���F0`l�}fy1�j��g����@e�x��� O��9�s���m��M����"����ė����-� ��a菉ȿ0fw��~��O�.��NP}��ߏV���`���>�7�͙嘂34���r�6\�:%�X��_ Ŏ���1r8Ѩ�����5��Qִ�0�@��,ۊ���vF5$���m1Z�/�fdG;Z�PΠ8g8[}3A�7��k���E+���ȣnI<���[F������B��gxx����o�8bTO��G� R�u�u�);��c�ҙ�����}Q��(� ��}��}��kH�.� #��l�i�����78z�2���!3����Րyp��&���~s��m�H�u���D~h~ �*8-g�Ġzr{#?�}k["�`�N�;�h��H���"j�f�8�v��h�:u=y�?hW��ٽU1S/�� Gk��B�Agu�W�53t���ȓ<~&��_�]�U�g�E����7�?�:���a�C5,H�"�?0�T�2�$}�]^�bЍ,���R4�-���Rib4�����+u��/��~�j���L���[fK��*{"�`3kc4��BXմ�"Eb�zk�(!�ಲ�x�M�����պ��?���s�X�^��t!����W�JLMA@�����.4[@\[Ow��lj[��"K��uE3�^U��nO���ф�ℐ�q#��jH���x����|r͒��j�7�; .r.=@3C�����|�|���M͂����א4��9�Q�b���hݢ<�q��J�{��&͆���Fx�n�U�oռ+5T��<�u_�K�\.�o�V�1]���R�6S��� �iV��w����v$�7�.����[�Lq�6� ]��,� �u�=�0���Z��q��p��⦼oDx��|W~\�g��N�@�p����K�,� � �`��9+��J��n��/BVC�ad�A��<����� j�h *�<A�6 �_V��q���%6Ot�q��Y�r�mawT-gXYvl�������|,���n=�'� k��/-[��g2G��-҃����余:���H��l'�#��&]mcI�� �6�m��v�愘���`�������cH���F6lG��!�:�5YU���0���a���B�#G��c���DT#���G�}�����]�h�y9�Y�g��@>^u$�@���0:;��j.ɣb({�.��{ n��%�mM{e0-�BM�I��z��N�e��'^�/l? }E�Z�{;����xl�rj{�X.����@�sH2��a�d�+x)$���}g�ӫ�χP�.ɷ�z#����㒰cO0�i��TWf·�(�v���Q�#�|��ot�7Y�4�[�0�츣4К��� �_91�w����6�c�u�����BW����nv��xH$s�����J�ҁ��Ap/C�� ��&���3>�*��6߰x�����5�;�XM L�����HpO鬛�wNC<��0�e���6�+�Z}���I{E�}<���%:8$X9�E���hz4��$z�WM����Lfg$ �����B H�y���4^�BG��K��UL;��я���S�Y7��d�1܋���t��ͧd�~�ڿK�S+ zP��6�q֍&�*3��=+t��n�������cS|9�u�Y�9�����s�#O=�]�5:-=��$,z0�ʉCvD�;/*ᢇ�n+�~��S��Cq�Z�� �Ve��n;��9M�-5�- �'���6�k��0�|@��:�{�����o��ӽ1��hZRd#n�4�b�o�ڿ3|���M���a*F4Z��C��kK�g�����f�j��4}(�$^�L��?��G� ��)�B��d��˅lG<�q��<%5k�Z>d�g��-�w��8�~�{��,2h��k����η�:�\�&>?U] ���h��D1��0[0�ႜ�Qx�_,R(�o �0R��%���()��rp���t4��,�������W55�8���0�֯)7;H����M���F�<$���$?�0���A�^��ƫs��n�5���]��g��v�dכ�e���=�%`D���Ю����m�3��%����Y�҉SC�퇓��>:�F�<���y� �?�)�N2[��|%�G���%��I>��A��K����Z�wH�7���?��'��҅'�[:�iA�Y��j9D�� jZ����!{oe�]L�����"�V�c3�oJ ��`Œ�i-$�ǼAL1I6·�!�Cp��<���Qi^�J�[��bv�yX�e��ffo×T#/��P�o�``,0UFi��\�e#\��������6K7}���R���`�=�I���5[Q���YB�Q�DFW� eV����`����*ݥ��k�<�,��9�Ý���֞��Ŭ����gK�J��(uO�l:<{.���,%�v�omF��Q�Y�}���m�\Fw��؇��e B��E�3�(+>��W�xj��ӒhS��ꀗ���r��\p��o�������ܯF����^�τHrs�$���g�Yx�o�z)��!&��=ڳ0hOg���?�s]��j����X��B$�]���9jc�y�8\�!�,�@�M�$��τ�p��,Vǧ*Ȥ�-Ѝ�a�Z�U]>����� �,��:T�(����bָ����;� �A��gK�����;jz�`�c���9��-U�@�i����JU��Q3gvoe��ç �#L�)A�gͽjw�$���HP�%U4������f�!�Ud�G|ɟ��4��BPym��jIJ�Y$��&�(�t�BL���jiJZ]�;����J#�u� Q(XZy���jbSy��h��a�*���� [Ii#�3t���$���F��1����A�<�"��ٸ}����sǠȋ�8m����}��Ϟ !-w�Ҳ�����jP@>�~1����:�Mi�s]���vC1?�]�IjFM'!2K³��ThN裢cĞ�D�Z��eGuߒæZ6V*��8�o�� ��H���f�G�q���?�~�-XJ4�ߦ���,��g{��f~��u�ԟMd�1:$KЫ��� �|���]k��}b��z� ��{�ą��8�_�w�[�L�6I�t�ӫ>��ȁ���ض3�1��s�������#���u`d�������4��3��5̣}v?�)��vn�3D�~� Ƶx�����2�}��mC1��
Static task
static1
Behavioral task
behavioral1
Sample
a6373e357580e0f9d0bc4bb95a93874ee335f3f97a664c8377c529d68bebc266.exe
Resource
win10v2004-20240419-en
General
-
Target
a6373e357580e0f9d0bc4bb95a93874ee335f3f97a664c8377c529d68bebc266
-
Size
3.0MB
-
MD5
c159158481f1b1067e3e5ff0f84783ed
-
SHA1
e308b093b94f4898705dfcc9c2ee8df9b9a229f7
-
SHA256
a6373e357580e0f9d0bc4bb95a93874ee335f3f97a664c8377c529d68bebc266
-
SHA512
e3dec5fdda97b674f40a32f0ddc524fbcd4a966c14a9a4bb27724488dfe947cfba6f39579aabae8aefff2ff91d7d772beb1c4fbb5a4fc9293b4add408e58511d
-
SSDEEP
49152:A8qyRjOkCNlvn/rD+1ZkQ29d+JlH88Y2NwRENnK8JWWQG3dwshdrUTDFTA5cd:AlQSkCNlrocL+JlHtSENnKhONwIrgTGq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a6373e357580e0f9d0bc4bb95a93874ee335f3f97a664c8377c529d68bebc266
Files
-
a6373e357580e0f9d0bc4bb95a93874ee335f3f97a664c8377c529d68bebc266.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 586KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE