X<����lV\?r�?��o�<��\�:���������j���Q��f[lH�6&I"�bFÄ�!��,#OQ��FyT��w�D�O���=k��}{X��)�O!�����%����-�1r��;F2p��%���>�<k`u&gN�M��(k�l���J!ll �G���M�U_϶��6��E��T�S�6�� ����DU0���t��]�������`��T��X��H6Ax���~� ��?�Xa�4���p����~�\��|!,%�D�⽐F���d�*��@�&4�ީº������̶���R��*�l.IH1���.���8[*���,��U8!��e����*,��Ő��w�S >!4?��nL�Ŧ��*��ZN��:/�82k�Z�@�~8���R��K��T��)˃��!be�(���y�:��;�v{Ùu�(*����X[ ��y�b���:xm�U�Q�|%su�g#��@Aa@ފOų;K=���u"iUhŖ�����f��O��-p� �`���<�� �>�ܫ%���G,�Tg��Н��w�5k��*^Ip����T�� �m�6Ԗg��A��z�7��&�z���d;NM��������E�%�9>��A�K���~Ý��z/�ݯ2�:Z?���Et���dZz���6m"�}�.{ږ�b�¾^��^��ȕ�z��2�"��c.��NiHLz�3 @Y˾5��ǚ����"�[Ƅ��1�ꆤ�q�!ERD�h�&�Mz:<r픮ht��eVM�Ʃ��(�` ��s�U|����������Q����zx����:E��M^n� &��ǻ�#��@�D�c�K�����9�!�a�~�Q#tc�5�'iP���.�؇��yә5�̗c�=�E���t��B��#����Ekc\ ډ��Oe�8U*�#��E�r��K(��U�Ym^DF6 AB�y�!�4�Џ �w*��*;}%h`r���M�i���%/�0[7��*0+9Pذ7�ӌн�6���r��jhS���&�.�C�]\$>{Z���R� �K�f����3v�I}��W��-�;�����=��Z�L�\k���$�:sg�����Zٓy����ҁw6l�mA�}(h5Y�%щݮ41�l6y�e�z���^C/�k�� ��v�)D��'_��%���z�n��!��w���s*�#�A�6�Tޢ��g����K�C,E4x+օU+i ��b���sG>>�t3�gF�~�e}�˴�Q�����q��DeR��WN��U~Tk�z��=nCi��:aL�^��� ǖ�m�ph���ǤM��}'�`��'�[�%_�Ĕ��[[���ie�J���[���J�j0���D��6O�҉�ި����ᆧ�/Q��)�S�7�R��pa���j�]��#{#�wޤ-���̎�O������JĀ��b1b3���%�=�nQ,TWX�n*I�b��)c,�cXʓ�7��Sa�K����*c)����U}Ll�CBn,)*����`z�V����H�~��|㡇ƣ'>o���:��)#��l�t��8��t�.V�.�<cu���e�m*��(���T���}��]�2�������h�A5_���̛�� �B%��q+b��F�T����؆�؛C|�%���\T�>�Pw���E'��))�@�~�E'` k�k��G�ui*u'����M�p"1 FrRF�A�PvV�>�)�@O&�kb���D�q�Z�y����p��Fp*:���GF�g�L#%`%���:" ���3;UAc��M� ;[�P0��l ��!�U��j�<�F�dO��y����]d%C6����s��b��N�ᬜ�xl��\���5�G�ˈ�k]��]��4�K2־|�A;ӌTpL|̢�#�q���ʺ<�&@�9���m�sn�mOc��3�C3�E��r��,�G�]�u#���7��_�Ti�AL���=���%��f��&Ϲ��i��rs=��"�B�N,�>:sR�Gn�����B���\���D_R���}�cT� /"������k:L�-��J17���&"�S��t,d��08�e;zG���z����?�uEb�{ I�ߍL Xv5��5�DH~i�76`���8���%�-�٘nj�[�ܧ�M2l�M��?ݼ���s�T{+�x]�9���Z�t;��8���"�_��'}�v�}K�˩8%5�l���0�A�Vc%��r��b�,�(�E {��#Q�h���I���l�a�o�a �E,_\D��nj]H[����]x�� �"`S>&;��%���10���Pi� � �v ���:�~k5����n��a�L��?,tl��ٕR*l��߳�R���m�s���� �e/O�BN�74����K@�k�/ZL���z]xB��k/���4�ղ�ڄm���Tg�'�Mvϲu��!�uJBL�2%��X̦�]��<]]��Qeĸ�?�,����tp���q�ĥm� ��/��n ~]N��qM�Q� $��e���F�ݫK��l�0 ��%rm@�~�~Wf��亳��xtj�}<]X��h����;�G�>����OIؽ��������E@��S�E��T��]���A?Y��+T) �c`��4��� �j���{�m ��,✅��Ł�k�Iw<=��4�+r��-�uK����X�Ψo|���>�Wf�����w�ҡ��bl�;^G�;$#�2�2o���3��T;3��=�&g3K"��L� ����E:�DJ��E�7�Z�=d�Q�^1��o��w���w�vpn�NWNGU�g���M�?�� �B ��a�"zȪy(aZ��IP�?pf��$��2�6Q�����v-?�ˎ֜�.Z���aD3ޙ�&ן{v �8���be����bfZa�jМ��������]@�M��<$aӍ^:�AC�� ��� $��?���D]>꽮()e8�>b���!%����=�!v?p���c}�E2���8V��~����W.���� �m�}����e� r}���8>�xӅA�����cd��B�\�!����C+�sk���thu��d�g �̍cai��V���R4? t�I�VB @e��o:�� z+"�I�h]`�r�����#ņSa>��ب/kG�'�������cZ8g���C8������}$��]����"g�->��'Ə�1�XI���n��(Z�$܂�V��F,���ʒ�:^t�b� ��Jә�3!���{Hbm���M��(�������� �m�v�?ru�����"��W5ڀ��$^ؕ���*��z� ݝ
Static task
static1
Behavioral task
behavioral1
Sample
b485b5cae7882945b5c6e859458e472560b29cb1a022a3eb2130a76cc355817e.exe
Resource
win7-20240221-en
General
-
Target
b485b5cae7882945b5c6e859458e472560b29cb1a022a3eb2130a76cc355817e.exe
-
Size
3.1MB
-
MD5
9285971685da864f0a33a8cfa94e3764
-
SHA1
a31eee95ba7f8a967084ea5529e9411b1c24f648
-
SHA256
b485b5cae7882945b5c6e859458e472560b29cb1a022a3eb2130a76cc355817e
-
SHA512
9c72b3364c92ec5d20b484fedb6491639b50a4dda3e0e94f13a53a5186229f598256f7dd8acde7a8351d049603b53a6034ca48fd8de335b54a1582dad53fb0af
-
SSDEEP
98304:KczyIH7ruEcASNmmfAfGW95Jw6VilXj8oUtBASJ8:KcG+3Pc3itw6V+glFJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b485b5cae7882945b5c6e859458e472560b29cb1a022a3eb2130a76cc355817e.exe
Files
-
b485b5cae7882945b5c6e859458e472560b29cb1a022a3eb2130a76cc355817e.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 589KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE