\�G�ڟ- ���=�it���\���z�tEK+���jG��iM\(�����i�y4�N+�H��]Ŋ�d�2�F�����'�T�u���fC�������l2Z��h����� ��@���1Q��z�Q���,e*���?�j]ӫ_�g�R��������[���'[���w��[���<a��T����-fA�k 4���X�^n,BE���Q�!��|���h�a�-�����dA9��a�[�x=Hp�㷕�;�`.!��M�x\G�F�Q�\�` <��q���b��%��������ΆbЎ;vvԅ:|{'6��";Wa�/�SU��|�SZ?p}Ϯ�g�$�$U-T��� !#c,��aZ��*�Z�'Ka�����5_�7��i���'1}��D`����Af*�@�O���(ޘ�a�ϐ�w�IҠșs\��إ�Qĥ S�!P��e���7iҎ�cv7����Ck0p�����u��3=�*�; �'&X���[;j�d�91U�5��#ٚ7���4�8^�M�V��e��mIP�f�������_�pB�ٿ +�I��߫�%��2�l�=Kq�ʺQ/��`��Z�8�x��ۣ���`%�A�;�W:oP�d������"�����zA��4_I?��M�E�/Ru������ATX����$�����'g36c���彎�f6V���d���ܻ�:��Id���YGq�((C"F���N�I���ض�[�� ���y]�wO��@QxZ�+��||��O�ك�'>�M?1��]����[���)��6j]\N�Y�I�U/N?RF��0��A�oD�X��a�m���v"�z���j���d�o�,�#�R�y�m �4v{ת���N�� �HQ���N#�����8���(��7:����f�1u����%VGW9�v��;�%w_���~�l�o�i���h�+�Ͼ��\eU��Ϧ�;K�ަ���)��������[W\P��rbi!���b;������/���oޮ�:rg�:�Q�����ƚ������Ǜ�z�#{n���͘Vd �<SQ�Z�~c�4�7�Zes�� �/�pj�V�D��9�YBʅy��I�b�$��G�,���c�X��Q�Ml�^x�t� v����,X��)�瑕@�����n1��_\��L֙`�F�%$_V��t�T;G�B~?��Z�\*:�j�C��f���5���KotΪ��[�1��w*��E��-|-J�d{wF\�.!�P�V.H���CZmlV,�� �r����8q�HC. �`�M�3��F{0 ��4��¤*��ӹ��Jk0����4o�ی�@�/ol�%j���냪Gg@���N��ZI-$��*��,��9�t�]���������=V�s�#��<7�E�T����c�)8��Њ��t;CP�[ )ߘ���(+!A�I�w3����zs��\�� �J�dW��w�] �g��נ7��l� r'ּ�6��bU�4Y��p:����h�F%��VY&�Қ���i�',E�������$HČ.�4����n�*� L�ڳLT,����s��tz; ���v����j���m�;g-��ՙ(��+�_k-���x�Ђ��� E�k-�c��Ɂ��G���K�g��7�EA�����������x$0��/���w~�G�/\��;pu9�BA��b���2!O�V=���;��PGaz�#��fh8��}ܛv�N*D�ni�z��'��>���OC��X����`���E-��?T� �x�:�i��ix�sq��N⹃���fq��d�5Y*u8"d�E��d�ޘµX\,gq�՟����[|�� �=�Dn�q���2&3]u�Z�e�����8A/eVd��R�&'c�7n+J-�-p�ŕ�b+�~2�6��mQ�&Ht15+8Lt�$���6G����ِy����o����p�X���땋�Lo�"#;������W�d+�3��K�#h�[UZ,5 K(�V~+PE7�G��tZ�Mkl����ܾg��K1����\Ϡ%G��B������^�W����gF���[���{���������]}<��lQ���&�y���I��^��ѓ�:"q�My \C�r7"��e߅ͮ����/8֫�@��,������g��-+&|Io�� @��NQ�����ҕӬBħ�5��\5�t�_m�W��k�>e�Y� 8~D��%�O�&�I�(5U�p>��l3� ���g��8�z�y"�5K϶��Tw�Z�x<ס��!�G[eUz̝7ѳ)@��M3Z���܇��߱�����Q��k��0�ސRٸ��RZ~��$5'w�P���<���"mr����e���A7Oܹs�i�^X�jmBF��������g��3�U�I�~��(\��MX����=����c+T,_x�{W���5�j��7��ד��<@`�w>{�Hç�O~�>�[�qJ��%����<�}�C�l�Oه����:/�e�&��Z�!܄R�|�hbD&��#{�g�����\c�Qx��e/���U�D�MS�q!d���D���.���� a\Б��uFWl�(�Xd�T;���y*~˿&}&���'���x;�t��5wi�v�D�y�Z�Fjǀ�9D�� }�0L��;�Q�P�y���$��t!*�v< �N��"�1� U&�f�������<�c��==��%2�ً!���Ɵ$PN1�vQ/�P1�e�@+jƎC�\c�N}�պ`?��~E®�o�S����á�]�,ZJ+�����l��I��{�L�2��BŸw"��|�\3͏�Wܟ鳍^K��Qq�� �^D��oa.��#2���W��>���a��������0�7��� ���j����l�8{L_� �n�pCO5sŎ��[4�}��lMg�G���<݂_��&qfʘ���j�Syiw�ԅ%A��_���� s��c\d���D�>T6A^J����9Έ�ɣ|��7�̜Ni�+�25i�J/Z u�t����,�xc&��F�6�ã�f��s"_��o1[/d9q�Rw?�o�=e��;@<��h��6ē~�A��*��-}����jg%�g]+��Ӓ���,G���nR���jP�[�GW0��Q�GR�#g��L�I ת{ͭ����&2
Static task
static1
Behavioral task
behavioral1
Sample
3d4f14601b29fae585157887a3fc30dfa95f1e01b380ae9d2b6d7b0f8fbe7b1c.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
3d4f14601b29fae585157887a3fc30dfa95f1e01b380ae9d2b6d7b0f8fbe7b1c.exe
Resource
win10-20240404-en
General
-
Target
3d4f14601b29fae585157887a3fc30dfa95f1e01b380ae9d2b6d7b0f8fbe7b1c
-
Size
3.0MB
-
MD5
cd26ea5b17fe98a375ddfb645d9da46b
-
SHA1
9fb4c16c99cbb30e93aa338c01da54752d5c6fa5
-
SHA256
3d4f14601b29fae585157887a3fc30dfa95f1e01b380ae9d2b6d7b0f8fbe7b1c
-
SHA512
9082dd9b0183be0e6d000f457dc457bbdd03be8bb86897f5c257afc61d3a3a713313aaf6b8815e517ba2bda52b60f1366d00c4403b6c23cc511c3d9b30ad0058
-
SSDEEP
49152:JECRjxCrm9u60kl9XCrmzempei3chLnl8VO5AJp6:mCJxC69/0GX7e/8VPJp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3d4f14601b29fae585157887a3fc30dfa95f1e01b380ae9d2b6d7b0f8fbe7b1c
Files
-
3d4f14601b29fae585157887a3fc30dfa95f1e01b380ae9d2b6d7b0f8fbe7b1c.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 586KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE