E(�C�`��Ӧ��Ɛ���x�.X��"|�c��M$4��X�K��+=��^�Ǣ�q���u��y��*�n" �.;�7���Lǿ�9� �������PΛ�����],]V�T��$g�ݼc�B�mB,�4��B\�dJ0�Iqeh�d��y8Bs��7T��$�܇b�n@�|[\�_Yy��~d��`Ȯ+���nH�/�<���^ �3���I6r��3�N����?����Ιg�2��'^�����F�0� D㫹���)�<���)���@����ÅA��.��/�"@ ��%������ʂ-{��X�C�K���٫�� ����I+��P��y&&aĊ;� `��Hq�����r���S�C �ȯ5�s�zZb�o��-K��/��P�fwJD MAc����G��-W���Nhu)fE\�L�)�n��e�g?U#���+��N���5�2��Y3ŗ"���O��g]�h}�EL�]�p4Q�^�t:M�I"?��T���g�a<�ۄl��b�,��P����J��b#��G(������O�G��J�zN�,����Y27 �[3��kAC��T䴿��_�*ݷ�u���l����|i���d.��TA0�#H�<kI}�w�6>����"Y���g& WQ^w�U���S*�12���4����,-dbxS0�����T���p����Hj%*��Uý����wb���qp�RWoM1Vsɇ�L�``��O�h��UZو���������~�6������z�)) D�>�Ε<�8��/2�XZ�÷t�z���Ó��Z#hd-\<GC�n���ʡ�� �� $��?��귙�����t��r8 ��A n���T(�md�9.��R�����TC��G�M����py�:���v{P :�z�;���B��ɉ�p#Z]�k���A-i ��o�n��7!�l���]�|�@j�ׯ��Żd�h�6�Ŵ �d��Ws³O����#M��[w!��Ҙ�V�xՕ��5r�!�Xo���$e�)���p`��o��ƴ��0<��?�K�`Ӈ��^�L��tm�?,���9P���d��U������K�������ا?�/ep�ەJ[㐌K�z��L] ���L�Ƈ��F)զ�M�⸁�h0w�W��F�Ė�����:]�Q 9��������`�M��ָZe ��GT�$E�v���k����I�B8ס0>DV��A=Z�����/�G�tΗ$�jp �w���Ƭh R�t��F����nf�wp$l�d.�V~V�$�ؑ��uOD=<���y���=v䳟w������R̿=���L��p+q���(-����D8�k4�H�뙵;� ����/����^�� p��6+�#��q�KY���q$��S�v�<�����L��'+/r�`!��8��ZHk����f��0r8-]����;��:����Ül�����O�!/2�4('gȸ�� [ƞsO������j�No�( p1+#�.�����tuQ�!���-HY�0V��� �������L��L �2p+#Fͻh��0��.o�q\�va=[[}Ofς �U?��I�!9 Ԣc�s��4��@l\Qal $�W+�[� ۉ�f�YB��#�d�yL<�f^� 01G�:���܌N aAw+b�����h}&��D��/h��/�`G�&�)ZR����� �+���&+�0��/�Gr��a�����5��p�M.��M��"�٘Y�*K��,L���\a3���u#$b�%�y������n���&C�F��z��#w��c��{/�Ym4��jU�����#Z�o�O��Ꞑ!����kU����՞�~.vҏh��B����^g%�E�ٟ+ &N[�'2����(-�^l�^w��4�V�ƕ��8�r��ak�#��m�����w���^�ḯyq��KS�#t�˵M�[�H��Q�[�9z`��U�ɶu�pSq���# ��}���B�>|��LL> �V�?�x 6f�o�B�z��4�Bb>aݱ�a"d ��8H�K}�����u$���]���ӿ��|��z�=�/��2|z�h8ڷ���t~&�oa�12�}6 <y8ֶe�O��8au�Ǡ�t���~���,{�C�5�b���b\w"��SN�p�H}��ſv���������/�@}�A63݃D���x���x?U ����5Mrn�r1�?1ٔ��=� (GX��� �C��ϣJ�W��s�������rP��9�0ͅXD,٩���(+4�����u�)���$Ԓ���N�x}��+�3� �Fꂠ���]-{��Ԁ�+��)���WYY��v�5ժj�o�|��x��{C8=`P����5�r/_Q��,�aLq%c�/���٧�օBz:d�)[&1D5�v��o��,1琲�����<�]l��mJD�g��5qݡ*�)�I�yH�;|ɻ���rR�����7T[,�h��U%9�[��gּ����c��8�+��I���]���~���v�)�K(+7W����B�*z��/�Bka[��l�f��1!ޣ�I>)�3}iJ����|G���\�.��k �/V�S<�J�J%n�~C�>,�wV��Ϡ/"[�I���AiۊO��]^̉+P�nI�4O���x���G�6�%�H��TٍQ}�9���X$�u��9��C���-P��M>ɍ!�a�������>.�<��`M�oT��s����K�J�Џ��_� ���������d��I���0V�WEZ<8}<�m�3����+��)�MR�Ixޓ�p���2М��b���xء o�"�?�7������864LIQ-��������Y� teڡ���L'���S-D��BG�(�y}^^J����Eg��&l��_������đ�Er���][����Qf��\'��y��$��y��3DX�7�]��G�}�ۈ%�L S���j;0�m�(UM�͐ɀ� �ݟ�b.D7���G�t ���ƺ����>��5-s����q8�/�Hm�� �Sh�k?��6j�ld�/`��J���/˪f&a�Q�(zn�����G�D���y>}��#���TXY��ϯ����@�g-O�q*p�h ��o-�{�� Р��a|D(�U�wc�����5W&�1vAk"�6��?�����������sy�oU��{�8�Z��S����f� �z-�֫��6`��g[1�PO�(���� �g�5�*6�2���iM0��JC7u��j�ͻM��ʚ���gH��s���o��y)C�{������u��{���ʂ<>ة�������|��Vb)�5�����5:`��3��o�eM���f����xN��:��_|�K)��W�����u�JrB�[�?/gY2M��<�ڿK�r��R3�z��0JR����qos�)�PtFZ�U����GI� r�Eq�=T��~dt���S�b+�2�g���E���
Static task
static1
Behavioral task
behavioral1
Sample
5ea0356d96f0fc808a2568c034c55c24fa642c6c5fa503c7d2172ce3ba7cb335.exe
Resource
win7-20240221-en
General
-
Target
5ea0356d96f0fc808a2568c034c55c24fa642c6c5fa503c7d2172ce3ba7cb335.exe
-
Size
3.0MB
-
MD5
8e2c427a870bf67aa462aec58a56c300
-
SHA1
11b216fdfe2589a6a33bfa56e5fb965409adf2d5
-
SHA256
5ea0356d96f0fc808a2568c034c55c24fa642c6c5fa503c7d2172ce3ba7cb335
-
SHA512
8da9f32ca98d5245ceb3eb1bab2a6920f2201b3723c63cd0f823f41262472c173e5c1d2382ce991b724d9bbdf1888d0d641a951378b206ae6423f1bff631c28f
-
SSDEEP
98304:NERY6YMQBJP5uwhVBbfN8jx57bFZ3qEb20:659+PVtfWbbbb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ea0356d96f0fc808a2568c034c55c24fa642c6c5fa503c7d2172ce3ba7cb335.exe
Files
-
5ea0356d96f0fc808a2568c034c55c24fa642c6c5fa503c7d2172ce3ba7cb335.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 589KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE