�5�|kĀ0 �!��)�7ZHZǨ�g�7�6����w�;�hȀ ���%�綶d.�NX���Y��B96��6ezҗz��t͟��˳��\6Y�Z��*���0Y;�CT����ar���o��n��TH�#���vG�h�E�0�9U�a�x� �"�����d��2�68h�Zc��? /�� &��ƳZ65f^�� %����w�D�M��u�@ꃕk|�g�9�o�,������-i"(A.��_eCak��/��j1�;����Q�`eki���B;gAQqڮ-��fPG��/ܢ���J���y�$� z�RLPV~����z�o=�l�W}�py��*�f����cL8��b���i$���U��&Ł.ݡ2�Z��,X��]h-�m�Ǧ������T{=<�fp�|ZN�9�����eN�p:G#��g���y�ƶ��۱�#������k�������(����xdg���������}���� ��y�s�٦#L���K�����`�e�_}�yM 7����H�,���K�ڢ���p�������Wr��#Y���A��)��CW����W!���+X��ߦ3Bqri�mD�S�e��Z&٣Kث���(.�}�MsB��<~�6����ÙÊ��N��Tt��y�s��]��zIeTVq[_� %M�"_�KV� �*���Y�¨y���/8���L��K�0�zko����P�X����� �O��5;���H�+a?���z�g�57}��Ɖ�c����N��v���6���F+�tи}y+�<��2P5��� �G�Z�W�"25@�gM)���)uH/�*�U @ ��l�GD㯖�U����bM��XB��$7�M�p�_ ��DV'8���.�Hu5�|_�O�p���*t.$�?lgBT�o~����h�B�_A�:�B��U~�$� '>N|6@�ĵ��<���3�n7�F���6�z���Ե��v�����(�"U���~���(�jz`٢aZ����NЀ��ޮn�5 |9c@s�$��Q�0T?��T��V�t���8������Q�8�ڃ��&����b5,�U����v�5�c2�0��!��>�b_X��$�z=�� a����+�����U>m�˕H�㑋�ζŀ%�>@$[�Fs0ū��q'�s��t� i���Z�ѥE,��u��ҙO�Y�xВ��G��u�2m�/��s��h)Kf�}V\��+C ��x�\�vh�&l^���/�}��jO ��@�N��h�,�f2�%����Y��>���sn�r�r`o$�~�0N�0xXY?��l\=������Kز��ZyZ^s�A��Yb=x?Xr�\y�ֺ�N�c��]^9R�L<���;���M��ag��P[�����դj��+e�4���:�~�+'�H�v t![��O�iop*�Tx��aO����K��`w���or@�y��F�@ω1��,˓��"`�?�:�30M�6����FŖz�y�E��h;��a���Ϭ?�uJ(���g���I����S �g�DK�+t"#���.Ƣ$sEG�˻N�j`%�{��h~F���CV5��ߓ5��я������"P��n�m�C��� �R_����1�x�I�:ƥ�N�Y�����"�pB��j��"Gg���bk�Bx�m6bV��^~�����>�<pD���b�G<M��&r��'ҭ��'"�M���E9�lB�����݉�hqX�P���cA<joW�m���K8g��Z�V~�H�p��lf���� �CE������_!��C�t^۵�XR/L ��[7� EŤ�K�b3ڌċ8����p���"���a�����U%M(�u�U�<��{� ���R�������Ҕ~�Y�DkS|� ��������y�U �b}��jx����',�p�Ð�YV9�ثE� .��_"E�,�!b�<�Ƹթ� �-Q��!�F i~��p��K�1~���\����fO�������58����&���?�%]��8��T�%��ྡ�,/����w�.���hŖ+��y���o2�0u�۞n�����c���ewH���T:��{h�� 4I���DjɏR�N�D��e_���gD�Xs�d$'�8�=���l:M�2 |ϠܐE]��-*���|)�1���Aj� ��<�](�� j��3��E)�;� ��:��b<y���Ǭ'��+_y<[VR�ѰF��Z���lCa��-�Q�z�EOa �]�0���\��ƲcH�� �Q/�����W��lh[�(&�~��=���z�sy�k7�� ��!��ݍ�Tٴ��G���M�$r�� u렛� l�z��OR�j^���]Z ���E�b�C�t�2��?�j�);B���[&2�)���`+n�MJ~��� ;� Z�} �(�N���g���º�lez����(ds:7���ژ�����+6��p/�9��O`��H�x��S������Y����볠�b0�*بO�����W��7�V��iB�ނè=�0D����3������d|;5�(-��|f0��c�kSR�(�0o�:�_��I3��?g��u���U�b�"��g����v���`E�_Ѓ�|�WlȤ�Q�]�������NۡZ���x�NװhК�4���uf�Lh'�٘nX�s�� 䊑��UnW�z2$)����`����3m�H��(��kܷ�`Ο�TfG0���b����c�����lq?)���\x�"��x���¿q@PȆ/l���,;�� ���z�6= �W�4y\?2��m]\S2�9�)��;���|��ՖC�j���l����J�����q@�id�P��+��Af�R��WjD78�� ���-M��g��G��;q'�\8��i��m��f�$�yѳ]P���h�c�W����n���R�!� dF�t]ʼn8�Saȡ��\Ф�ORh���{������ ���<h��$�s� �Xx��%x��P���h�9A�H��A��23�L|�\�z�np{d%�{` r2�U��h�Q\}I|$�ah�����cN�[%e���0[|(�/~�d�]x`>)��N �j��[����Ē�����U���BM�nb���R�MbP2kM��~��������k�- ��N���&�E�f\ \���~XW�� R�^Xn�a�k_5������Ʊh���,ו�W?O�;s�ֺltdk���m6!P�Lx ����?z}�h�|�H�+�X�����ݸ���\����E�r��j_V��;�K��� ���O_B3.�����X�`���T��d��:L�z��5�@��ofL����;��ۑ!�#�&�u��O?�KW#��Y�%��N��<
Static task
static1
Behavioral task
behavioral1
Sample
a43cea97621e3941fc0c76a0a9fac94d64a5b97a572b3c3b6ed788cc6eb08652.exe
Resource
win10v2004-20240419-en
General
-
Target
a43cea97621e3941fc0c76a0a9fac94d64a5b97a572b3c3b6ed788cc6eb08652
-
Size
3.1MB
-
MD5
1e1772ba483030ceead09a75af763f01
-
SHA1
34f4f93e78e0889b5645679825a9edcaa0ec142d
-
SHA256
a43cea97621e3941fc0c76a0a9fac94d64a5b97a572b3c3b6ed788cc6eb08652
-
SHA512
efff4841ccce5fbf5f07c2e446629a9a8b9059e563e95e7186b5915d2bf58f38583b11d0dede0a8323b1d5b9a3a4418cb4aa0112c77027e50adafcc59ef8a625
-
SSDEEP
49152:EfmWdd11LIHqfEIk7uclUYy9FOql3TmLt2Ebf9T4dn4vZJdYd1/SR9Mm:WmW/LSRIA1lXiljmBfN4YyH5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a43cea97621e3941fc0c76a0a9fac94d64a5b97a572b3c3b6ed788cc6eb08652
Files
-
a43cea97621e3941fc0c76a0a9fac94d64a5b97a572b3c3b6ed788cc6eb08652.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 586KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE