G��>�ւ$|Jz^42�i~t�7�-�!z�h�I��B�N��l�syNJ77�\����ޫ"�S�t��-�F������c~+�4+"�5�v��������%�G�ts��?P��&�=���? р?@�=��,�"2K�+Ā7.�,�Uqg�+�,�� �I ����>�5�����J�����ynxAΑq��2�ď�z/��᱁�z�F!������!�����zU�-�mܳPOi��:�ҝ~P(�p�G����&v؎ٳ�V���Y�SW�}[���ĥK��b�%�[ �C8���q#�D �S�IM��t왼|u�@|��6�)��]��[C�x������0�2ۇ��u����Sju�w��A�Z��QG$~�A�}3�����c� e�`5��*�9Vk ���F&�YX���IW]�-�&oa T�%N��a췲�5=��3*��E��u�ًHM�r8��ҭzY)\�up� �4f������c� o�7� �O�9��X���<(�S鉾7���J���IV�h���d�[uUx38�O�8�;��*��|v�����R�~��MۡX�^L���{����P��� yxp9Wqe#��珛��$��l����U"�����Eî.[b�,�&�+a�����*JTFi�Q�`@ԃEbĘ�8z�!;mhr������@M�M�R�-7�D�n!�%b��qDW(���}����q�l���9 ��C����u��eK�Ŧ��/m�v'��9�ϱ�J&t�����#Ŏ�M�6��5�Z�`/�M��/�_�9M�E�o���5��� ���I�Յ�"�<F�c����dV A��!�.������J�D y S�^���v���CO����^��>��3�| �P+�`5���]8��.d��(�ij�ҎU��f�+������(��̝�R**=(��8�];H���Hu�H�˨ÂKs�gn�V1n�ǃ���v��� ������2���@Z���)͂�r�_r�jM_,M��M���VT-N�``��M"�0V1��+5jY��y��B��H�?D�E=�\o�?X��D�&R��+�)�{ ���[:ݵw�34h�]N��C�ER�o�l�٩�z���(����c�UsT���<��<�9��Y�jj3��D�A'ڬ�V����הj ���a�4���ۦHJZ*u��S�o�����F�֔p��0u�D$����� S��P;O�Ӡ����aƃ���,d� Y>�ә;�}�b�@�� �M�@ LQ Ca3d����D�t3���/at����T�ڐ�{��1�{����*���z�e\�����C��SÇ�j:������{�$�}[['A}a��lI/hZ���la�2[S���B����>��Z0��%oڟp�s�8�Qbw��4�����䥂�y4�/�G��g!8�p����m�y����@b�v(E1t�RH���x��s.ʻg��7��)P�mE��a�'�z�݇��ϒ��+�ɗ�F�F)��>eU�H��S[��5X��T9�w�e�h�V(��|) a����Q����p��'���̃�dSZ��tf�C,��-������_3_@�Ệ�#pvؼ�+ �Rɶ�y�wxh� �H<�)͟g��=iէ��J��|�B��V68���3�l����6aẎ$�&�ץj��0ve��Cx�!���k��� 'M�>�y�7U�r���������nyLP0����)#�J�W�cZ�c]��-A����f1����P�+�[�-;��� �/��T�ddо4|���RDV\�委FF�/����6p�{�����6���U��=v���.�/���`��q�����[�N/3v�q���FP��<x�i��$����X� :b& �_���sv���1��Wo��lp������J���9@��wt���)�`/��+�6c@�v�"��T�`�)g����O��S����%����<^p!s��]�'n������ �>7kqd����[��eY�v���ϟ�S8�CW%e�Ext�Ew1�H�7���^g�#���J�Y�������!Jom���W�yײw����\2�?V;rSS��>h�15/3�Q{����^d�9�����cA�C^)5���赾��!f�찚u�<���֥#$cť]x�ǦP�ݐ��Գ�@��o��Md�YeE��ق�ʠN�r�A�=���9�[m_��v��)��o�� ��!(��͉[<��~M/D5V<Q�a�m�'c9�>�|�?�_��gQ������?�����-kC�Z��\x�Y�`S�!Pw����tv]f��a�r�FK^�[��Lְj�#��>c�Im(D�ZC��R��똍 L k�F���fT�&��OW�[�)�d���`[���À�S<�c��[�z�c �J���+��ӟJ�(�H0�É�GF?�9q�b>�-������4�g��3�k�i��?��r��]+3I���(�U7S�v���_�Fp�ȎEZ[�Ós�k�>"�q�6�{����JR�=.�R)�Zl���y)�����Vͻ�,���ȑ*�� ]~���JiQ�<0(;��9_t c�x�?^���PYwS��� F����}��CZQ�F�z��<]R:F��uJ��xnO0�Z��=]~[�eoz��Ȋ(� ���0�M��46Q���q�͐�X�u�j��i;%���t7�^<��V�s �R���)�n<���X��� n�T�B���q!-ܞ�w�0[3a����!�`B*>sK�" �������x��ݭe8�L�v�YM��"Ҷal-�#!6N��^U#��Q�k�2�;Z�zL'�+'ԕ�x�E�v��rpݍ6���)OS�\��m�� ��De���y�ʣ�x�@i.��‿���=t�|y7����A������+BD��t�Nl����.��麰K��^?.��Ij��,�;��|�h�Tcx����{�_H�~D��1�DЁp�斬�V�Р������S�������vECh��>��fg"�j����%y�f7dƤIA�2�P��ij�2���I�Ʋ��� �ø'A���Ź�!ߟ���z�L���?�l0�W������ ���J�w��A�ř��A!�-����ɼ���by�$����vD��Kkg�#ڕ+9���!8��nz��O�@������=�h�(�{�x;�6rg�H�� 4��V7�����ř���ְ���+�f����Ճ���=6����W�*�Z�;Hh:�r�EUs~�[���6\9�<T�by���d�쮜-��@Nr�̓Dw�"��O�x��2��XƟ�lhU��.@�Lj�C����LE����f��r�|O�݉���Kt��\Zu�q�^�H����iD��TE���캌��1��"�W5���'R�����7����N�5�= ��/؇����p�*R}�NH���fG����_����ћ�c|�����<%#]�9�����s�Ҷ�x��0:�����RD`x�O�*�����S�] �y2W��
Static task
static1
Behavioral task
behavioral1
Sample
616579661d363587e9c7b43f908a6fcd8246da04d187cff213a23068fc4d10f3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
616579661d363587e9c7b43f908a6fcd8246da04d187cff213a23068fc4d10f3.exe
Resource
win10-20240404-en
General
-
Target
616579661d363587e9c7b43f908a6fcd8246da04d187cff213a23068fc4d10f3
-
Size
3.0MB
-
MD5
f8d5cb085dcd7e34ea00f05c827100c0
-
SHA1
e9555c5d7c2fd654516d784c23d831b7fe955019
-
SHA256
616579661d363587e9c7b43f908a6fcd8246da04d187cff213a23068fc4d10f3
-
SHA512
6ce7469660871c14f2d1050446590d74b3ea6060b916465356dfdb7cf189fc6620f3d1188a50103e0a99679b03734a15aab9483c79bda14b5da59c6ce2afa5e4
-
SSDEEP
98304:bgpFrKIy43D8JVLWdCZOSgn6qGiUAXwg:MPKI5YVLWdIU1xOg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 616579661d363587e9c7b43f908a6fcd8246da04d187cff213a23068fc4d10f3
Files
-
616579661d363587e9c7b43f908a6fcd8246da04d187cff213a23068fc4d10f3.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 586KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE