&Q���a�����"#�XL��������]G���ʧZ+�+*IA��j��A��D6�`F��O�9���+�y��."�����}����]�Y�u�Hr����u��4�n��iW�x� �ȷ� � �q�=NJD�a�f\�:�"V�v�<�@H�rݍ{\�꫶���������(���]��D. $#6�JfK�,�v;91�����b�m/oD:LϮ+OzD�`��ϔ�8 �r��]� �;���`�����OpY�\D�Ȃ�뤎v��������86���W&<�<�=+�v�ڕc��,Ɨ��d$̀�'��9��L|?F�%�R<:⾜��L��\E<�i�<�;ld�{T��}]�O͙E��nl,=���/�c`���s���j�����I��O}ߕ�"��AJ?��=~���{�"�3���0'Z���>fw?�/��'�3i������ꍌ�)6�bӞ��V���3|��וD}��rV:L?Ӛ����Y�j�{w߇��p |�:þ���>X�,�I�1��|�T*�?r_� R��>��ך}�-����/�J����Dy�ッ�*��I$m����j�{�ip/����#�p�ϭЙ�S/s| B��%,��9i^���;=��̺T(q=ɒm��<�j��[]���& m��ct��ْ%�c22`�4l9�z�hm���u��=��q2ڑok�rU�T{a���N0�� ��c��T�[�m��n��4p���}D���5w���V��Oz�9���.�wB �������>N���وE���d=?]��sQ� 8�K`fva��x�~K�q��S9�(�/aI}�` s X�y�PL��,-�%�̝��< ��� Ħ�ܪ������;m�/�PVU�7�/���B��h�"0�A>ӌ��R�8HaO>�]pە��������#����%7�#Ơ�T7fNK%~��� ��X-~Ţ�ӛ0���ת�����y�J"�sTݞ�t�NF��{����VX[Kfw��}E��R�X�P_���8�~�#l�+�(�މ(��zB�����_���z�;�����]����7��u0�����l�,����[�2"��H�W�ܢm�5�7�-ӃY ���cf~���CZL����>�O��jP��ÀM�e\;n�3�@��7�!��l���p���c�1�&T�Y��D�/�G`�W2j���E@��$/���'��݂�d!k�#�>����e������Gn#��h(�������("om�1�۶.�X]�y��^��zd�Toժ�R�S�#X+��1z���f�Y�~f�&����+v�m��T����]��)|=��QG!��p��2�].^�E�2W����=�j�#���+6C�vBE<d��"m&��#^�|� *�7���S]��3��0*h��,iџ/�����i��j����QY����U߿�F�P��̊�K�(��]�����娫g�ќ�Gp{V��/A��\Q������Sz4s���k������2��読����>��A���}�QTQ�dp�؛������:���"L�����zf5r�"t a���B�/EH0�T�t��U�jD�Z�{���B<v��>� �e.�Nz�_��( od��(�����E�?-W"����Π�\��O�|���~T��*�a�j����;��D��=꼨��62�����A���:2#:C�l�r#'�!����-=�z��T"��F��]T&Α4�+u�d���+r˚s'�lN��thaW;*#��G�ǔє�>�HnD^g����g�(�7 ���1���4��C&8� ��( V7R �w�N�&U#Ɗ(�:.��w��h�ѿMs_x:w������4WjR���q��I4� ���RaTY�J����S�g�}vM9��,0��F[j����|N_aQ�0Oz*�kty�6r~��^bJ���ce>>�������g�X��x��\G�z �/P�.�֝��$��2�^l�����@���ع���İH�TI�� ��cꕈ�k�g��)^��H�Mh������w)�N���t�g�Z�p��Y��k|b�+{�ZSqb�7�\<�BT��P&R\5T2��M7�2�<7]ʳ&H��m���] �H����c�o�e~Z%({����鷁#Sr��f��3!�F`���T�f���� ��%i��%8�)��e�/�����mmr6g���]���9�$yr/}#�0q���=��_LJag�Oh�_���;��B��On�ڙ�����:�q�ld�m#���jK1^��T&%>�!xr�Y�h��cD���N��H�й�GM��yc���;N9�M|mЙ0ҥ�{)��RmE��]3~�˟�8�{y`3@>�k�����26��?d�~���_������h��� vs9!���i�"�K��Շpd��3��>E�ol�O:�Z3ݵ���0?D��-��_�CҜ��/���{~��;��+���Mn������$?)4�.����$1����r��e��*Od/|#U�Ax��~��@߹]k�N,J��#ej`A���v!�k�2Q��@�*19P� W���.宐 <'�Ďn�m�3Z'��~i�-�J�aI��3���rѤ���� ��+r_��ʼn�a��9 }9���:������k�������R:R����ED�\"��� ��Z�dG0ОC��8� �� %;U�.7�@z��N>�] ��oШS>v@�Ҡ�3�K@����=���g�Y��}s>�De����ֳyV~�$/pB�R���@�r�b��6]-��)�5�@�l��h{Э�i_�:F�gM�a 8<�ʌ���r�����^��@�v{�/�Bk����*�5nd���/�E�nZ��L<�d y'Y�4u�u�Ίn�s��O+-� -������=h���f��amOdY��O�l��LU3+�X���a���P�@��d\E�+f"*�[���\|�ѡ����1�f��엷G��I��>e��v���kS/so4Z*��b�X��B3]�)����HJ\�� F -orL��ڛH�Ĭ��|�d�[_p��5⏿k��7Z�&�lL9&�T��^�PԚeD�|�c�@��2�A��B�4�G�ac�H3>%��k����\���Q�g�?��3Q���}я��ڣ�H�]?�r�k��u����5����S��'�z����~��8���� ��e������ �MY�GTF��ϵ%�& �N�հ����d98u��y-��m�r��h��E3��QL��`vq�qKO�HۘS�)z�f�C9�ژ���BA�˥F��8�mmpv��6���в�n�HfӅJ�i�Q�S�x���48�)�G��u��f�e��-�j��=愨���O犥P��a��SUv�y~�A�n!7"��ĝ�DE3�NUUZ������<�PhH�d���� �Q�&�n5���Gd騢@g�{�����X2%�W�L�;�)J����Mף���b���F���.���<��U�^0e/2}�%�\�����l��'����_����gwߜOt����))��*ά�UH�舎c���e�3�Fd�v�����Wl���Zcà�Jf��'bua-�SBP�}�£��x����VB�c-L�~f[�|c����CE��T�����Ե����5w�J���:����U�"���%v���x�cD��B��/���ˬL ����6�O��ʧ�Rr���EC�FS\8�D��2�<g���"�{�x�GY�ݽ X�ݮ�Q�JQ���@����1Q����l���̕�V
Static task
static1
Behavioral task
behavioral1
Sample
68c861f05da52282e0a68fe88f5e9a29f542e3ebc33ca419d2b16da353df3589.exe
Resource
win7-20231129-en
General
-
Target
68c861f05da52282e0a68fe88f5e9a29f542e3ebc33ca419d2b16da353df3589.exe
-
Size
3.1MB
-
MD5
e841704edcc2554ac081656a1d6865ff
-
SHA1
8adaeabed88a4ee92f20a2691e0d8a3b330c2adc
-
SHA256
68c861f05da52282e0a68fe88f5e9a29f542e3ebc33ca419d2b16da353df3589
-
SHA512
558a4df7c726aa0955b0a12cb2080cbc5844a342e384004d2fa53d05b1bb7742c2283c473a773d215962ba904438913520e124dbd8115fc260918d7478403c02
-
SSDEEP
49152:ViXylpHbmw0fUaPG1UlIs0TnY73Js9958gtwrta2iHOzzGmnSaAK006otWoL:VsWa+1UlIsQY73JsbiF3pSNZbUt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 68c861f05da52282e0a68fe88f5e9a29f542e3ebc33ca419d2b16da353df3589.exe
Files
-
68c861f05da52282e0a68fe88f5e9a29f542e3ebc33ca419d2b16da353df3589.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 589KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE