�7-���k�s��>t��A��fs�K�YwQ��6m�P���u�^^X7w �Ry��ZA6X:��{(Z9Rs����t�Mc���ʶ�����*(p��zu� '���q�#�I]���û���3y��{\�6aD��}���J|M��[�t�-4xA(ಔ�2�We$}� ���>��t��(���;>�^t)c��#}ZUՔ�Ŗ[�4���;�R���9��Ml�M� o�䝯�?���}&]]����l�9�=�[�tXƽ=���>���/r��=�fr+�3����-/��I%�un�A����5G?3����$˴Ba��� �u0l�-[(�,J�Wq����n��ޫ?7��J`�4�$��U� �f�c���pY��%��-�����t#<���c��q�����ޞ�L�{m���銗WE'��f\ڡ�+�(�}�w� ]���$�V �:��~�6�OQ�C.��!�)��o��y��8��;mfTög�&)�p�2�E��^�x7&�QH����q9��qhC��5�=��c��4�I���_����-K�H���ز�p*=� �;�^�xl%���h���+H�li��"��-��>��z<�; ��_��SǏ+W�6���f����X7����,�����KǦ�@�(���[I����ۍ����o���Dz��@q�Cf�ֹr1V���QCR����+�YE���v�YC2�({���A��셐2<Ҟ��.�F+ڥ7FR7R���)5"�{����s��M"���`j�M�&[��&��Iz�x4nc�3Wz�_/ڌEZ�Q��3:�i+1u�V�������}�f��#j%c\y\O�|(���ל��rb���z��Á~d0�h�x����I�i�w�<̟6���xm$�\����m5�C9�����+�qZ'7��(Ě��x~�]&�Q «JPnݥ'��u�X:T!�������)�0<��,+5�B�@n�����xV�u��8<G�(Ω��6W�������.<pz 5� �Ӓ��A������M|I����Ƽg�Ա���p7� �^��Q��C�G��!k1b�E:2�[�I2�H�ʃ�2�h��MH
Static task
static1
Behavioral task
behavioral1
Sample
c6a657bb6f4cbf3729b549518d4e0e9cc384caf5a70383da498c2fb31f26b439.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c6a657bb6f4cbf3729b549518d4e0e9cc384caf5a70383da498c2fb31f26b439.exe
Resource
win10v2004-20240412-en
General
-
Target
c6a657bb6f4cbf3729b549518d4e0e9cc384caf5a70383da498c2fb31f26b439
-
Size
3.6MB
-
MD5
3e0c8851be4f199ed43bb75952f0d18f
-
SHA1
f4864a46f93abf231ff004018ad1844e990f2f95
-
SHA256
c6a657bb6f4cbf3729b549518d4e0e9cc384caf5a70383da498c2fb31f26b439
-
SHA512
368af296e67ed37e9254548e5b25853b113369d37faac8f8625f056257192237080ae38ee3ad6ab2aad18ecf5779fc6189656a72c6789dfa882c6e7ef61d45a3
-
SSDEEP
98304:CPB0ybSx3aY3jgCeAWP5S9oizFcrb55B6qo:C5tbShacjgMn9oixcf55do
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c6a657bb6f4cbf3729b549518d4e0e9cc384caf5a70383da498c2fb31f26b439
Files
-
c6a657bb6f4cbf3729b549518d4e0e9cc384caf5a70383da498c2fb31f26b439.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 82KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 20KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 298KB - Virtual size: 13.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE