���z�%��0�!��e�j;����J�T��~-�ߍTwr;�g4��l��Q�;�����رoׁ��)p�{� �w�i�_I� ���)3�Ĉz �����]�ar�=p��O�k�'s ��<� X���~֡�G2�ϸ}�B4g�l�)x��4Q�_Z�����D��g_��aB����s����].�Ҝ� ��H�+d����H��Y Iۨ�ƭf�|B��24i��}��߆��/����-���2 1(P������^�6Ƥ]�23��w���Cy1��\ΥB��4��6J��*�>ex?7�ںAH;Afn�V�ԅ��D� �;�!��w3��~a�G���������*�1�C���}���Dl��+N�$C�/K�(@��_3��6�`M�B ��� }Z��?�� �=�����E�g�Ķ+����f@�a����E[��%�ɚ��%��/�6�[5ۣ�j]B&��͐�����h�톤&7��t�p�����yr1r(��a�pй^�Fe#�R�֝����X��'R_����1¯�MF9E�bå{p�� ?���:h��{�2p� �������@\�r)�� ���Nᬨ���p�I�IIN�5� 2?��?S�y���n�A���μ`v�r(�h����=-��I@o/_[�dm�h��@m�M�b�;��+�uY��:q�S?d+,d{��.<�_�D%��ck�#g2߬��G���t��Y�悬Oƺ�ndYV�±��%�6V�BVbu������W������m-��M8Ң��%���B绫�ؒ���ͯ���SZG����!��Qtp�&��4�j�Z�-b��*n�xS��+�E���}E[>P��b��� � ������{�=&�s)fY�q>�Q+-�Sx$�v�%'���ܠ��KS(8˜$��"�iPۑ��[=��_�#)w�����"�?���g7歴��q"�8&���*��2i��<�e���!^�N�L@�QN�I�1A�������2��!��0#�8�)È�rb<���8���m� �z���2��rٛ?��UK��{��[�9�1m6o�5ڼ9c��9�\ܤ���d��d���to�Q�P�N�'��DTtkDs���W�X�����\�y� 2- ���W�nԁ�̠�������=�k6;�j��鼔�:� ��Ɔźo�ҥ�+?c����d����)Y�x/��1O�]'��Ӭv\��T��R��G� �~`Rd�[o}?�ฉH��ʽ�4�q7��NU]Z�JzX�S��ѥc�&τ�1���Y�&��A����R��W�)���l1EK�g��� �J���sP�^���?��*�K^V0�&~�:T.�9^�(�����/x3n�A�̉���!� �OW����]u�GZI������ĩ ��?y��z��bo(T�4�O#ĥ�$��b������W�������d��!ߟ$�7\�����̶�P��6H��UlZ^��� ,�?�[���� p�K0��$��D�y,�/ 3?ɰ�X����!�|�����1m�͑�ڞ` � io��üx�?�`�b�7�yH霃 �������!s�9�GaZ~���+c�����N�UD� ���z��h?n!��V7WÇFN_� ��O���T�p� ���o�{i��>�9KڤA�[6���������^\���D�z��!�A�.ǣ���!!c�s絟�Ն�俴�q�L-i/*��KkLÍ��Sp��v,E�-��F\*��@G|l��_�l�����C��Ǽ�a�����\��ᰜfd�ēd��� �'�>�MUl��Ζ�4-ݡBW�/�����"�V�+8]��]ć�A{�m��*�㝭�SA#h�n��U`nS�`����P�?S���s`��ܧ:Iz����Cc�>`�w�v^U7��'Tr�����~�~�� 0�L�g.����2����$)��8~Lһ� ����ޜ��{����C̬^v�I?A6EY2�!AB�(�z,���F7��������Y���m�uo�,GC��o�T�<uj�3����ɞ��~�v~�_�ק!�8!�cA�]A䒂��"�O9?�r`.���ف0�o��nM�ڴzM���f�=RX��?�v@r��^0q�F�OJ��)�Տ�`Ҍ���ߪP�h Zm���Z2�іs-?�)@�49�SN�}���O�Y t_������,��t3���~_M<W{��p�o`0� i%��&��y��x�;F{��_�e�H1c�f'ʭ,��9���m����Z&���H��d�锚Q��zr�O���'����D<=�#G�������C����3f;V�b��S�)��ZP��"C2]�KDg����.a��8ZȘui�����*�Ƞ��o7���)��tK|Tܜq�0٪/��I<D׃F|� \�p/6��LOT���7lӭ�����k Fm�ӣ1 c~un��l����_:"���8�'���m��������u�2q�/߿.<q�N��������-x�������<|�k�� �����g`�T�;{Wߢ����fL�[��P�_Zּ����¼� M��mi5���]S06Blc����rO?�O�F��W*�=}�ĝ�e��Pf���2h��I�9qh��i��1ݚ3֗�^CG�κ������/��������"�����?�ڌ]�D��c�V�G5��o^��a�@NK�&Ι��GF�1&!��*�DWU������#�l���;�S���d-����ĩS��b��<�|�F}�B�f��W�MY;a�z�Ű���}�w�| ���3��3��27�{fV ݀T"��z��NB��_���|7�� M ��M���=�W�/xO�~e������ZaSg��L�6�i�[9>]����\��Ѽ4��Ky1@u%��y,�P�{���X� �g��M�H5��t��N�� �`dGҩ��͊M/���;�(��4���S�Х�7�� �J�k�*�1�p_�E6 �ݦ��B��a��\1�t�3L�����o�c��&�<�Pҷ�pb���|��*�Y��گ�+W��J�g�Ϫ� �؟:�`.#0QB"Mi�˭�L�d����WA���Mun�j���<7�E�]ZE7�7YV��&��e�*�)��h����+����C;PD���р�/'���D�j��o�e}�UGB#�X-�C���3��4�nB�o��R�Z����[�8(�$���R�_˥K�FyOwo"��U?m��>X4�ߓ��Y��
Static task
static1
Behavioral task
behavioral1
Sample
1845d2a25b628c6ff5e489f83ff975a0c8140bbeeb8ea05f5404a45ee2f9c7ea.exe
Resource
win7-20240221-en
General
-
Target
1845d2a25b628c6ff5e489f83ff975a0c8140bbeeb8ea05f5404a45ee2f9c7ea.exe
-
Size
3.0MB
-
MD5
51014f1c86736d8f91d432548062ebbf
-
SHA1
6d0bab0a443ff43c293f57dface65dfea47501a9
-
SHA256
1845d2a25b628c6ff5e489f83ff975a0c8140bbeeb8ea05f5404a45ee2f9c7ea
-
SHA512
e05a72a5dede84005aedb80884ce191180bfd811a5aa197e18b5d467170b1e6b534b42eef3f37782355193663f952599d7eb6d0121a6f1adb2019cb3b547187d
-
SSDEEP
98304:DInXnNqIvqO74jZlyPeYy+sOnc6FqoMD:ygISO7sZae+FcSMD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1845d2a25b628c6ff5e489f83ff975a0c8140bbeeb8ea05f5404a45ee2f9c7ea.exe
Files
-
1845d2a25b628c6ff5e489f83ff975a0c8140bbeeb8ea05f5404a45ee2f9c7ea.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 589KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE