���z�%��0�!��e�j;����J�T��~-�ߍTwr;�g4��l��Q�;�����رoׁ��)p�{� �w�i�_I� ���)3�Ĉz �����]�ar�=p��O�k�'s ��<� X���~֡�G2�ϸ}�B4g�l�)x��4Q�_Z�����D��g_��aB����s����].�Ҝ� ��H�+d����H��Y Iۨ�ƭf�|B��24i��}��߆��/����-���2 1(P������^�6Ƥ]�23��w���Cy1��\ΥB��4��6J��*�>ex?7�ںAH;Afn�V�ԅ��D� �;�!��w3��~a�G���������*�1�C���}���Dl��+N�$C�/K�(@��_3��6�`M�B ��� }Z��?�� �=�����E�g�Ķ+����f@�a����E[��%�ɚ��%��/�6�[5ۣ�j]B&��͐�����h�톤&7��t�p�����yr1r(��a�pй^�Fe#�R�֝����X��'R_����1¯�MF9E�bå{p�� ?���:h��{�2p� �������@\�r)�� ���Nᬨ���p�I�IIN�5� 2?��?S�y���n�A���μ`v�r(�h����=-��I@o/_[�dm�h��@m�M�b�;��+�uY��:q�S?d+,d{��.<�_�D%��ck�#g2߬��G���t��Y�悬Oƺ�ndYV�±��%�6V�BVbu������W������m-��M8Ң��%���B绫�ؒ���ͯ���SZG����!��Qtp�&��4�j�Z�-b��*n�xS��+�E���}E[>P��b��� � ������{�=&�s)fY�q>�Q+-�Sx$�v�%'���ܠ��KS(8˜$��"�iPۑ��[=��_�#)w�����"�?���g7歴��q"�8&���*��2i��<�e���!^�N�L@�QN�I�1A�������2��!��0#�8�)È�rb<���8���m� �z���2��rٛ?��UK��{��[�9�1m6o�5ڼ9c��9�\ܤ���d��d���to�Q�P�N�'��DTtkDs���W�X�����\�y� 2- ���W�nԁ�̠�������=�k6;�j��鼔�:� ��Ɔźo�ҥ�+?c����d����)Y�x/��1O�]'��Ӭv\��T��R��G� �~`Rd�[o}?�ฉH��ʽ�4�q7��NU]Z�JzX�S��ѥc�&τ�1���Y�&��A����R��W�)���l1EK�g��� �J���sP�^���?��*�K^V0�&~�:T.�9^�(�����/x3n�A�̉���!� �OW����]u�GZI������ĩ ��?y��z��bo(T�4�O#ĥ�$��b������W�������d��!ߟ$�7\�����̶�P��6H��UlZ^��� ,�?�[���� p�K0��$��D�y,�/ 3?ɰ�X����!�|�����1m�͑�ڞ` � io��üx�?�`�b�7�yH霃 �������!s�9�GaZ~���+c�����N�UD� ���z��h?n!��V7WÇFN_� ��O���T�p� ���o�{i��>�9KڤA�[6���������^\���D�z��!�A�.ǣ���!!c�s絟�Ն�俴�q�L-i/*��KkLÍ��Sp��v,E�-��F\*��@G|l��_�l�����C��Ǽ�a�����\��ᰜfd�ēd��� �'�>�MUl��Ζ�4-ݡBW�/�����"�V�+8]��]ć�A{�m��*�㝭�SA#h�n��U`nS�`����P�?S���s`��ܧ:Iz����Cc�>`�w�v^U7��'Tr�����~�~�� 0�L�g.����2����$)��8~Lһ� ����ޜ��{����C̬^v�I?A6EY2�!AB�(�z,���F7��������Y���m�uo�,GC��o�T�<uj�3����ɞ��~�v~�_�ק!�8!�cA�]A䒂��"�O9?�r`.���ف0�o��nM�ڴzM���f�=RX��?�v@r��^0q�F�OJ��)�Տ�`Ҍ���ߪP�h Zm���Z2�іs-?�)@�49�SN�}���O�Y t_������,��t3���~_M<W{��p�o`0� i%��&��y��x�;F{��_�e�H1c�f'ʭ,��9���m����Z&���H��d�锚Q��zr�O���'����D<=�#G�������C����3f;V�b��S�)��ZP��"C2]�KDg����.a��8ZȘui�����*�Ƞ��o7���)��tK|Tܜq�0٪/��I<D׃F|� \�p/6��LOT���7lӭ�����k Fm�ӣ1 c~un��l����_:"���8�'���m��������u�2q�/߿.<q�N��������-x�������<|�k�� �����g`�T�;{Wߢ����fL�[��P�_Zּ����¼� M��mi5���]S06Blc����rO?�O�F��W*�=}�ĝ�e��Pf���2h��I�9qh��i��1ݚ3֗�^CG�κ������/��������"�����?�ڌ]�D��c�V�G5��o^��a�@NK�&Ι��GF�1&!��*�DWU������#�l���;�S���d-����ĩS��b��<�|�F}�B�f��W�MY;a�z�Ű���}�w�| ���3��3��27�{fV ݀T"��z��NB��_���|7�� M ��M���=�W�/xO�~e������ZaSg��L�6�i�[9>]����\��Ѽ4��Ky1@u%��y,�P�{���X� �g��M�H5��t��N�� �`dGҩ��͊M/���;�(��4���S�Х�7�� �J�k�*�1�p_�E6 �ݦ��B��a��\1�t�3L�����o�c��&�<�Pҷ�pb���|��*�Y��گ�+W��J�g�Ϫ� �؟:�`.#0QB"Mi�˭�L�d����WA���Mun�j���<7�E�]ZE7�7YV��&��e�*�)��h����+����C;PD���р�/'���D�j��o�e}�UGB#�X-�C���3��4�nB�o��R�Z����[�8(�$���R�_˥K�FyOwo"��U?m��>X4�ߓ��Y��
Static task
static1
Behavioral task
behavioral1
Sample
1845d2a25b628c6ff5e489f83ff975a0c8140bbeeb8ea05f5404a45ee2f9c7ea.exe
Resource
win7-20240419-en
General
-
Target
51014f1c86736d8f91d432548062ebbf.bin
-
Size
3.0MB
-
MD5
272d58a5f267fa0b7b651cf79303be8b
-
SHA1
77f9949f28e88f6ac84aa0266f33e2277e6aa005
-
SHA256
cd36a3b501cee396e3edfbedc8512a8355b03061b081154c28e04ad4dc2a8127
-
SHA512
da0461a0953df66e4666c941146fb5239a4f5505048721759bbecc1aba0bceabb2efce9fe8d0fefc27c673407f6e15a8e9747a92d5a739506bed0d346de519c0
-
SSDEEP
49152:A9IfxOvE5OvZVm6BlLZmikmSnIXRnF4vIPC3wVKxxMlj4rcqxJTcKaB6XqL:AqJWbswL94sF4b3wVK48LxJ4Ka8qL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/1845d2a25b628c6ff5e489f83ff975a0c8140bbeeb8ea05f5404a45ee2f9c7ea.exe
Files
-
51014f1c86736d8f91d432548062ebbf.bin.zip
Password: infected
-
1845d2a25b628c6ff5e489f83ff975a0c8140bbeeb8ea05f5404a45ee2f9c7ea.exe.exe windows:6 windows x86 arch:x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 589KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE