J1��I��9��rX��ɪߖC�#Y0�Y�ؤA`#}i59����������|�B�ފc�8 �����x�T��`��i��������d�mq� L5r�r�P�jD=��+�ӡΑXg)HR��?ښ?�I�D���L�({8����Ҽrb�����z��U�w����5)^OՐ2�6�+]fW-;�@>j��6>�����j[�n��P%J��m�&֎WF��7.m�{z�~t+�)�r��������j�A�]�A����/�o�no����X���ػ�m���cw4���� ]���r����$$O���[+���0�� m���_&� �b��I�Ǩ�$P�˂������s��/u���K� 9����"fA�G���� �hMsGtb8�cڵ�9��3�[cG����0̯��F����Mتz��dO��n�#���n�Ñ{L�~�j+ $(Z�l�F��?Q�=��T_��a遳#�_l�*m|/���d:�U@|la��H����~Kii$���M��Ls���Åc���i´��O��Xk�_�)A�Fl��(0�ʲ�& gG�w���3�����N�QMJn&lY����/A�<c*����ν��]�_1,F��Ns�w� ���9;�;����o���㲠'�,���4�p�u�z[��I���t��gN�?��sS� ����txk�����c� aKʨQpH+�E.r�X�)�5猳���f��j�`��4$�>�˒rE|�%������������Q��1��8.��Š� ���}�ЉH�hF��W3e�OBj��p�ݸ"lp\�~�#������EV�@$.LՂ��wܼ��'��������5|c@�պ�#�Ѻ��{�����}��]����_��-/�\6��I:@�����o��rY-��542����rC9�HO���0���T�2a�k6SW�; �J������rK�y44�3�R���3]OU�ގ���D�r�[Z��UQ���c3"H,]A��2�B={��]ˇ�"ދF ��1͚� �:��f>����Jt�^wVDyk� ����.��l#0�Lg�D����w@Y[ ��.蹁�H��"}��c��X5Ş�f$���Tp7�2!�d����6j�x����Eʧ���fPVL��G�+��J����G�EPmڌ����`&5�J>�;�k�4�L��9?zq,�̨����B��K��ѽ�~%M[����Y:CK��Q �x�aڇe=�lqc&vH�<���y@3Z�N#;�ߠdx�@�ε��,d/�$|ZR?|�7���;���b���,n���Z�;$&ZI�n�Y1&�hؤE\0e=��,h��R/�S�6� �S���V�C/�Nj�U�U6��iT�[e�y�v�Ѿ�CvoS��,2�2�3��@Ѳ%���5��#v=�@�B���6��N�q飳XBѕ �Q �"U/�LP�91��]�aY��#�H�n+��(L���q�> �'�@Z�Oc���l�l�^�0� eYg+�Z�I�,�R�1�Y�����މ����cU k�1$s�6�HP ��� C���Oy������@$��y�q���09�qfq��a�J 2yS5B��P�(��i���p.K���E"��� ���=y�۷�y��0�.?q~��!��?Al�>���Iv�j���WO@���ТoR)��XV�I3#��W��A<�1o�2g;<��4�29��`#!3�k$ �>�J�[��\z88l���"O��Bm � � ��j�]��#���,��-�l����5 �_��*R���ҍ���s؞f�Ch�X\C�I�����.���B{-��ӿ=�����z9����b��J���{�q̳R��*��c��{��-G��~PT�9S�tu=��{�K�l%o:�F��}kf�O_���/f��m��U����c�� ��b5��Hމq-2�X��s�\&�x�:j�"��+z��Dz��&/��t3��1id�a�]�9���x�X 2���-Bx���*f��.K�����gi�~�.��KX��YfH*��CV)�Vaz�\{���n:��s�pE���� t��~���=N*r4����9̖a��~�m�����M"E�����:$nV���\o�hԳ ^?��-�WV��R��FVu��Rb{�D w�r�]�S�:�)��=����1x��}�5��]*fC;a��l-�iA�z��g�@?%o���d!�W�"]�p� �^�j&I���X��m�w�E0U�V8��&%�����yB�D̙a���NP�F���,B�m��Z���Q ���ҳ*C�"ܦr���̹8��"ۏں�?e� F%>���S*�^��w2k�^���5/�x��ϱ���(�:��ܳ���k9�|���-����`1M C��Ɓ�G& t��c,��K�F�l���e<�C 4~-M��-($���CP��za�|r��3W��S��d�<��]�0��พ���G�d:��8��p������a��:�b�-�)͙��Ui��i�x�S�rc��ƣ�.�jF"�᱐G�5�)3&�4)Qeʵ�����uq�|g�zL�^+c�6� ���:�Ϭ ǒ�����p�4�}�8�JoG6S��e�" ���&�9oHg��Ȉ�=�:x8�� Ƭ�Z���EV@�J�Iᆗ���I�M9�a���L������8?�Z�K�N���3˪D�\X���jJ�w.�V��2���A����6�6I�SP=�1,cP��8����OԠ�i����#��eE�¸K@�>��<\�Wqy�=xP[����� Tj���'ؔ<�[~�1��lZ |�Q��8\|C��T��O�6���U�&j����X[Bq�%������k3�8'�;��c!��9o-$��#�v��ޫ�>�����nAp#IUiV�[�AcI`A8f��>���Z�Q�sx٥���vt��S�hp�h�f� Q�_�=u�*,$\%�+L_�sz�/�E�ha��Z���vW��nw����C�z�czaA*z��u%�Z��s������l���;�Ö�� _=0*4 �P��g츌�̟ �������*j�A��F&ŻI{w�܆{�g�%E�B�o)�/�O���i��l�<&%w92c=j.tЮ�"�����z��1A�hy������`���%W.�� Ď�1��À��$�U���{������3�V�m;����l,Y�F�ы�.]���#� w˷�|���G�D�q+�`��d9\f�ҫToՍzG��c���R����(����{�5>#��{�_:5g4�����g�!b�#jn�����2�:����,�~t�6#w�� �@v�$+Җ�*��#���0n̩� 8���U�����h&A��WC���'�w�P������S"���h�̶?�+Lp��LB��^j�.���׃Ū�O�-�Ŵ��~�Oɮ�M��Z^������`�ψ��R���5*��K�=�p�>��$ZCdlr�QǼ�\c��+��P}�"�
Static task
static1
Behavioral task
behavioral1
Sample
d1aa79e5bea9e90188f52461fabd2a87c499ae9e7ae0406ccd41a3d8cf3e7124.exe
Resource
win10v2004-20240419-en
General
-
Target
d1aa79e5bea9e90188f52461fabd2a87c499ae9e7ae0406ccd41a3d8cf3e7124
-
Size
3.1MB
-
MD5
08b36bce9bcb36649bd921b99c44d03c
-
SHA1
6bef1e5a55c79a5ea591cd725d96cc3cfc60a3b0
-
SHA256
d1aa79e5bea9e90188f52461fabd2a87c499ae9e7ae0406ccd41a3d8cf3e7124
-
SHA512
8805820f99e09635c24acdefe845d8568b3cfe0d5b8d5b32a576e69b94c587a89066047c30f04e4bbf31c7ead357b693e5e6d2a241e849eff9f951e36ba7a3be
-
SSDEEP
98304:ePg3WqsqYHlvtybE24hP6GF706XGjrt3cp8:8Lxlvtyb4IGh06WA8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d1aa79e5bea9e90188f52461fabd2a87c499ae9e7ae0406ccd41a3d8cf3e7124
Files
-
d1aa79e5bea9e90188f52461fabd2a87c499ae9e7ae0406ccd41a3d8cf3e7124.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 585KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE