`�K�?$�.�N��J����T� ��Ǡm��m�9�_Iɶ�: ���r��9��[�`|�u�:� �3�$D���ͮ)W��f����� ��������n#���@X�·#�"����!!.Ŭ9�VR���B�[�߹Y������������U���Ӻ <�ߋ��=�+�AC܍����rK}���KV�-�[*~���(�n<-G��)�M����м�|���l�.�u�����$�W�ʒ��箭�A�t�:K���k7�J��0�X����f=D��cY� uN9�e\o����!3.�s�4�ĭp��5�5��)��S��?$�:v`�+�jQ�,���~ Fk�3h���OD,@ c#�b�j_g�M��}t�ܟ}P���f��%�(=n�}:k��Tu����yeR�<?'��d �e+��^����"�|�B6+D�l,aGJfkL/X��ВV �"Ks����4W�<��E��-T���l!�åI�wSn�7�}1mCЂ������o�UJ�eR�RU��hD-vrfs`<&���.��~xv;/�s�B��?�ԙ� "�R�N��E��$����X�P� sk�l� �e��������c)|�zb��]B'>~����8��2#�PוDw�uI5�:�YcW<�=���/vۜ*�������p*�_�Š���d?�Aź h�:J�F9�����9:��G�� ��r��VۇC�����~��U"����h�)��{1�3��v4Y��PY���){|I�ć��*I��?#9�҄b:����qi���������@�s���x��;A���k��/���5�L�!��l{{_ �o霵�`��l����0��ar��T�OTK���q��5�� q�O]��Q�\n��+�ƾ�/��$�����O�9�KBJm�xGM��p)�1[�?���gԘ��"1K���U6�=�p� ��Ա���/��> �1�G�pdmvA<J�o�����݁���*��PwWp�nnIh�R�h[�D8�&(���kK�Cd�6bjqũ��oȖ�e�W�%)GJ���5��)|ӧ��l�{�&��!䠢�$��֒'����TmՏ[W&+��h���1�ԦmҀwn�pn�#M�t�K�=.�r�{ZN�u�u�s�����H�Lq&�$�{hQ�m�%1�Һ�%��gd������5ᑏE0I�Nb�Q9�cm��I�8���_K0 �QE*��#�٣~{��?��9-a�Ϩ��IN�.���Փɧ~'|!���/�s����N�eO�9 E�Z$h�A�l��-�>���p3S���P�k�Q|oū��xgl���(E�&�n܀�.�-�J��R5�k�[>�<W%��n�+��-�!6�Gw�ǨbO�j���i�.H�&h=����G�c� �K�d\m��P��]+۪ ��4����bЖ�Ly��;��飰����'�ZB�1+h�.ð0mX6�8&��i��⢭�1y���N���pg3��"�����UJ�݅P;��*2���SF��zg��|��:b��-W}�)E*T.y�����F[�����5��цBt�ʱR�ċW�����,�c6���aW�P�)��xi0��CT�r���"�XWE�Ϫ>E���N�c.k���<�.�4A ���q[�����X�Y$�8����D��H��}��NvX) z�^����μb�V��x�|�duϼ�i���O��"Z$JBqe��J�n���j�ѩ|�lB��A�ՙ/�#�z厵7U�4f�����-%5.y��wP���"%v"j!�{n�<�`�@���JD�Ȍ�������=l" G1gm&4B9�$՛M���v~���U^n��?��Pz��E��㮅�)����-5����6���/料�ˆ��u�pƇh���Q���w�ScJjA�|N�puBWMY¯4qϞ�����7������[�ޭ��XM�z�c���c`0���5��t��pw�h�Յ�� ��bn�Y�Zt����:�2%��P��rKۂ���0�b�}�K� ��5�Ԛ�FZ��Q���wi�`;ꎦ.����I�I������%�Uu�!3�~���`�w��&.:�Y<�h�4Z��Q]}2 �#+"J[WB�kq�s�]��6���#�#��x��)����m�����@J����N�&l(��E���IZ%��h��g�i��\��}HC*��}�c�h<������N�gu�0��Ђ��ޞ��eT���C�Q���i�w �nkU���e@���c?Cf����W&��]"��\���^���1zaUHl&e��=�������~���;R⢊�|�w!.%u�(~2�������h�zZ|2�11 &��V ��IB�����YVj��%�?��#����-u1 �Qd݉o^I3=A����y�DWN)r)��G��1�����C8MK�ɴÊ�yی����s�Ї���}�p�-��n 5S��J�$�E�hn�?T��#R(� ��.}�}�dQ�bj~䆺���+R��;�g��������s��O�.N�¶䝗��Y'6�,\Dƒ1c�dz`���-�P;�{b|O���VA5�]:��w�y��y��wև�q���m$Ln2\G�oi��� q�bF��LV�sSca �a� *X���X�E��Q�Y)U�iB�Yx���m�g-���N>�F��7�"$9 � +��NP7-��"�5N��iz�W��!��������?����n�3(J�F�.��o�0c�h�����43��؎�LC@�a��~����S��3G���R������<:�HN����{ 7�7�<��{���b �)�;���� � o)����L��]Ҩڗ��ӯX<�K��-���Mχ��{r4�V`\��j��R@N!��Bd�Ey<R��I�u %Z�b�!���+�(�1�V8ދ�)�x�ƞ�!z�xe��g���A���;�ʝ��++��A��k��v�S��rU��c�����#;$��*Ԙ��xjw�[6�HV����^̍�H<[ �4r�j�����I�Y^�n*��)gHE���ɠ�m�?s���ᣩu%��7/�����ݴG��@���ȻR !�g�o������� S�� ��9�����n�~SE�8N�IP�nY�W�.^O���g�QOEE�/�SJ�.�kn�ZT_��˩]�������
Static task
static1
Behavioral task
behavioral1
Sample
6cb20d672e41533b96510df19eb28908e2ecfb7241e7d0480b16ba123e904b06.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6cb20d672e41533b96510df19eb28908e2ecfb7241e7d0480b16ba123e904b06.exe
Resource
win10-20240404-en
General
-
Target
6cb20d672e41533b96510df19eb28908e2ecfb7241e7d0480b16ba123e904b06
-
Size
3.1MB
-
MD5
54fb724c14a7085e9908196ec2e9a1f7
-
SHA1
dd55a48ea4fe52a5157d882511f3f384c9f1f08c
-
SHA256
6cb20d672e41533b96510df19eb28908e2ecfb7241e7d0480b16ba123e904b06
-
SHA512
0fd2c95d04d673703e11671a02cc9deed16e95b800b15c056dd3bd484eb23f32b30506b85990f31941a8ba75dbd9d6db3a4c3fda790ed9e3fdc1508d863cf56a
-
SSDEEP
98304:bSQG6alVMQkj3xPxYIyCMNdUvAPFohrLVq:bjXalVMiIvAKioh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6cb20d672e41533b96510df19eb28908e2ecfb7241e7d0480b16ba123e904b06
Files
-
6cb20d672e41533b96510df19eb28908e2ecfb7241e7d0480b16ba123e904b06.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 586KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE