z�B\�H)J�3ݦ����8 _�&��+�14���M�v�娝�~>=_8��Dw��S�?#:rr���#vv�X��X�(�7�qq=W�JN��������w��uB\�3����H�OG����-U��XE�'�R֦�0[����X��)Cw�.�lѼ�����=����&l[�Q�1��rv����I���Vʁ+���"<���}Q���ey�ރ�rպ�A�HR��D��Iiha���?G��O0k����W����8��:�}��abC�:��h�K��A��hB��cL��{���m=�i��X���y�(b��egt#�V"H�̀hǬ|dO����z�6N9[�IGa�Ԯ ����W�(��K�Ѷ��'6��}���&|�ζ�)�i�� �+���ZD#��.`G��q]�Fn�/����N(XVh��.���T.�Ew}]W�}���-���?�l�b�� ��_��+���Q6�+���^��ȻȄHB����,_4.�ӰmI�x� ������s� Z|����O��G�O�~�yRT��oo�3Y8� �����u���-���h=3CXe�ݩ�|�z@��528�b���U�Y�9�c �<˧�|�w[����aKjÍx��J���b�M+k�#����W�� j�(q� ��3c���o!�fg�"��Z.%R#�쿰����lnmY��L"|�o���i��j����][Ù��#E��2�[0xks~c<�����k ��]�P`�%�]�x���� �l��:����������� �9�z_m&=������!l�?��骙�P����:A�P`�d�܈��0�hUP�%vO���`��}}{����dm�9���K&���/$��p��[����ۆ7h���ܤ#���cX9���Jx��u��=���� �ʩ��~M�q=֘�f��hh���Jݴ�Ȯ�6�Ġ��U�#ԥ�2�.+A;Bl^l����_�)́��<���Z�KgH~�|��8�BI�r���/�� �(/�����%V�͐_7�>?�� ��9�w���+��?��|�m��_���vɅ��2,4Lk�4�B>��I��q�G����לs�X"���4�5̦8@��tAH�^h�ۗ��#���ٟV��4�C������F��[��Q�I�����cl��1�%/4�����8�$�����a#�GYh�<q��= �~��=�k���n}�%l��h�՝!����K�@}jǷ|ʠ�(7H��`;L_�JƦw�m,�ǖ^��q�S���`ߎ}#���p:c����߫��,��2��XG�!�oI����68�Ξ5~]a�5�D���v�� ˡ�?����"��E��vf��'��"��� ?mY�S�I��cES�Mu+j\��.�\��ywx-R{��x��ur<.���M���d{3������C�Q���S��Gp�n�é7�7>R�N'��z��2X�y�����ft���)��)���,��_���F��g 'm���b00�+��&�[����4knC�P`�H�X�/S���h2����_d���|qd�+�gB����%��kJ+�#�yr�)����8����-�o�=��v�:��lݾ8-��G��Х����j`{)����i���$�� 0=�i,L�-�T2Eb��\*���~���n�V�s�̫�R�ܚ������Q��2\�H&�]�Lҟ�i�|�וb�/��Ȗ�P���=f�]�,|�r�ڰ?89 #�]Y�1��.�r�#ˈyGk#��oF�Uq����9~X's�xU�gg�����}��b��l��!i$����鑀�Vx�8�0���.GK�p��ȅǑ��f7��H%H7��7Y�η�`�hMd�b(.IYq�����_6T���Oy*�ը}](�f,j���Q,��CE�ҥ0��.�9|e@L�KkD �eX>m��]��5,�\Y�� �j<$J��x�fX��Rjy�-�VvzA�PeF���w����k8I�?���B�����t�|#���������c9�%i6�5�:3�/����s�@��ogkڍ� ��z)Q���� 8,���q �Wtj��Kf�� @λX��c4��{�|�&l�zǃ�)O�A�-MY��z�Q���=5u_ai��ȣ��p|Dj� l������8��r���#'*��,q��۹ ���I^I�G�Cb�t��&�2�xΥ{��9�n5 p���CP8��$��������j����mw����k�$b-//��`�v����۰��G�猒��(���C� h}cl��2J���p{Tx=ޗt~�ڀ�Z3A��§����XS~����IR5�M���LI9�A��s �s+郊y��Mvz!��bV�[m@ϐ����,^�����V�/*U ��M�oZΰ���E�!�jD��,�����m;��O3��$#!o��v"�'�W��=ҝ{�@�ߎ�� g�1&�8Z���>?��)�����P=6S {�&ֈ��z08{���l�p=�*��iH���"_�P�]<�����Q���V��8�!#�>Nk�b�,�T�慺v��^�Q]���x$Zw1����fK:����Kv1� �wT[�T�B�-D������3/q�e��f��V����n����7��qW,Q�_[�.7@6����U#APc�'���xO��[�)��.���`I ��Έ;Dsb*�lR`��3/ Qs�It�-d7��J�T��.�m�],�(ը��UG�h쪁h�֏���gN� HPr{őm���*��-�0�۫�,L���u��5D�R�/�O�����/��#"�d�?�q�x �Vz�i��֠}u�G�\�>;��`��P��g�ϘΟ��D����q͌���T� �5{4��3�'k|�L-�h�&L�%0��X�P��戍�S'��w25��N����jǒ$_��턟�1�ǝ�L��(���X����'�kg�w��tj��%��=��8�i��8���v|�:��u �o���Y��#��=��� �HK�)�+ܫG6i��q��v'�T��n�H�48[(鰀�n5�M�)k֝����)Rv˂mb,O7Qi{^����n���c��<R*s|q���x�R/�.�Ӫ^ ��5�f���,J=��t(SҪr -Xכ��;r�I�Eh�u��k&�G�ce���|��}�,U�����?1�K�K.��`x�jh���2%�7�O�~� ��pc��Q ��U8��۸w���,��r��@�4!��#�c��&B�Džy\i��1*�˧$K���. ᑹ?�[�`$��VQb!��$����gU?!��;���Ȁ�0Ko��'KV=_h�lrǀdxuȢ�1j�Nv��_[����8���:���`�A�th}�<�U.B( ����Ci�:�$�:C��풮a>�&�ٮY����n���}"gG��,�4���_Z� �b�+n�?�{'���j��l�*�게�h�G2��={��V���Լ������4.ᵶ����Ԟ6?"u���B��b�Ec����H=��k�!k�G M�D
Static task
static1
Behavioral task
behavioral1
Sample
fb456907f17b0a04e63d3991bba4a274.exe
Resource
win7-20240220-en
General
-
Target
fb456907f17b0a04e63d3991bba4a274
-
Size
3.0MB
-
MD5
fb456907f17b0a04e63d3991bba4a274
-
SHA1
aa615e77c3fc7a298904d2954d1ef965af7f6b24
-
SHA256
211dd4d658821750062e7b7189e0a3cde4f081e38e7a325c8f8f23bbd6d10b93
-
SHA512
e84c6d815b95a42ddd5b1123f143541f92dcf74da79bb49e7505647a758e8dcf2975e55c830e589f377eb5063e9ccdc18f31ec7ce6c1eabbe914fc3f42c5d50c
-
SSDEEP
98304:uwSIaTQARsbphbohqRCRIv24HVzz6T7NMTYiw1U5FrrI:O8ARsbpWhqgmu4H5IMTYiw1Ufrk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fb456907f17b0a04e63d3991bba4a274
Files
-
fb456907f17b0a04e63d3991bba4a274.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 589KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE