8���� ���͜AD�����)�=y�z���n�LL�0�q�ȧD�w_Ml�ן�V����9:���-����D�ѻ/"�Я2,E���Fk���������v2���v��XI��$t��ǀoަ��ǎ½R5 �@V��u���yO�Wo@�� ������_&}3~7V��=��k�����2�z2+�V��ВD�|:�����+5�����NEQ�o��� �^iXdb��������������dİ�N瑱߬KJ�%{*�;,�����*,x��:��<��� o�g��s��"w��EJF���.�dP5�a� �x��V�,�ҳ��_Rq����m5;�E*��8�@�I��������&��,X��x��l!(k���g��U�����XVGo`���2)�v�֩J�5��$:d eh�/>R�|���:�wN=��MW\j�+"����:�D��2D�����M��~� ��Iq+OW�U���cI������L�@6& )��:�L��m��* �'�������c��,�K�ך�,�� �G�%[�� �;^ ��}b����2������s�P�4Ơ�'��tE�>m(LE n%�0 ��^�R㿶�%�ڥ�����|p��#�}�lvA �{W��m�f!�@��)c;�H���y'�pW���#���R�$[�Ap�� o q�r�(O�3�e�5DO>�Z��=1'�!����毽�^�蔫�a�$;�xȏn������l��lVQ�u6c.�����B�wQ�Ƹ>�:'�=Y�{6�rC���!�U�p�#�rq��K���-A��<�6x!�}�L�E���u6F���X�$�����1]�O��D�~�6��l��0N�r��wvn��3� �+�Ȣ1A�;Q.8�X�莳~��N��0���-�m�D}$v!;H��5_�p��>������|�<� �v�N]]u�e�N !��k�q�b�J7���&�B�$�P��'��_��K�dA�po�H8p�/�z��grcx�#$(�䀆�ؼթh�S��I�Xt�۬�=���,Wb�y��Ki�yt9�c��j'����5����RR_�9]b��A᠈�~�dq�P��W��?g-^�BK�� �u+}����>u#��q����o��A]��TY|$�+�S ����0m�RC�c~� CU��h�i=��H����h���Z�s~�-��RK��u����1�h�~�&��ӂ��&���k����Wc�����aW�g.,�w���DA���)\ ��?�&�$��L�Un'��C8�#�x>"�<j�P���:P8F�ӷ�#c�;��cp���o`h~�l�E��v�4z/�ꖅ����5�H\�"+�C�R����0>�r UNz�!��n��/���`��TW��6�~:���(aq��ם�}�J�jƿ�?��q�E ��K ����eCƒnr+E���1��߰A�a���1B5<��\(;�J�5 q��b�hB��a��v6�3��t������Nh�~��AK$�P�ӑ&5_)O)|m��(&�x�Sd�@��q�B0oxH�ju���MLj� #��L���.�DƁYe��� u�r����͉-�ʕ�Г�`���Ɂ�ɗ�<�Z5�3=�6�d]��M�s���+l���6���p6�}�D��>� Ӌ����X���DM9? ����C��*� �1�Di�g�Wn+� �q�(�4���XȦ�D !�a��?!� ��h�Y�)��� +� ��������1H�p��֤UmB�^X:�U��/��Q��%�] }�$��3l?^ο0RR_�����������):����u�Y��v��w^b���m��� '�?�@�h�w�����C JM51�1�O�����f��C�_$ ��)h�l?����` �#�B7"�����9����VJAI�?�d#��}��Z��ϯK�+��ш���j�]�P�n�=Ů����O�"$N ��ֽ!��K�N�?��GV��2���?��JM�J �E�K��a���^�ʢ� `�G�2t�sp�\��V�|�¿yQ�>�Cz$���J4��eg�в��aR>��o��pOD05[g���yW��C�����ͨO:���0�|���? Ts�����o�l_��bȍIR!�!oG~O�~gK�-Zcװ}��׳rY����rh�8�ҥ�繢,{"�� �0��w���l� �=� ��B�X�j/ݮ���J���=4�b�1D9�,�F9z ��C�����Lw�hTQ�]�H����jXew���ɘ�q;�������?��#��8�whs|�K��u��J�+C�Y;��o��P?a�#�l����-O�;D@8��8��:���٤��(��x0���,i"��_%hĊe�� H�kn��D�,�>!ɧZ�WD�no���!`�8E��M[��_����*�GNvx=:�w_q�v��Ա " �j�aեl������on�B�B��< ��f J�Zc�?Yr��Djfޅ��-+V/�29R@�̇��Ua�N^T%�� F���4�~-������f�S+���G�,�l��'<9�,�<Gj��:�O��e��p�X��MgS����=�O#�v�M����{yl�����A���Lo�l5�2Ob����|)�\�鿖L��w�X��wR�����]�}?v�?��\��@�{J㰏��>��M�'�"��ĉs^��������6 ���f"3{E�oL2����ŧ|WUNS�_ߕ�9)��F��j30���zTuo':i擀�� �J7v7����%2m�}|�;/�J;I��1���� 8�����#J˽��6��E�8L~����!E�w|ͅ�(W�H�c����x9k���wW{-��Z���|���f�q��֔���uO r0�O�s�Q�]�ⷖ%vwr.��ғg�� Τ#<�/Q�v�K��4��#���R���� t>;�6�ԾQ�<��l:�U|e3���R�vpӡlWJL���'�g�Ŧu%"��&h*���f�A�E�+�Y��~�s�U�a�c���u�c)�>��&�Z%������m��xB����uI��ӲڷZ�^�_����̄��ק��;�mr��6�!C�:��w-���7�v��#���螮 ���ꥄQ�y+�/��&��Ӄ�:M<w��mR�Cn���Gؖ+����P��!D��F���٤��]\?+�Y�� �:��埨�z�H��)���)�D�ZA|� ��R���(�nUx���ZRcæ@縎Y~vq��u��i����-uZO��.�cY��|���T�/#>ƚ��}]}褾j}�[�i�r�7)��J���ئk�y�ܥ���Bu���X�z~f�zQ��PՑ�bx2S���3��S���8U�<��Y�Ҍq~ �R���U:n�n2t!]�?A���X�,�'eF��؍�{���"���0����*��kOTd�d��n�!-���?���O�1$|�����h�`8W���ꄂO�~o�됓����P�2�P� J>@kEa����/���U�jb���!M._6?&+���,J�c.ä����sEg�\��}6�i)��|�is�O�V f 9�Ł�u���v�iOTZ=}���a1R��c�D�;8�S%\�m��|�0UdX
Static task
static1
Behavioral task
behavioral1
Sample
1e93a9c3971ac64a9495518f191c848c8b42f39f488bb742b8bea3b084e8b99f.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1e93a9c3971ac64a9495518f191c848c8b42f39f488bb742b8bea3b084e8b99f.exe
Resource
win10v2004-20240426-en
General
-
Target
1e93a9c3971ac64a9495518f191c848c8b42f39f488bb742b8bea3b084e8b99f
-
Size
5.1MB
-
MD5
af9ac86ad07046746e0af51018f53bd7
-
SHA1
0cbf63e2f5c55851c434520aae1bc9a06fa77a62
-
SHA256
1e93a9c3971ac64a9495518f191c848c8b42f39f488bb742b8bea3b084e8b99f
-
SHA512
23222ef0384b82686419a95faf55afcbbcab7d7a29a23399d7c647283c58c28261db2ced81a97cc762dd910d37da0c129d52e25e148dda4e75766ad73d14daef
-
SSDEEP
98304:MVQx+9CtaD8G/WIZzWNSghDZ+f1AvNgaPbnVQx+9CtaD8G/WIZzWNSghDZ+f1AvW:qX8G/WIZS8ghNU4NgMVX8G/WIZS8ghNS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1e93a9c3971ac64a9495518f191c848c8b42f39f488bb742b8bea3b084e8b99f
Files
-
1e93a9c3971ac64a9495518f191c848c8b42f39f488bb742b8bea3b084e8b99f.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 20KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE