����dZY�V[K�W�o��c�s�r� ����P���:Bk�N���= �.-C2��l �_ST��"��m/�R�o����.L���hJSTx�<��Qۓ;Mg`�C�Q먟�@�p�#�*��lJ��7zN��j�?����a(S� �U1CU� _-�6S��Bu!Ϲ�p|dh��������kl0����H:�G�`z��o>((@�$Ѡ���!yi�UW�� ŐG%<�\Rv?�Hbo��'�� ɤߺ 5��HV)�Jޮ��E��ב�U4���y��F�� �ک�<�l�"�|���[�$�-9^{��̥S�˻�S7�ʀ�pMYP�='}Hz`����4%*��x`���T�f���m"����U�K�"��uP1�����]Ľ�F����tкˣ�7� Lq�ֆ9~���\�gj���:��c7w��Ș��ے����@W���#+��W��}��푞�&TD�� ��8�X,~7�f�氷 ����R�*��@�6�B���)�L| 1��$%ژ��wI��H�<I1?,gU�٦��%�e���KI��'���eGv^���k� �]F{,r� r :9���ޅ*?�"�W����g���N���`��:o51�F����7q?W% $ J݆��h6�I-�I�3S^,��5���1�L���VMR�upE�.��UD�vy�ԍ�|aN#�H$M'/v�&_�� F�Q�����l�ނ%������3�ҽ�����_�V���"�����B�8����&��s�eݤ%-���-��C��3jCv��I|�!�TϾ����[8~�&@�4A e����=�|N��WE��{�Oep�2x��3/��>Kw�`=�s G(x*�\�U�*8kpO�f7�ï���v��p���1�;2��'$�����h�=��L�]��W�� ge�����v���(.^�w,_����� Kf�@����(7� �QF��ceؤ�%c���@{��N��jby�/mN�Ѯ7���\@>�;�P<�L5�\y~��X{�yw�#��������������Z��<�1��YV���"�R���U�R��� uv���R�mz���9$h�����¯ѵm_�R�2E^��������ĩH$�u�U����Y���[G�w�e�[���ƓU5"%x4�<� lT�,�����1��c�/ZU�R��dpZ�N�ji�R8"P ��� Sm�"�{���d�q�T��SE�i�K��yi��u���+�&>����]�}"�T u��#U��08++�`�&�(�l �Ϭ��W������l4�c��o���:VFw�F����%�,� cpI~��1Uo}���U ���?��~6�`#OT�o��u��Q���#X9�����gJ��|���)����Ѕ ��E�Am4X[}�q����P!��ћIb�0V�)�Q�nƲ�"p�<�檐 ��ؘ�x ���l�n����@�$�"h����0ˠx�Tx�#��,%&�yL�׀�]t]"�40�Zb0�HLZ�[K߮uQ}�o�7�9u���q��6 Q�.kb�Lbb�Sن�^��}(�6i<�dDv87���,�+�{��ʽC|����}_�M H��'��C���=��F˧d���{�� �XG��<�2@u�+��>��Z�%��̭��Цc�ىu_�V�+�"����s�,����AL�7"���]�;�]k�p�*��CC���{��n� ���1�9����Z�^jӵ��yza�m�g��i�n�K����0�H4�i��K�_4��~�6Y�s��uےQ}¾z�x������_��J���N��~h�1�±�Ҵ.�zz�&�,����]�D�.��G��_���<e)��jAĴ�s�~��H���}��~rл��M(:O�v��BWO1����;�at2W���ە���-Df(65��F�@#Y���2�o������le��u�w ~�e����q^c�P��<�i��[�`��"��iF�7�x_�'�:@��KK�>�����L��EIDxz�F4%A* ��ȷ�Ұ|�O#>»�r�c/�cGJ�Ň�19ZL��J6��av��,t���yF���uE���%R���krG���\��"�"�a��K��P�-��&؇�W�6��!4�u���D��W��H��m���O=6��\A�L�����1Xp�rP��ٞU����Q]7��ےI���e�N�f����3z��������eI��ⵖ��8[P��;�=�ז�q�S�7��*�x����hs�_H ��W��b,#����t*�Ah#��h�P`��~�� �]+��7���z��e�f�����|�.tu��Cj���/�,tu�u�uє��W�6Ɲ�2���/���i�w��f�Z�y���f]�WC�u��>� &K�+������G'��A1������a��Sm��nT���"?�����JA�nW�!���/ߠh֝�����3�e�)TPosR��_C�m̸�.8[�����1i���m�ͭ1�*�E���*���������#�[ � ���(�ng}��vM�u���z�1���l�[ζ%�����a)5�v��[c| �ta:p����p:>/�T ��f�3��0�{z٩�8��g��.X����RH�Ń�^n:ʝG���n�)�ZQo���c�_����� m��up5n$j?tu+��C�O����@�6��Pn�<�ꂑ�(ͦ~���p�:ybͮk�ow�"�i�������&ƺnZ��!]Mj�=b��]��qC�c��'m���掎�=?qDI�p���*��Օ(�;�Æ��P�ζ� Tfv���������9e"ԯ�� 3����ϲ��7+4���F��Ě���U����ط �����(kH�1w����ߴ�k<'�գ*� �����6i-l�%��M��ɜ.X=��&W��Q��Nu8���-7�����q������s� @�J�`;��� �#�"���X�<��ư�E�/[D�n�`N(�2r8��ɻ*9���Z>YA\N��xt�1��JJ�'��7������t�7��2������*��¯Ap�49��K��֟L���.�J`���u��j�w����H ��������~��U���<' &�8���<���$*σ*��o��<Uu�x} N�U�]�0�\�y8�@"ϸL���$�iT̯a{���/��O����+~���=��/�Ei��9%�8Dj0%VHʮz���������C-�����f|J�Ns�7Kb�i=�ΫuF4 Z�e�<�Oyb��x���$�H�2��7q�T!YQ��'n��������u1R��ڛe�2��/e��1�j���*rp�_�Y3�i�z�ب��&�PJG�� ��c�נu�U��9�����1�)�C�Z�"��~���v�0<L�̥�p��,�ݿ�I�%����,�(��c+����N9n�P�'Z�4 捅ɤ�C� Q��C=ίoe�vfA'�'����T�P�TiN��Y=W�_OLk��m3��Ev��^6�E̪-��G��q#�|�O���*a�^�U\�/�����0�\����H��� n���{Ls�A����^�+���� Z�A)�)��ޝ����ZC�(L]6�4���tZ�����k�%�D�]��)�"F��x�kD�>�HN�q�P|. y���Ҕ�1c%�o� ǖ�9!0]�F��7�tF-*�|r�AG�]f���'C����p�1�����u(�n[��R�oɵ�P�8�8
Static task
static1
Behavioral task
behavioral1
Sample
b59b771242b295cbd93375820b7af7e4e3a609ab537bf64cabb5c6931d189d72.exe
Resource
win10v2004-20240419-en
General
-
Target
b59b771242b295cbd93375820b7af7e4e3a609ab537bf64cabb5c6931d189d72
-
Size
3.0MB
-
MD5
494455c0acdb000784b5e530dbb6ae16
-
SHA1
cd05fe6fe8e07c9beaccaefbb7a8b75c6777749d
-
SHA256
b59b771242b295cbd93375820b7af7e4e3a609ab537bf64cabb5c6931d189d72
-
SHA512
a34423503b13f6d978071da03adef1644408b551a4049bce1f2eb187a2fa5d7feb329a81f560de718ef8ff608a299e156fbe8feb6f67e55b941371644965ac69
-
SSDEEP
98304:DdmdNL69a3db8UmgR0J0pRvzwuzRCcUj0QBz:pmH6ENb8dgR0JiREupUjVB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b59b771242b295cbd93375820b7af7e4e3a609ab537bf64cabb5c6931d189d72
Files
-
b59b771242b295cbd93375820b7af7e4e3a609ab537bf64cabb5c6931d189d72.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 585KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE