�9��R+i^�u��019X�&J.l�f���f���,�����fR~��9������/ @0l7ػ�&�r����P�I���=��Ӎ�N������z���ۍrk���-�C�������vi�|��g�zg�~��#��g*������z^���`�O��JY6A�p 'fo�P4�@��P$���§��u�T;=��0WLY.��Fa�#p�� ه\~$��A��������$�c��G�_05�l� $�����n�W��Њ��@���8:�Ys�[<ZԱ��4~��)�6p�r(������1N�7�� �����ѷ&b�R�죇)\�멿�/��u O��yjN �'Į���� w`��UJl(�$��U����Vcz8�G�� ��d�O82� �(��b�ڼ�5^��a��_��2P4�~̿ P��f�����1��d�xCg����V#t���M{�� �R�-K�F��t,�?���Odz�nF�������/� E��Vx*�̔��I��ݥG�I'���8���7�H-�� �o�t0��n�A��6����OVT��Y�'m1�<�MCF4��m]uy�M�M4N�����^�����wd��g�tE�#��+0�%��0><�m^G��g%�)+��澍8������I�}(n�T!zSL �۴��|����/m. ��5<�����{"�0��%�m�4��m���Ĝ.A(s�4Xo�l�,�8�Xn#7�eR���)�Z�Ft���I�>���c�8-I���$��8+��A�����[�m�����Υ���NfU�."p,��G�7-�9�t�~��N�F.P����N���xsB��A�*ݥ�|1�Jz���������8 �7�&�W?���āFm0�;C��==��]�O}#ORC�u��^�Y��U_bZ �oO����"��xZl%����飼���XH5l �(J�N��)B���s(ϟuvA�}��:�_4u'��tE�uP.��M��U�5�R�(_�A��H�X��$�ɀb�P��"ѕŲvܴpxw$���ݕe��p�I�=Z)FS`��t�_6g98�-^���+n��&!�SKS����`�:ُ�P�o,�q?��p��ZsG$0�} Q�ݡ[$��H�ԋ�a�[�N5{���!����������������ع���K:��oj�)q���p�:��4]_Q�VR�$�7��Y�5���j����:XV��zz�=w����� F �>�=����ou��Ӕ_����E�Q���.֦:ׁsDo����U?��⎯�E����ś����1j��=�A�D�5o�?�ޙ �U[aM�:g�=(^}��3� � @����G)�����A�>2~�l_vl�} ���Y77Uc�Hu"�_���4�z�d;�n"a��P�zٴL�V�~����?(�#�8鑠G�h���8:�I�I�K�.P�&q�Y.�-a\����L_�* �E~X���Ɲ��R��yua.��飿�����N�ߝUa���]��Lp�V�u��S����%ɇ[�ob'�S5y���A�B��M����m]ԏ�4�M���-v�I�r�G�������D.���D�f�;�����b%��������PF�� ���Ѡ�t���;��9���D�k���@�z;�:��t�0ڸ���Pz��wY͕�^'�R(���mf��o��hu��|1�H㊼)-��d�~��#o�K݊砡yV�M���3 �9x'�l����ѧ���ds��}�� ���v(���̄?�* ݔ`�Ӆv\{m�p�����c��.���Ɗ��z�l�cRL�fWI��-���ʼn�<��o\����{z��so����c ��5 �/�^���D]i� �N����4�ה%s-�Tw��"J��Ќ[�=<�G*�%fu�\�3��_:�';Ksv �nf�i�)�HwDL��Gn�E�kN��r:����u��/lG��@K|�ZD�.��`�)��r1q���+�kR���X�,]z(�K4� �a��\@).�Q��bM��=����' @�����[��͊A�oe����ͥ:����� ��G��������}�AyL:-γ�v*�������PvP��*�]��L�p�݈�3dHz#���wW��>�7�s5⻯ �]j��W��4�O��� �M�STӲ*A�.���㒻z:c�����Pյ����|Q�� 6��8a^��ó�0��NK�&�B �T�?E���t|�ה�� �U�1؞�&���gl+�}0�D�hI���ˠ���JE��9`�X�� ��ŧ�k:�(�^�6V���a���4��D�ԍ��7�0�B��@,w��w CD��>�i �?+$n���6�O,ح�Da���7�7��˜$tz�[c=ٷL�\�mh O�[���O�a_�r۱�լw�[ ��������I�ǎ�b���\I�$|g�Q�?�W^�S9G&`WP��ܐ��[�{�N�WQe�7��~�),������(h��Ċ����!J<��J����|[��ܐܳq�^�C&�ދÇX�Ck^h����ȗUf���eF�|�Zȭi#v����V]���qx����T�%���=%ynf��oܩ����Ӿ�rý-*Z.0�$���5ʞ���}ä�~�%s���� ���zE����/���,�/���+ ���;3Q�C��ݯ�s,�]4U%�C�sG��hB�h70�w�7h]��ʸ��Ż��M�DO���o�5�ة}O�?m�x��V��+E.{�ၺ��$���s �0�یD*��G�Kl�ujIv�z�GM�V�w�OM���'�mQ���(.qMo9��^�[�#4��=�;�d�=J{N�_�����ڳ�D�Z���9S� O��|}㛷��j3MI�7�ԋ�5�Y%����������32�U.�2�j#�e>e52�p0�n1=�`��K'W��t�eX��w>"��y��0�v%X�%�|�� ~y ��Yb&mrP_ban��b��9�����Q������{q�*=�Ѿ1j��7X9�T^���fd���kO72ŌC$�sd�"!�$��Po聀Q����ߙҮk��<:���½���������w͚�����N����{� �U�������x�t���P5��2U���d p�E초r.؟Q�z�d�Uw��sH�{���^��44!1�9��b!�m�����%t���@Rm�\��z��h��c����Vs�xqU`Ug�~�75 ]��c`�9����� ���S0��m4�Ϳ8����qU�ߖ� �b�N�/��A1Mm��SW8��9IЯ#��C��F =�9O[+���-h\�����q��u�)kg��l��k� ��q�?�@J��N�i���U�2�a���|�k��$�A ���$�nsn-,o� � ��:����B��� �����~�oV�`�u�}���r�3/�C{߇+;]�T�$���W�(8l��5�[���q���լ�<-�����K$�>�y�h�rEt����'\�|E���q �OW��>����Xw��/�~M��u ���D��+����E���NN]�u��Ȼ��3#�>�_���&��xy�n��P��C��JN�o�nY�C��,uX�.��ms��t��4��Vf2���M�T/�(���-zX������ �[\I�5{c�A�N���B��F2�����X,:���!���<�s��q�|��N�^#�� K�F�x^#�-��vG��5�f��B�X@j)8i3�m۩��Nܭ�����;[sUx�N�,�^@��ha(�d6X�j}J� kǾ�ŮO��
Static task
static1
Behavioral task
behavioral1
Sample
0b8fda39a466ec5c8752213ff51bc9a500712fc2434392def0a1436345704e21.exe
Resource
win10v2004-20240226-en
General
-
Target
0b8fda39a466ec5c8752213ff51bc9a500712fc2434392def0a1436345704e21
-
Size
3.1MB
-
MD5
ceccad962ed08261e8434d9fc8610dd3
-
SHA1
d3d8be606293c5f712cc0c9fd7e516b00f26f635
-
SHA256
0b8fda39a466ec5c8752213ff51bc9a500712fc2434392def0a1436345704e21
-
SHA512
a5d6ac0eb136319977bcf480965f9fad86e32c3182b9728041b6a390076ac3f6db7f48d9c03aa92a19c334a05e41625d72f822a41531a120ff783591f4f63c83
-
SSDEEP
49152:IIo0PTHn/8NOH+NnnM+DkJfGB22NMZMIKbbq8XZnR0FMDvWM0HCKaQ9MrG4losmP:9D/8NOedn5DySzIKCw5RlvKHt9My4M
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b8fda39a466ec5c8752213ff51bc9a500712fc2434392def0a1436345704e21
Files
-
0b8fda39a466ec5c8752213ff51bc9a500712fc2434392def0a1436345704e21.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 586KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE