-Ğַ���T�[�����-����(!&�3:�K�O��v%���L��k�-���l�F�V��h���U���ky�Nx6���{t�G�Zމ� mL�8�<hE̪��ēD颥�B��������ş��"���sOT�tU$�s�����b�s�ei���ܜ��x�o��.R`�,���y��A��pSP��K���n����3u����K� #�GT��|����S��ҙ�YӔ۲��n��^c$2t����-]%}ݠC1����{�<C���������zJ���gM�y�ʦa��;�(�y"��⢇� cL��ܬ2�`��|(fU�C�܌<�ئ�R�Vygk:���_p���n��]��u �^i��hR�&]�2J� y]��h�"Q�5�����+_�����Ȱp�&%��paU�G�{�������.��%�;=��G�A= ���؎�'��*��}��n��O].>���G�;����<ր�# �=� �xA�?���_��Л!-��.KA�\ o�sФnk��/\I{zxb'{B���F��Z����'�Kr���I��7\ZaЭq3�� ��ӄc�.���1�c��~��� �k�R�'@�M<LZ�u�^�q�o��r-s`��i���,��o��Pc ����/���eA�������Ӱbo7:m�OY�1��2c�Hp�1�߲A��W^}�ڔ���tg�+V�E�&�u���?~P7���������@'�`gh�`�(��och�� �����-ߒ z;��2��oO�e7e1 ��6[�*7;�7^�5�{ڨ�d����Q ¾���,V�4[�BC���.���x��ne��R��bg���z���R�q-9�m��1}��j� ���q�9�+�?�l��?��o�F[��hH�T�Nu�JMS���XC"b�G١�l{qȄr,ˠeAz�bZ*-���s�帵��W��S�L����VS�xÒ�v�Z+�������n����Ss ��O^Y��c^�o:���������i��a��0#�'i�\������U�����"Ա��_ڡ�����1�J�r�4�SWn�̓\�5��B�{���næ�D����.�l�w]"k�ωѭ,��@i�9L��ɾ'�Ѡ"�B'�4ʨ�w����r�J���*�G��ń��07�Ob��}�a���h��D�{c��]+�ج��Rk��L�,2�=�����5o�R7.@A돘-i ��ol�"�I��>���j���0�*]�U'�7��kM��Y7��b�4[��L�D�h�1l�%��oq������g��z�"�H�>٣G^FPu�he�^�m�����F��`�R�����O�Q�y��ig�BmyA(ie,�� Q�se����ٙ"����nx�ag=+�$[�-,�xڋ�n%����c��Fq���3a! D%s�۹姢����X��<�C�z`=��w�+�SaT�9���)*�U����b(�Q�U�����2�2��5L�������/������w,+�!e;�2�<�+��Q��.|�A����l�s�'�6A��E�'}��Π��z����1�~��{{�d{��|�T-]����V�p���z1��\�R��-�4¿s����ٶ���ϰ��TT,6��Vw|���2:Z箚��zB4��=�<�?m����W]F X?Ұ�$?���E���B��JV ��P:�����2�x>r��$��fu&����U\����w���gK~�C�CR�c�d�/����G�ZDPB��[�?Q[����P�'��'a�Ő'c$V����7�i~ �>m|�� Y� h4����U���#��t�\ne4^�̃c��"�ĂS{@=_�%0KY^F.�{v'Ow�j��_͉��a\���㩻���G�06��:U�@�$}ꨎB�-`{��ED�.��Į��<%���;9-J���n�8G(�r�u]Mr�Ҙ�!i��ϸYkg�5�t忯r���R2knyu�)4� ����QM�M�H�����2^��mO�쪓�,����^Ҋ����n�Ŷ�Z]��Ӣ���M�|�?��Ϳm��:zf=B ��~�^.A�ś������`��UM�(��τ<�Yݫ����/I�3��c�tB�#8ŗ�z��r���̶�-�y��&���/ڟhN�&��R!�1#������=���|z�Ƒ���:�dU�����IXWވ���xs��Rz|y��>��(�~���Q+�3�6 M[+�x�h��JX�V�U��%���Mo}��x�;������O�uJ��V'�C�]J��^-|�E����E�k!e(:��f���B��Z����l�_��Y��X��4���>�}zG��*���/:�f��&�O���g�1T�@�Z�%!jy���`��7�xr��>#����VH���)4�eς>R֞�3�p?Ȭ�1Kd��G��dظJT� �݉�|���0e:h�%K�^@w������i�v��o��� B�tŹJ�0���fO��N��7v/X��!�zZ�P�0[���*6'Z2�i���:KXb&��w�f�\&ذ�o��魯ŪZg�������t�WWJs+r��42Nn�3x��_C��6㠢o#�#c�H�mApD�`&nY�z-�b�d��ϸU�9B�a����jS�M���~ �o�I8��l�f.��W��J|����5\�����<$�~�>�~� �]o�t�B�L����>O]�����7�7�#)�� 荆�לe.˭�0�}�V��~8|��lLj��a��`)�������d�%8TS9`��j����|�V�R�S<*�[��v��X#~@���`���B��Yք��J�Y��{�����vD=`4��!�jk�VE:6�s����'�b���Bs�Ve�cZ���d0���2�La�c�ps�W��g�B����#����? I9�iˢM�?F�%��3�qE���_������ ���O�:u0�RGY��.�߳�D�.>RD�4 ȳ[5���IJ'&�8Oޞ�K(U��`��g�D&�r� ��zս��Ed�]w����q8�~t�i�J�T~�u/s�@��L,�a��W���r�A9� Ȥ����zDEƖ��]�wx�����ñ�P+��h�Xd}��s~��ÞY�#�A�^� A�x�=M�T=�V�����!Li�N�љ�0���T���a<ZV`��eű����N���V1�����"^.� B~�(�]��x� �6<��.��X�e3����&*��k��r�����R�-F�b�3����q(�I�sٞ�Y��O���� ��jf=G6PW�ة���>X�0�M80��z�3�$A���f-�p�����kE��` �X�[g�ն*Z�pռ��e@O���`tC%�?ր�Lyv�F2_z���4Þk���J�Z7/'_*��B̀,�! x�[�S"]�]M]d�ۧإ�G��$�݃A6~�� e��@���9`�X��_5�Y�0 Fk�v��y����<���.:��K�/��)9��Z�a� �e������s3 �����>X[:ўUI!0�+�9&�P{�wM���X��Od� _N�'��&8U�)8��5�E��R�z �|LMВ��W�-/�4�����{Z��FW��N4�1W�&KD�!��g�拣v��z��l �(#QT�.B�+����GAS�WubE����lV�tn.:�E�E�O;;>�2`�������>��ƥ�:�]^�4� ���5$�V��� ���! î��6�"A��C���e���c͂+�i�pp�<��ӑW��w�UNR V���bz^Ko�����Q�p�*1h�r\v�T,�*%KE���+��J
Static task
static1
Behavioral task
behavioral1
Sample
5f95a081a8f5df81e9e618ab76e2f29d9e5dcc26795461235a4574e6fb17ae40.exe
Resource
win10v2004-20240419-en
General
-
Target
5f95a081a8f5df81e9e618ab76e2f29d9e5dcc26795461235a4574e6fb17ae40
-
Size
3.0MB
-
MD5
dd32a5d054e2d1de9b13e755a739134e
-
SHA1
ce062b9920f4aa6a97435db27ad14196befb5e54
-
SHA256
5f95a081a8f5df81e9e618ab76e2f29d9e5dcc26795461235a4574e6fb17ae40
-
SHA512
ba6c1d134e07a86636119711b88bfb752f28cfcccac7c29929e7c744ea46e32f563a22536c992ee5b0420f0330d4476f256d07c3bc396b314ee8fdca7bb156cb
-
SSDEEP
49152:u69Y0bvDtKg3TBuhga8WrgkyJ6Kliccchio2tGBVc1SB4pqAlVv6lRega/:uaY+bj3oh58WEBll8cH2GVc1hjVvrg6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5f95a081a8f5df81e9e618ab76e2f29d9e5dcc26795461235a4574e6fb17ae40
Files
-
5f95a081a8f5df81e9e618ab76e2f29d9e5dcc26795461235a4574e6fb17ae40.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 586KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE