]��!έ��R�+����қ��[�PᲧ��Ҋ�Y�$���6�`Ylju��ը1����=��9���`0誇�r��Yt��a�/����c�aW����ރo��q0Q�`B�hHw[���2�/�֒�/�'��C%i��\jwC��x�-p�]�,����A��K�HPە��΄e���X �KA�sc�L�Ӏ�I�`�X���4���V�U�F!ZS=����qg�;�ڔ�r/�,�F'�@�m)�r��1���{���_��~<D�.��H'��xJ�Ot���(^C��J��֡W�sס�s�W?�s����h#�ݲ�v��~3����֥mɁd�E ��'�u4�J�����o A�7=��i�IM���}fO� ЍZ���1z����� Q��O�%h��N:{��в�U*-�8a�U�&bC��{�N�\���:��,�L���X,Vec���n��s��p�'g<��a�w�;ӥ����b��a����"�g��n*aS=�_;ٯ%C(IH1��J&kӦ�Oi}��N/��bP�/��z ���{z7PQ�'|�oY��gP��4z��ٜ�Z)�^�����N�BDE �����J���Fy�-��H6QoQq(���t�R�5b��L���{I�f�'�~�aveh�maZ��m���[� ]����m2���џY!8,>�9����������<w�����������BG�zH�g�5���iKg&l��I�f�z����vA�"9��!���'"�wx6�K(��@��m�w��̄����Ey��c��C/��Z��`I���c8��WnK�K[��ۜ������03�Ӫ�̀--�'?��a�~CF֥O,����(<� ��:!�>� ����!%�m��͕�Z���6�^��o�otNJ�ݟv����(����b�Ւ� �?�4Kk��Q����LQ���`��6��=v&T���џMJ�6���R�o~����ַ=�S]�?E�wY�n�mYL3��;gX��_�5Xa��Gx�t�,��|a.�8&����c���lPx�V�����E�zK��� '�%X�8�Eq�����6I ��A����cmg��/j�L��cX� 9�����ܝ�2�w6x����#��9��C{��5|�6m�~��: �3�|�,���u��Z��EDFG�nA�Fxq�`����ό"�+�#g�bS��7���p,���M#�N;���!�_(��O96Q��*8}X+Ǭ�G��� ��e�pE�9m����}Ϻi���<�������*xp���M���0�+Ҍ[��x�����ur3��d~|�J�L�����0�X�D\'1o8�ԛ����*�����qiF���Ixz�Km+粐^�&Q�s��U�V�<x�$l|K�q�(�. �2r�3�#h�Lt~�ke����;7Z���0�N��9�D�OD�yb�����u�JaLh��%9;H�?H��n~�����CE����%��o��=`��Ϸvθ*bH��=e$�?���E����a���z��cv���Ӥ�1j8����'��",M;�J��uOx@�F���Z�5�7�Yp��߃n)���}T�09���Q���#.U��47_Zc��]}�Ԃ�q U��y��@ms�� 5A-�z�F��$J@�_����B��u�DH?ti�?/�)�N�8Â��F�њ�>�:� @3u?TpO�e��E��̮�(x�L|�������: ���������J�9�1� ��m*�+V9xJ?��������c�3*��V/>!IarΆރK�?]d�\�vH�A�4�r"�>��)r�=�����6�ţ��&~3q0'�1ڿ��*�V��\u%8)��ҽ��Ln��ַ<�ʹY�����]�~�l� "z�tamcsW����}��U�������/dLO����`|�6=RU�[�����(�1IhHL>�)��Y�E��X�:���wd�R�y��)�4Bi�*v�ƣ)���a��Q���䬔P����+J����4IIJ:�H��+p��mض�<��_�;�O�;�����d���q�w^R�L�.��t=W(\db(-4�����h�%��nG��g>�y�9v������'U����?T- ��%�g���'�Ƃ::��;�����+T�� �ST*�w�De˷��*_Ÿ��mw�qL�T~_p ��W;�VH�����L�>��{p�� 6=յV,�lO�z�a�qk�*�Ѳ�� 9u��+�m��k��Ko��㯪���2C�F�0�d(�R?hƕF]Z��x��V:xH]g�t��W �/��p�J�����w����yZ�n��0V��+�(�$���?�>�Y�Ҕ+ؒ��_����W�Q �����G�!O�����I�'�!s�2�����s�)�4� ����'��ЭUd���L�x/qeŞ�붰�Ӳ1T簿��a���F(p�T� K�6}����,w��Tq��}��wpsݴ0�9�R�c��O�:�q� ���T�2�y��_�~�aP�Lڭ��c^z��v���O߭Ā��{��r([˪(��Ff�Hrr��,@�V$�Xs����*��!d*QJ�TӠ�U0���Z�|�J�2�UT�5��j�-�r�����aB�|��-�E�����{����>�%:Ů�۞�Þ�K������өB� .z R�:?�b@��dǙ��EŪ�_��e��tŷh<4!�S�[��LjǭH�d�����Zv"�#��������,*$�N}���B�M���t7�Lm[��IqRιH� �usCY�g<l.�- �J��E� ��2( Q�Z�2������'A}�uq[X�F������' �_��F^C��,?�.�� 0�h!�����kIg��h-�o�ᬿ����O(G8O�j��LD�&��UW�B�� �9�?�C$k��;��M-���}�Qa�@�1L|����-B�%E ��ĸ��7��:?,�dv�v��d0�9����5q0�?��S������H �w�!̜A��Q0�����L7-� EAդ��[�����O�RY�ު[�����y�;���/�L��y����j}j��6���7w�k���������N�s3z%o 2 ؏���GPn��3ǐ|�ti60J�����k���WB�+����;��f~ѵ����&;�H rɍ�K���n6�ݐ�;P�q��ϵ]�Tb����k/tf��������-C�(0zZ�aQ��+X��ናRT�e�m�����ix'��We��<�ŭ+LZ��e��(d5����;�(���1�<� �f�Y<�*�����%�� �/������㜾����<��[8�@��hK1
Static task
static1
Behavioral task
behavioral1
Sample
ffc2f5a450d08085a70f1c93187b4d23a807287052954ebe333aff74a738a0ff.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ffc2f5a450d08085a70f1c93187b4d23a807287052954ebe333aff74a738a0ff.exe
Resource
win10-20240404-en
General
-
Target
ffc2f5a450d08085a70f1c93187b4d23a807287052954ebe333aff74a738a0ff
-
Size
3.1MB
-
MD5
d4c024714f86d463927ac67a85d2993d
-
SHA1
0ff127ab11204cbe3bd94d1f389a0f741f374cdc
-
SHA256
ffc2f5a450d08085a70f1c93187b4d23a807287052954ebe333aff74a738a0ff
-
SHA512
5d1062ee5d5d2182644d5c05c53c2e374689ac6f4f32b6342f08b69a962c30b78e1a5f12b2ebe6d990cb25259401ae2a7aa3b2dde36ed9285f783bfc4fe7f558
-
SSDEEP
49152:VD0+ufUPr0tJBoDkUPYcWDOC+R/1Hr0/pQNPwG4s6QXiAVIzvsO6Lim8xpWf:VDJ1+gBPzWDsNAGPf4mXQkjf4Wf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ffc2f5a450d08085a70f1c93187b4d23a807287052954ebe333aff74a738a0ff
Files
-
ffc2f5a450d08085a70f1c93187b4d23a807287052954ebe333aff74a738a0ff.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 586KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE