T���kU�$���c�ɵw�y[���g��Ԛ�X��� ��<b�*&N�:4V�� d�a>AH�o���Y��z�_ڻx���M�b8�4*Ukw����x����QC�2&K��� 1��J �o����,�*�j]�U\5d�Z�#�!$W�������9�Ә��X#��>$�-��p`�1�zu����#�����m��݂��R���=C��>��)t�9J ���K���p3q-���$?ג��#?��f�'�ߨ���T}��]H��f�#�xwR�7�:GmX,��X�u�MF�|�S�Ћ�g�Ƨd1�F�=BinBx���+#3�`qbG��Z0����v�>���Fg��sE�Jz8!%�c&:ܻ���)1�3�V��_�k�[��=N|ъ�������P�)�SJ��ܯ�/�ud� n�h7Чxz�|�h��op�_w����xTM��VR���kSw�&*�����^L����M�KP�����4 ��/�';�q:0������z�['6*�V�R�!�`I�0�]�q(�0|Ϳq�ۦK5���cbff����Ѳ���F���:�)�=ފy]�3�x��}))�E��Mj���� ��O�d��d�Z�>�_b尓*ZA7:fG�|�q�,�2M�¸T���Jf���)4�;�_�E�� g����c/���B�f����,E?k� ���� ��'`��#7j�|l��&54��~0�vc��dS���u�FZM�٩^��s�r�9h�W_�=/be�=J�Jٲͭ���l�(�"<����p�{���˺ק��G�~���[a ���yW��O#*j�@I�������QkIPi~���}��S��R�� �]�vA|/uQ=�^��b�=W!)���NE�}��������6#a�R)֤�v-�R�"r<ܾ�i�������Ƀ�a�;��J���|��� P{H��5@�Z&,7 ��|�cZ?��w�����d����O��t��|�$u.sQ�L) (�*J��k�T�_�w�W�w0H@>N���������`{�����ܸ\ X��n�ɑ�aJ&)e����O��:�������*�:��3�3�N�u�#Cj�`O�M�V�PF2�5n�+"·����������u���b���h1�����7���#`�i������9�����S��D�-d��R��S���"<��+*2L\�0��!ش�>ω�\h�V�ܐ.��d?��0y���z�%���9]����U�`��ꥤm�X��NdM��(=]27�,^�'���]%X��x����# "�EiK�n�����,ײ|rt���E4��c2�P(&'���Hz��!��a��F����K��璁mZf�8}h������B�^�H{ΙO!�PzCV� �QM̹�|��*��*�X�jH�4�K�9Q�d\���)vyaԹ�����<���]Eu�H�Zo<���sw֘�j'��*g�Ų]����$:�X��7%`�S��ھKQȯ����Ƥs���L�SW�u�+�{*VKgR�N���=�z{8����Yw�!�Ҁ��{� ,~�!��:+ξ���H_r 5�[c�H�3M ��=��B��u�J���O���7_\�曑2��jz���uٖoa���� ���sa���b`��m]���� �츭�k"(v���U�ƨ�7y6���ss�?W�֟���;�����֡��w���8q����T�G[%�Q5霟�or�լu� JU���n�:���A,����F��q.���=]�k-�^-���"}$t��(JW�3k����)�%H�}O���c������� ���")��P��ł�X�$Ĭ�ш��,��kc�!��~�-7J����&<�M���eI�5~��M_x��M�X�'����v^�|�v|Q��i�6*v&��d���Ҡ�<�>Y�b���Hͤt���c�0#�*qT0�Vwg&���'�B�W�OC[F�n���M���l�b�H���[�Q�_7���\�d���d���S�=���r����G.c�:����g.jr�,�q�T�&���Z ��x�:m��ҫT@g�f�ţ��<M�n��� q��z�XU<�9R���EC�����DDQhF�{ݘ�_��g"W4%��F�r.�3�1��`�QQ�����C¦]�II�����9+r: G븫֗`"�6�OKjjB��H�رwg�%����9�m��\|e�d��4ÊC���������]�����^u1c�b"b��T��, @�զ( g��^@Xv�C8Tl�L��1K��9��T��}��H�WQ�'���m1�`��-3�e�'�.�A���_R��e����̺����rB�,1��e)����G�/L�ffHp����j�[�DyB�>BHyh{�f�ե��#O�~/�ou�@r���t�u�=�U��5G����r��F`��� aA��<0��<IDU��!� �}ǂ��6��f@���?�Ǐ1NА\:? ukq��d����~d�}�c�]h�['�����5T��`�u ^�v��h/��T3���>���(8y/��4-bP^�_%��Y|��gkӷ�TI���d=1�[k2�����;�N��MR��d��Q��nS�uɉ�;�+ ��=��UԈ��PT���@�u���{Ԑ������:�=�Gm(߿i�����x��ʊ,8��j����s�w��ϗ/�Z��@e�,@[��Z�S�IL��k�u�H�����@��;0��H1/���Y �xz0kX��v�c��� �X��\����ai��d�K�K��$��7��u�Iv��?��uNē%W���C��`��� LC�Pj��ʰ�?�W>�t�4��-q��c)�;����Lr��fws��J`M���be�M{_�oXn�pu�?>��D�>�o�k!�r�֥�Q�;��D�_%���'�yun�W��@�cѵ�'Щ�����8|�����J�'��8+E�'�LTYN��QX �EV���A~&�X�YU/SL�i�e SmK�N%�_���+`*�b�Ƚw8�rޓ=�g���PO��$%>�w�����Ƴ;��@� GÎ�<v���D���cF�����i����}A���Y�a�E�&�Y��#�_p���AοQ��we}���:��+��Fߌ�Ee�^"�<��l��,'Ty�q�Յ�Q�3��8��O31��&6C�iqg�.���tm��BbV��n9�����0!Wn0 S��G��ȹP��LZ�8:@��V�I�M2�T`8v{Ԕ��j����*̃jw�0% �J�R&� o+̟�Ò���c�����V5L����a��*�����KUn����Vn�}���n*r '�6xl]90���]�]�y������s1��˹�Ή9�kQ�2%1�4 �Zg*6� �{�܌��{��\V��ET��;~G�:Uh"���l[�����4�z�z�˼���}��Sa�-���ZG{�a
Static task
static1
Behavioral task
behavioral1
Sample
881d4dad7962ce9119af68196c80c73a5bd9baf235953f5e5f6f984c9261372f.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
881d4dad7962ce9119af68196c80c73a5bd9baf235953f5e5f6f984c9261372f.exe
Resource
win10v2004-20240419-en
General
-
Target
881d4dad7962ce9119af68196c80c73a5bd9baf235953f5e5f6f984c9261372f
-
Size
2.4MB
-
MD5
3821f5b0bbb603bf93ee3ef0deff1a98
-
SHA1
18dbee8270c1ef0961b90da7742ac6f03e5065b0
-
SHA256
881d4dad7962ce9119af68196c80c73a5bd9baf235953f5e5f6f984c9261372f
-
SHA512
3d57f36ccdb60f8813b6492b70001e5e101ce719da15fc78bdaabe61f33d5b4bd74a5847cc6db8ce35f79495ed80b27377a0e6cdf0f63e1ecfa0c816495f1414
-
SSDEEP
49152:FLq2rKx0Pls8CdcpLqd9QxaGdTC5shonkbWYtB0VMQ7TbhpETLFTV7w:FVrY0Ac89+TVashO0EMgTTEThJ8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 881d4dad7962ce9119af68196c80c73a5bd9baf235953f5e5f6f984c9261372f
Files
-
881d4dad7962ce9119af68196c80c73a5bd9baf235953f5e5f6f984c9261372f.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 12KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 204KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE