��X���Mz�2�8�`�o�-L�����g���da��h*êŪzx#�Mj��%w�'�8�J�v?@��U=�`� �K�"pZ�=�s�R�o`�ϋ\�5���3a��rKJ��`Q��)��d�*��9y���-�j���R�#0hZw�Z����W��m(�J;e���S�܃5��QI�0�������jV�z���cxX��N*q1QQ=4��/���c5���@���s�*��;�,~$g� �3�SUk��</�m�T��5Ui5Yf���wf�XS'a�&���3�z���� @E6c1ϯ���]�bK>���R�d�,o̞�|6��6�!�K�}/D����]�dz9���i-���_r��U���p����N>� ����0��P����W9:�j�8����������|����:[��F�����!�X�m���9i�t$���wG������@d��ʫ�� _ߞB�=�����p��F���[�:'�($�uT2��{)H�.�A��e~����}�Yq/(6�7��G~3��gu'���8w!$&]� a�a�=+������J�{��i܁��:��e9����O(.j:K�8ͤc��Z���D�;o�R���gQ�À�| �O��@��6}����pd^L5r�뿬+�a^�AH�܃�R�!-0f� ��� ւ|�.��(�O�d4�h�\X�MV�z����<��8�k�<�7x�l��'kz'�ɯ�t]8QO>\w1'�F ��:�D@Z �1����?Sh�IsW�|�E��pf5���F�n�!�)M��=�f��<g�9�� ��~�a.�\#R��z4�-��wnR,o�ǟ�k(�b�/� ���C�Fb�ki�[H��rz�=����̵2��S��P�juJTk>�q�!��0�AԽأw�ܑ�o��8��3��>'H��\�S�`�����+�(Z;?}��3(�kr��B������y�D�'��~F�W���!��2�5,e����]8.J�i -3�j!3: u�hf���'=��[�`��t�yrc����Q�C}�e������f)� ��YV��yߪ?���+�B������������P!T�4�����Յd��d{ �k���[g�>O;��}��]�E�'sF~н���W_�?���bW�m�?.�«9o���߆�Xb��%��[v�>>��j�q"ә'��/u�Z��ې�����SqV;B1fB��۰��=�'���Sj!��0F��M��K����rv�w��~8�3[�GF��o�b�� BT@�A�t�j&u�i��[Q�#K��e� &��<�W`�:����dnPb)�.��ӄ��KZ���S�Ȱ���Khz����{R�� P�i_w �����c���&"�������Y�G��7�h�RZM����d����(����]�� ��s�H��[_�C��.����U=1`$c����<�!���"�%j�^OTz"ick�1���B�lL��U��h����a����j ��X^����v�LS2ۻ\���y��'H ��@�e��9� �B�;�#Z�3e�� ��o@���9�G)b ����:�t4���/�G?lu{5z��|\��n�g0t�b�Q���{�E�{���$�J�'S<6k}�K"�F*j���~�6I)m���iR9�����H,�+N3��Q�at�(Ly�$��)lgt��� 儳ϖr���\r��&-Hx�`uREN��;��ęBp�=׆2;��¢��b��k�R�� ��`3/��fS�tx����3X��Ԑ��_�Z�%���R����V��@Ӭ��m�P� ɽ���"���.�\�i�,�5ugH��R����2P�����[5��&$�����el�w��X�B"4g��et����$�s�J��mo%F Nt�u%!u얱.�������-Z��7��B�B�_��48Ã�]g��nb��F��������oϘm�Ќ�T��Ő鳵q�h�!�M�ٜ,�����!���Ό l���]9k�/��M�J��"{y�b�5��$�$_��1��B(g�=c�O=o��������=e���"'۵��k�V�0߆��l���f����/X�E(���VQa�U�H�ˋ���&\�4�T�63�Ҙj�T9I|��y?�]m� �E��Y����2'C�U'(�Ɍǭ����1��ڒ���`OJΠ?�R������:vz��C%4�W�R�NB�9K��IEtx��N��_�wu��dЯ��/�y��1��ӟ�W�|Yp���O)=�TҌ��}�,���8�:(x��B�o�uK̀�u�Z���Cz���%�#|k�y��ٝ7�!� �-sJ(�ʖ�&R/�c�_�2��e�W�K%��=Z���O���d+�d2�<%�A<��{��������^.��T�K1�a�Ϫ=���ZX�t +���5�ʴ��$Oԝo Mx�M�AI������X��,�D!p�� �:�>�{Rq��1�.�qA�^xpIh��G����Nw>pW�:������U�+�˨�x�R,!� ����V�g|��)�F�ɏ\Ϩ��*��!Y��*3I֓`q-��4+D�>M�g ��j֤�!���W���a�!i�+q��L���4��I�A��-�g�� ODgv��t�|�.���tPQ�Lh����8Bj+�Z�����e����."ElӴ)z��R��=.�SnT��7�2�:��0�$L�{�8�y��|V�ۊ,\S�����$D�'Ӈ���踳m|���m�^<F�?�FT(R��|�p�^j4�>s�G�?�H���p������ST����y:3�ɹK���+��%�L��[K����Fɸ�[��wǞ�0����^�ԉ�u�q%�KB�CQ"��ϰ��u�k�{��w�|��e�y�TP� ��a�0xn6z��#��PDc;���<�'�I����l���/�NO������:c�_[��T^F��Z'���[RZx ��}�KS� ��!��9��s21TI�[��bCb���"����J[ZL���87#4ҿ;E�HrI�ؿ��dp������Y����!��=0���k�Z�$j�ZI��^���A?�HnA��efˠs��ck�^��,�lC�!I�ʇ�a��wW�e/���Z�;7��^r�@Vs�K�}�6#��O�aJL0�?�G�������hڢ'� �=�a)��E��z�y�������6N�-h�Қ�����_?[�����."p}2�ۊ"�����j
Static task
static1
Behavioral task
behavioral1
Sample
2144cf9c43b185215ed7d45ae42287fb15f063e9d60149f74f204f205b9e2b46.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2144cf9c43b185215ed7d45ae42287fb15f063e9d60149f74f204f205b9e2b46.exe
Resource
win10v2004-20240419-en
General
-
Target
2144cf9c43b185215ed7d45ae42287fb15f063e9d60149f74f204f205b9e2b46.exe
-
Size
3.1MB
-
MD5
df2c21b208ace815329c5cc8e878d649
-
SHA1
9651c25031da7a7af37fbede67244faf27b5a932
-
SHA256
2144cf9c43b185215ed7d45ae42287fb15f063e9d60149f74f204f205b9e2b46
-
SHA512
8f6ba57b49f4e82b302d011e5bd4050800d7a133c725b974aeacb049225fc14ebe0b75ffbb9eda2f42dd6c7548173a11a77181b4e101836828209ae089ddbd46
-
SSDEEP
98304:SVONxo0Gmumd67pjS7uPYJcaThp2HSev:SMNxo0JDdkU7h2yA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2144cf9c43b185215ed7d45ae42287fb15f063e9d60149f74f204f205b9e2b46.exe
Files
-
2144cf9c43b185215ed7d45ae42287fb15f063e9d60149f74f204f205b9e2b46.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 589KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE