Y=.U)Q�ꋨ8����p��K����\�t�ʕ��ʟMfr��KD/�x_���w�}(Uj��R}�t��-����U�C)����Z���DeK e�hZ��[����(�F}�)�z!&N���+�!n���վ���S���,�i������MH�d$zm�{s�$�BH�k��Ev�'��(�E��^K���;.f��ҘP�ܦ�2.�����R,����5��:�� R�Ȉ-�0k;��N��H+�O;�1k�0��Ds)�d���m ��O�Ď��*��;���ʈ|-,�feGϻ��{�vXX���ೈ��%�B�G����!GOiqd�U^CeZ';#���0�k`q ��� �r����Pw���o����ҔAI�/`A5�$и�5���eq5!^�B����) ����j��(�����'M^��L��������S`p�Ӯ�2�Ѕ<(V��.����z���-c�~⼯�*�G&⯙j�Qg"�6Ɣ\�k<�W�x���N���d?L^})[�ł�ݒ�"�����_���3w7#Wl�>)d�ÎߍKq� �P�s� zAZf�!�����+�F�,�O���n��E�?LϨw$~¨���y���lW�eKz99���eŎpf��#&Q���vxلK���<�c��t�9�CC��5�Re�V ���S�k=�bŗ�a�r[D��nNf�E.3��e�|y�LnY߶�l�-q�)L�Tɒ�w��1|D�W�MOF6$p��ݔO�ь�;"x:F�.���v�7ǖx#��(!F^�>H���|��ϨʿM�Jv�a�{BwyZ���o��(�����"l�mX��d������ �.n���P|�#��z�`�������}�P$c�����G$� ����t�ewx��M��Ll�`R���e�&R�ݜ���QC�>�W���SW#'��"��Z�?���ߧ�S�z�9��ڎ�����`�Z��եa^E�Ut#&���?�:��\��/*����d#�Tn��)�pI,g��Ch,�d&c��_�y��^��kw��S�~t�"���t�2����A�)�D�a����'|ߓe��6v�] ��T����t\��r/s{-Ԟx��Qm�Rz������A��W*���w5����Uw�}���:��yv"*������R�R۴@�����ї�Ư;I��OR�46/ ���e�T���<%��3#M�*K$��n��7)��@)���;rm�|k��(���L�ل0�ڄA�����#�|�����o�����s�6��{q}�\Q^u��Cx�Kz�� �$��5�T5���+fl��[���~��+�)�m�J8W���A�-���J2r/����u����O��9 �xU}�bl�g{k��:�l���s&�㏦�f_�6��%-]�2#{.*�&�*8���[M�ӝ��Ƣc��#�[�t� ��D�O֭���a;�~�g��e7�6at�2[�tQA��ʩ��bM�D��+�� H�������q��8�?ΗO�O�.�ܐhP"��|��dn�*&��Ũ���5�����<ԝCIa3{4�ZFSף���K�NaN�'�`�D��� EvL���>�|A��4U��^:�t�;���-x){R�@�~��,�,_��G����!Y�p@$����V� ����לŁ�����A�O[p�o$��m��?B�]C4=RrJo�&��k?C�O�����Q�9@����l� ��Ο�?.�q���C���ex5�[Iz�Ć�N�%^�2hT��������8�"}����/����������|xN��%~o���,nI._�R�`�F}`S�R(ѐ�x^�y)i'��=�,D�h����[��u0k�g�;�ynJ���C��wg7���Ζ�!�q���K��%�� ��������/�6�b��0�I��/�WTgA8&�)5� �eZug���5<o��rr����K`��_�$x�e; �֛��5�Ih��5� ^��]`�[Q���̒7���ec}�Ÿ�C�����bo `@3�e�I�_�_aZ��EvuO�i��/O���E�=�7�1��v@����4��Ȏ.�%G��]�s���6;3;b�ԓ�_5.4oɍYl���"�������ф�lʛ���DO �H����TH�t�3��Y���Xh��ctw- <�}�3�qP�*�^ �$-�g�g$�D����/IU(ƕ�K�����oc:` �n^�0�o�l�J��v!�B�t��sj���:R鱀�Q� ��{B1�˷ׄ�����N�Å�`41le7&�����ǟ�+���̼�Y�XZֈ���=�d�����~���av~G��n��~�Z:��R7��vѬ_��Ԅ�϶@ ο'œ�)��GZN�wγ8�K΄"�Y[6�.�_X<H��똀|�N�[G���çw_pNɩL1}�:ȱ'�3e(�lf%�H�K]���*oX/"���*o}��&?v��Wx復h/�;Zs[��jd�$�};V ������YH`����]9m�p�Q�M����`gS�-T��d�1m��j�!�E$�z�wf_�G� g=fzf�j����[�1,��G��8Y��Xez��K�����uc� !�:�$Hs*���9��(��rc�.���p����?{U�������wrF$�a|,��mN�L�ε������=�L?At��<4���y�ڨ��H��M\�TnS%^�2 ����ql����a�lM�����7ت�⻔�5��\��P���E>�|�~���H�d\p<���ٺ�������1�[S�s y��Q���*�~�K��F���C� �Hۍ��|�� �A� �:u���>���N�� C�v���TH�<�%�T�jbNxB4�ʙ������KRϺ��ce���$��t���Uᾅ~,���"�=ɑ�K����LiC<4a) ���-�)c��~¾�kGS"���&�2(gf3i86���4hfvz�K�jw;9���dکQ�������{�%�쨡����g�o���'b�/������6r{���˰g Ù��gA5���@Q�j�<��3�����J� R��o��V9�*���r��yq������ ���S#���Z7��aY{�Ӎ������I�͐Js�wX���#6�sz%��>�K�LØ{C}w���%��v1U<�#���O:�o���1- bw�����p�$E��Nu"��7�6q���bt��C[�5Q��-��{�5da��Z~j;�"֔����=��؉lk�-H�&�T�.����S�h��Q�:"�SYE&�i���:�UB<{��O�����=B,�*r"]-/sb˃U]� gaj_ Jk{ŵ1B)(�n���%[����z)�EW�,�&��5��U \DSw'��mo\��ߒ-��=½�1��z�!����M�o����X6� �� ��� �_��-nro6)mWc��x��] i!��;��,���K���DҸ0a;�i��B�d�����9㥵Jd�TE[ЅS)�]�5���U��L��魑ހ�Pb�X����$�[f#��_��ݘ�ce�v�SX��K5U�D�?���^�������b���]dd�� � |F3^�q���=�ۯ���F�#,]�����]���yq�w���L_��4��ƚg? ��m(�U��o)_ #[� F
Static task
static1
Behavioral task
behavioral1
Sample
eb6e319c2693b8bfb9e07addb938ce436f6c466a54ae06f8fb4caba6fdf2c592.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eb6e319c2693b8bfb9e07addb938ce436f6c466a54ae06f8fb4caba6fdf2c592.exe
Resource
win10-20240404-en
General
-
Target
eb6e319c2693b8bfb9e07addb938ce436f6c466a54ae06f8fb4caba6fdf2c592
-
Size
2.7MB
-
MD5
95551c54020ff1f84fcb9b46efca07a5
-
SHA1
d49d180f3b0f1420cc1318c0457457b75a16832c
-
SHA256
eb6e319c2693b8bfb9e07addb938ce436f6c466a54ae06f8fb4caba6fdf2c592
-
SHA512
eb0e09ca8dac5fc690ab81d3440cb368a14709878e23f9e8dc7895cb459677c664f92e2909b3898619e64deb57c08e1ea1d4889e89fa54607f3e4ba6874ecc6c
-
SSDEEP
49152:Jtla6IBixlSx3q/4Kuoou5pCDk2Zf4kjnKbB9BuhxqpgCqgGUlIdb8QN37Vr:jla6IwxUx3q/LzoApQvwkjnMTOpGG33h
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb6e319c2693b8bfb9e07addb938ce436f6c466a54ae06f8fb4caba6fdf2c592
Files
-
eb6e319c2693b8bfb9e07addb938ce436f6c466a54ae06f8fb4caba6fdf2c592.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 586KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE