zR#��� ��Cb�9Z�sWo�VKv;�"�9���5�6O������d��jB�&�oyG��7�N�^Wf��'��h�7Ycr�;���[s��:5H�O����8+������j¬�׳�U�Z>�v�H� ^��E[?'nD�Y��X��Y���O8H���u�/3�`E%��jJp2��c�J��6U)�]E�{66X��2���s��ZIu�'f2~6~w�>:/�2��G�k��,�xA��g��������T�T���S�@b�9 c����(v!�vdN�˟ �!�rD�o0�y����ol�_�8Iwl��74Z���Qf�Zhm�t�#J}�B��*�Y��*Ō��&T^%�o�7���,�8�����B�ʭuˌ �!�M�xa��Z�{�b*��E���#���xX������4���ت�O�M�2���ZL�[����� Ŏ���oi��=p��u"�( )#l�|������,���������Փ�9`���"꺯K=��7��lUZ,<Js������u�m�A��<�~�J���1����D>�=�2��i��P#�¼|�_�$��6��z�1�����yC[�C�0�z���"C�7����rL�K�~�U3�;��'m�9�]4ӆ���%C���|�B�G�0?����vH^��ԘE��֏�a-��g��i$�8#���V��8���T��~���Mő�WE�KK��*��.2�4��T4�#,�-��y+���I�"�8�p��.d �����g':Y�=l����<����Jx�f���-e���#��B��MfJ�j~�8<�%�i�<���i�d�P9�J���o���^L]}����7�Y��Xc�:�����"���N-)Ҝ!��Y��Ӿ�>L�M�ri�;�v� ߋ�����䠅*��Ŀ��WH�N���qu���q_Q�Ո�=��sX1ߦ����Y��紲W���0ϯx8���^N3��D@�86�����oM�b��̄����4��(��G�B�o��������Z�Tt~᧮��V����� ���$I����ђ\�8&7�����<�7�A�T�E�bU�e�}�KJ;>w1Mm���T2NA��Cv^Ɠ���"�nk�]ٓ�ʞ{$��uG)��絭��e��iE������)|[k*|M�7[9��#��6#��X-����9���J���p�j�2�o,�#Ľ��&��P>:WT�@R����=�ą���%*�{'x�ˌa��a�#n��|E`K`H���JҮ�I9�N��e>bSEB+�͊0,�埛F�8|AXq�7���FE�鱓��߽���$�{���B�E�����a�pr��N�4�nA�����H�����:�AE��Hz<&�����-��=.^�3�4�Fe>Q�$ӡ���?�t���bE��Ъ@!����kO� ���n�~�������Z�n?��f�.� �S����t�3CS���f;J%�M�unz��44�����F�F]Ҝ"�s�f`aѻ �w|�6��$<B#�9���o�5�?0?,LǗhG�2;V8�bl���a��2���ׯ��cf������}}��Nk�A�"���m�U����z�����p�2$����"������*�,�R�Qy�U�Ov��.`�N��X��*Y�U�~��.��Bs���84�9����k���f���#���/Q�[� ,�'\CD�? VP��,efP�=s���� U?a�����鑿�����6����-�P'���v��h�b�-t8�~���r��Ґ� ��,�Hk�̓�V��J/x��a�]�~���S���"�߲�b� (ͮ��>���.�J��8Y�������&�z#�B3Џ� Q\��?��GE�OwNUȝ�ܺ7 ��x����R�^�(���<�����(x�d��K���u4��B �Q���������^�ի�+�4T9MI�:`��~���Mi��/�/-���Z�m���j��(g~�=W�U����ܩ������]W��+�=�[f���\���m�D�,�4��{ř���J�6"�1DM�@�D���.dHm�l��k����iI�l��7L����m �K@�.��������r���W~4����o7]���e2a�S����4S�3i1��g(n�tk��=� ���"��B�(���5k���N�-�����a��a�h�'���#���~��SY)J�<EW����z�������E��I�ge�" ��\)Z���?�q�NP�� ��Ͽ�G�Y���0����"H^�4G�Nળ�$�d ܝ"o:<V ������[����F�� �sg��P�j�R]q[*�������ח4�v�����t�/'�y����]��PmV�|������^?t�B��0E��檚� ���)����3�>�G8��=[��[F�Q��@7��Cr�����b����ZM,�:o�{���B�x�ƟGF�_��U�g����h �鬷��/����8U"�Iu��1�N6^_x9D3I`���r�P)k�i�«2mS�� �䉭OuȹiL��!H_X��T�{�� ��3kKD6(!Մ(>Qy����v�Ї�����M�j��(L+����B p,�X�ŀL_KS��H�|�`���(�+�̿�3�b��K�}���Ռ�Cﶮ�V�����V��Hh���D*��|y��13���b,nR;X���U��sO�[1��Gk��C�� ��}�%�eK�D�"Fs�X����7�3��d�����B��=�6��Ig�HRmC����e)���0(����T��x���E?ѕէZ���4~�z�h\Mw㑀{�a�! �<:�^A=����5F���Ȩ�,�槷k���sj� J ��< �:1Ү��+Z�B2�h��g�<eu;�D��G�S�4;�<"Ƀ������+`E#c�%�3��N%�� �e�DЉ[�Tr���Fby�㺙 �X�/K]�%�%LBxNc�k�ᇂ�K�J�1�d�O8-r�r����q�ڡG�]P*�L�2�S�<J_������{��|Ł��m�"�ܖIvO�!������E������J���ⵤ�t�6{ۗYpw|��5E�p���h �5��(�֣����6�m�w*��M&�Aj��4�<vޱ�2Dmje>$��jK�%y$�*Ä!��'��`�:z.ᩕ�u �#���e���Ԭ}�O��ª�N�k�� L���h�I%��_d �y��M�"%�۸Z��h����G��ADc��"tp�C�P�=�iޙJ^"��+>�&�� .;%[:��Z���!�.g��7�v�1ї_��\�����w�C��D���S�_JvJIC*�סQ�zo�D�oa�c����A]fY;���@.�x��D�z_�d2~ ����4����e��2[�4`��ի 3O_�g�oY�5@�.?̬�YX�-1�cm8{Ѷ�^f6l�Tӻ�~�:KC�6A��ma�����Ϫ�I:����ܶ�\�o���/�-g�坋�P;}���#�qf#m1!� Tʨ(0��l��c"��bėm����͕iB|+pJ7���\�t 1����Ao��K=�g��Q��zFo굲�)�)>��a����H����X6I۷&����W-�ٕ�v�o�֜A�w�*��#S��A����w��^� Xb���0���P���1���|��cF�f�<$�X(z��z����r���e��i�6\�费��t�e��Mh>��D��yj�U�jmKu��j���~�RM��2�hi
Static task
static1
Behavioral task
behavioral1
Sample
28ed501f1f0c617472cefeafa0268738337dabdf1fa94ef1a49cb657ae20cd5d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
28ed501f1f0c617472cefeafa0268738337dabdf1fa94ef1a49cb657ae20cd5d.exe
Resource
win10-20240404-en
General
-
Target
28ed501f1f0c617472cefeafa0268738337dabdf1fa94ef1a49cb657ae20cd5d
-
Size
3.1MB
-
MD5
2e894c40a5f0f24ee9f8b7d68f761d05
-
SHA1
fa7b64f5b01965b799ad5194d576a6fba9b13f0c
-
SHA256
28ed501f1f0c617472cefeafa0268738337dabdf1fa94ef1a49cb657ae20cd5d
-
SHA512
b8d9026a85cda56f62e3f6315906bf29851306150b8da93727426e51cb89f08b9941ab1bf86f95b43b3847517c0b82187698b606c8b3ce529255e43721366328
-
SSDEEP
49152:1ue3idERBYOSqpJH00TUlkaY8PfKbbq8XZnR0FMDvWM0HCKaQ9MrG4losm21+:gER3pJH7Y1fnKCw5RlvKHt9My4Md
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 28ed501f1f0c617472cefeafa0268738337dabdf1fa94ef1a49cb657ae20cd5d
Files
-
28ed501f1f0c617472cefeafa0268738337dabdf1fa94ef1a49cb657ae20cd5d.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 586KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE