�5��ʵ/���\�id��H��J�z��СM�"��� Z��o��.Ƀ$�u-��.d�e�Z�*�qe�/�'E�����Zqz��,]�zZ��2Hr`�5���i6T '}���h��+(��!$`��Q:�&�4.��`Y���%^��A�.�� i��g`����Z���K�:�r�X�XX�jt�n`�} �U�礦�^�=�=���H���a�����rˆ���S��4O�'� fh���(�,z��/�������� ���A������ ��D�=��"�-��u٩OHJ���D:���Kä3�_�$�����I�X�gE?�ZLr�t%�����a��4(��3�y+�;X)#$P�~#�jVF�+������t݄���7A3��Ӟ���O���јΙўz��J���C�,����;h�������ww��t��v��R���{��;!���ck{ֺ D�B�d�|�,->z�����ц,�5�[���`N��!�g$D f/��3�w�u:5�9���%KVlr���a|�1���)��؝������X����J\:�ZR���`9�����3��̴]�M'�/���^5�I>���ܩ_Ine|t�D�b��ԛ��}J��/��D�ӽg��;�=POVJ���Y��HK��Ͷ�4�=%�V��s���.��S���wԆ� =�9��s��K�>�K{f�k0���@�i�����et��h�ij��g�n'?��a�ս�� ��Pjo�E��r��*��H�#|�P�vˇ�B�L1)�5�+5Lb�ͫV������kĈ6&�^X��;��Ha����9���meGW[������5����Llj-�i�.�U1�*��rp~�);Џb��-,}$٭�&��l��O2%� ׃S��bu�c,�L�2Zޤۀ���H9� ��l�E�;��q�دAK�8ƙڇ�t*��-�>�H͉E.�k빧�a"�i��>-<A!B=S��s��O��@����HZ�Wy�@қ�Cu�1}�E�?�����W+�"���|�{Vú?�A�I���ĘRD���W�y��0Q{P-8��q���Wؒp!�ww��i����ɚzy���V5�J������%@R��S(U�DEl欕��7�1��Ql���0������l��z+T�u+g����� �Xo�WA�0EC,�b�-�҉��rޣڧXb0�/�ݯ�����w��6�?+,w�]G��5�[�S�@��� �IS*$E:,����,JΗyc���a� Z��g���w��,0�\��ɂ��N��i8�&�����b����pi�kp���U���%�����u<p4NR{���Kk��t{��܃_C�1��[� (Cy��û̫�����=�ܥ+4]���l�,,�� BUo�~�� ��v���X��ڤ��s]��tp�;�4F�l;ĭ�OP��m��������v(\�:1�~>i}D���L�,���9�y��ƛ�HCn��_���G�{9[��u��~���0Oҝp� -��.�ku]A��E-9i���~})�E/12��"<.��wh}���%�r�Aـ*N$07���������҆���@b8ި�ٟ�m�p4�~IJ]*��(-�1��3�������e܉�O�zV^�LQ i)B��v��y��3;�-�Hإ�S�Q�-��\�8g>N�$K�rmoB��6(�d!��\�*���_&��w��;�]_X�[&����܁���!��kE��,�Պ묩+�B�Q#K��ԨC1�fJ0c�lK�y�����o���yhb@����\��6��ź߰��J��eSf���/�$�)�|�1�v~��ٵ?a}�3��\�~Up���ƬɃfױ�d�u�a9�j:e�/�a������{:��"��|V�����G*-QQ�M�F��A�l�F-������b�3��?�-�=�g�w48I�j6ZC1��҅�4��~�N�l>5>�j6rs;�?Z�{v )�����.���:H�� �pe��~$i`x����v��<>�8�B�2����#N�>^��L�*��]�i"�� �K�БP<�bpd�U�F��W�]��^�}�2ٮO�1b�,���Aw���l�^E�a�ސY �+iü�b�p�vA4I��MALH��%�8����hzBBa=;0y6�!X(0��]\K�6!���Ƙҋ(8B�S�0��Փ�Ԑ>A=\�${�e��Sykf%�y����+�BjBO�?h�N��>�I��#��~#�!-�`�K��(� Կ�?��k���Hcd�O�bZ"�QM�_AdX'�uL����J�Җ�K��e�(�d�5��c(W�]�Ȝ4�������k���u�?!/\�}�������m��v�c5v�zm����(6��zT�g�-�Edwϻ��5�L�"j`�i�Bj���h��Ȏ��̝j3ݧq�3L��ِ~�PF5�_��FwQZޜ�G��k r?a��zy��ċ��%��uO�a�OD������C&7�E����*~�������m%Dw�������:��E�g��#F�Y�hb�ce��'�F����4�E74�d|���Tӗ�p��H_���7��#w;㚑�^���@�����/J���,�B�[2��ʓ*�;����� �qӿо���c�ݐ�Q�^Q�$�wB4F'=�xlF�4�9�L���p�<�t>�%���R��Ox#mJϛ��.�u<V�̴ �Ԍ���qZ�sL�JҐ�z���f���f��"@|�̊�������y�z�k�?K�ɘ���S��b���%��pD�t�3�"Ji&8�0� D�~��� ������q��?��b<��?(+`�(!RPb��QH�i ���I�'9�A�!Hma�3��y��{�����Wi���wv(2O�*43�k�$���(ua��RC ��,��7�!��wc�8���D>�Â�(N���<}�@b���� za#�[�[|��Q�m�P���r<�"��>��_�C�'����nם����:�,y��n���y�ɮA�p��x��U���U*����-ZZ�P[��v��HS v�*e��H��lp���<F�X�DZ��9EґrI�K=�x>�0�Vl^�k�C0�B��A�����&�`S��)<� ��� &��ߔ��e���!�]���fs����s5S�}�d.$��'i$�H�kFFk�t�륙^F�<��s~���3����\t;(x�I>��!i���{R܂06&==����j-_�:�Spb�2������ �z�_��|�A��?�9�V4M������ ��Rk�`0�eѨY0��x�/d%Z��ߡzD�d���ZH���E&Ȕ��6Ŕ�pї���.}n��zJ���. �0�)]M>Ҵ��[<�wph�a��"9�0J�Щ`�"��<�'c� ��Jb䱐���qgFW�y�_�p�r
Static task
static1
Behavioral task
behavioral1
Sample
5f0411f2fdc73a48e55a6314908008806e7eeceb5cd093f0cdd8bb5145b2e39a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5f0411f2fdc73a48e55a6314908008806e7eeceb5cd093f0cdd8bb5145b2e39a.exe
Resource
win10v2004-20240419-en
General
-
Target
5f0411f2fdc73a48e55a6314908008806e7eeceb5cd093f0cdd8bb5145b2e39a.exe
-
Size
19.3MB
-
MD5
0499363041b5c5b1896c112f1579e045
-
SHA1
691167a2e942e21bb4ed461a2142135a2193a94a
-
SHA256
5f0411f2fdc73a48e55a6314908008806e7eeceb5cd093f0cdd8bb5145b2e39a
-
SHA512
530ebc3a1c536f9b9abcbfc8d1714916b3285e6b71c48a8a3f4516d69cff0ab4c547800eccce6b45309d4d6023c891f55fb419ae8388fa374db78f641fb089d4
-
SSDEEP
393216:t0Xj4XpVZnUz2J1TGYwvlQwGSh1te6JEv4nMt8gRV04qu4gIXLXdDA5:OXkXpjUCJJw+v06fHq/7ru
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5f0411f2fdc73a48e55a6314908008806e7eeceb5cd093f0cdd8bb5145b2e39a.exe
Files
-
5f0411f2fdc73a48e55a6314908008806e7eeceb5cd093f0cdd8bb5145b2e39a.exe.exe windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 169KB - Virtual size: 404KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 81KB - Virtual size: 384KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 273KB - Virtual size: 83.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 18.8MB - Virtual size: 18.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE