N�������R�,����1�9�-颬�� l���f1n`Y�����W�C�Ԟ��ɺT6�;��Q�r�(�F���3x��c�3D�@k�w�=��ZK�uGZ� APb���썩�nߴyj8ϒy;!v̺K$�Z<�I�c��0��n�H��x��)��#ü�Q��������7��_�O�:������?θ�ZF��f#�#�ͺס�r<�ݲ���(���������_����=���a��W�a��nԞ�Q�@O�'��I�c�&x��y7�������"���J*1��%�<�!��~d-��vk<-�%� ��@H'n�A#�����l�ڱ���2k� b����Way*�Q�����v�U�[E�e�ؘ|��ȸ���B�e6�i�S��>��"������'&�#ڛ���Y*C�gu��Ie�((��ܖ$�|u6+�T'���5�����5lJ$Cx�y�諂��o�:yT�8nQܣ��Q�=���Xn�_1e ���TL>�B����v%e�֝����B��d�/N6 }.�J�ި/�g�$��bE(+�\� �#��Ц��>.���/��,/�=��̲p�����vn-��Cj�/U�U��uޏ��>T��& r�!o9xn��Jy�0ҌK�DMB�������%*�ÿ��!��nִ] �<�aBQ�}d�,S�"�p�gJ3�];�1��wc�H�&D<�w��J�/�#����^��(@v��ǸM�����bBє���oC����;��2o�ߒV�(��_�� j���ND�U���$�K�>x5�G ı�k��؍ة������cR�G�=���C]��dV� �l캥�6�6ő���E���o{"\LQ�9����#�~T ��zW���7��{P��NbK�hD�tris9\v>Ik��0wlN�A��y���r�?�D�B55��`�b����k���pA/7ܝx�nD1@wO~���G\2�HD���4�Aǔ�=˔&.��nNٻc-�u?蘫�X+��ƵJ�������������s���{ĬI�+4>����,��������Ҹ�'�1����L�!y�r�E�*���L![�� ]�_��X��}�K'�L�-�����q��L免@�%*@�}-�oy�KQ�a� ��՟QΫ`��C^��<N��W���k����2*'g;?\d�.&��t��藈4$����n��<���/l{�5����c�w|����wN�?18�\��135B�s��p3�� ��-�V�w#�QĬ~n��]��G�R�K+�l�g��4D�sf��r i���_������\�g�᪵��d��)#F/�z�A*eYn�{������;����� h�|��!�4�T���T3���*��� ��ݛ-�bi� �g�!�$���`���q����r����{���2S�������l�(�w��#����or��������bM����`+��L�%�V���!pS�u�j�����|���1�w���ȓR�r��.����&Ւ`�����U�O�7A���v�����:xP��q���s~Y�^�s�o'�h���1V]c�� �!���"Z�����`R�K��ş ^2;�h{�( ~U����<R�%�Η�.��Y�>D������2)������)��'�͏d�.����"]�LT�βmc���r?��.�K��a��GHCMJ�9�\��H'k�j����/�B�y���͖t�ZQUG��D���M�J~���A�~"�'�p9W�>T�M�`�|�Ću*��Y�WXc��TS�K��H���%M�J���6�tܸ-g� ��ʠ�cE;�Y:Qc5>�p��G&e�-z�\����gZr�*&�@�����x�?<绗i������v,I7����i5mI���K+�'/�6s� �K�CH�� ����^}� 0r�m�����L��@�w�B� �B@���s��jI"f���~9�Q�.�V ֏ b+�H�K}���4��>�k�e$�%�e��L2A�//� ���� 76�4Зo ��$�#嗳'��霁=a��#Ꜭ>9bC �;�ޔi ��?&h+� iBg���7&ᵥF���~0Q���=-D���Č������=^<�n��܅B$5��g{-���/��%h�fw��Xѿ˜��;�GY}a�L��B��vCG�ѱ�hدi���� '��)51k 藈n�Ջ�����D �����4�(�Sj�or�w�����4l5cY�9�9~.�̔�ƈ�?�ꩢp�h/����r�6�K0X�ua=C�Ķ /���ٲ�*��������g��Pݵ�����7\��J.8I�����U�W�إ�xj�I�v������e�ih(�S��m�oRNЯ�#&D���b�3�Q>�n��'Z^�� v��*=b�K@�zۉɵ���Ӎ���k���.���8'�ٮ����R��|�K�<���������� ����8���w�D�\'lTM헫�DkLp��ǻ��{��O�9p�-�mk�+���\W���ͳtƹ�W�� ґ��s���eZ���`����iDを�p��L��_�%-��6�EkU�/m�'ԡ]�Ȑ�;���Z�����E�����X{1q8��)�j|��M9&x�i��v�+v��6�:�J�A�@*+����A�m��Jf.��~�l�J�ur�j�GdK��� �l�Y#u�R�� �!��U���p0%��zf�yR�O3"ډ���(����l҂�������t���C�G��r���ON�ٖ��n�)f2��K�����RV�Ҭ�8�^|��q;J��ѧ�~���qp�"�3B0�t � �D���<YN�^��}?v�]XN��� {Y@g�e-� �YR�`y���l�/����1~�[Ce��]������Ͱ����a��K���N�]<����gD��<Pu}�CX�/��&$S�m��\��s���aD�O`������h�lV���;�s�5����g���<vQ�������닱u�|����u?�{�߰�pa��#��6��4&f��N�� ����¯�j��tk���qܲ�x�aY?�;$�Y�!�K������xkeG��K�B (���=���auP0���>���cY����>�3��o�5���^�a��e!��̹��*}{��7�KqaRЃ;���ZW�(��Ԍ��PW]�#�;��:O�>e]�
Static task
static1
Behavioral task
behavioral1
Sample
2d1e07c69cd1e5f939b8d70c2f8c1948cf42b04bebd1c2f9b75772de8f216a48.exe
Resource
win7-20240221-en
General
-
Target
2d1e07c69cd1e5f939b8d70c2f8c1948cf42b04bebd1c2f9b75772de8f216a48
-
Size
3.0MB
-
MD5
a3ec3e168ec7be7b04c45533ef3e58b7
-
SHA1
853d6abbb27e954fd802658511317c3504235b01
-
SHA256
2d1e07c69cd1e5f939b8d70c2f8c1948cf42b04bebd1c2f9b75772de8f216a48
-
SHA512
dc04bd3577a8714dcdcdb6989e21149cd12280ab5200dad402564cc9b00c85a7719b76872d70c25502adab260115c7412caf6afa43784d2870c9eb738bec8253
-
SSDEEP
49152:FGFGToBWA9io9mkrRMMz5mvAYcZrejBStlDYUgf8MI/U9LNwvsdhod9Opq5:FAGVA9v9m8RXlmvAYcZrejM7HgzMvm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d1e07c69cd1e5f939b8d70c2f8c1948cf42b04bebd1c2f9b75772de8f216a48
Files
-
2d1e07c69cd1e5f939b8d70c2f8c1948cf42b04bebd1c2f9b75772de8f216a48.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 586KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE