b� � �S���E�#%Hxce1�HR.��,��,�۪�/��M�EE�����`�bI�+(�K���B�,�p���`8���ެ�t~�����%0J��Go���Cb.q�h��(�Up�N*�ʧw܁��A�"��a����Ek�aNHL�2Bb5����Lp5?�%s�®����Ɩ�5��,�!��t�^��l�maOGQ��q�C�FM}�!���8��� mL&��}��4�o&��Gn�D��O(̛�m$���]�o�p����lW�ڨ♭K���`��_/̨A�4-N;nGf��_�<��<%ۻ��4��Z�{D����?d��99{��9c��\�+F�Ԝ4F�ը��>d���z��5�Uv2�<E���i8����{l�� �j:�ŋ��W]� � ��������|H�[^@e�O�R��'�|��|��q0p=����Cy�;s�^Eۯ�W�%p�N���e�����"v�@9�v��齡ph��Bc��T�d�S,~X��<���6H{v���oVAt��5�/����+�E3V��H�c��;*x��S1�p�@^6�$h�ߓ"��_���B4l��; n�*$v�7�Đ�n?��2�ޒ�$�2�Yz)"P���#��&3k�+�,�h�&B�v!�N�bN���t��y�x?�Vl��j}L����g��fF��UK��7E?�L�=P�q;�he���������W������!_ت! �=*� d��A���L�Ɯ��br��8q�H��Lܺ���^�bt�O�YM� [Аo_�orEs��'1^�6�>i��l��/-!1)I�X�c��\��b��rF���(�B��ıq��������`�莅n���;�σ���a�r�����1�V��Wž��mB�����0;h+>]T9�8�;�E,�/�'�t@�Dn���4��`��)F���1�*t�7(�ZQM�ņ0��V����}�C��3�]<���sh�������fʐo�=L��������6P��8r,�L�g�'1c?�i7�&�a�MYNa�_B��ae7w��[ܪ�<�)�lBlz�)l������<�<����_�q6��9 hɫ�68�٘v��մ��"���F 'f��5qMՎ��@)4�NJ@�Do�:���Ti��� ����b����~��Scy`�+ar;�� vhXGGp�)g��䓶"���_dդv�ا�Z�c��S�S���7OW�_��d����e[�H����eg����ٺ�.�P"�t�i��ɵ�T?>��l�&'��͂����y1Р"̑Թx����\K���{V�a�v����WJ�c��H�E��Ӟ�Q3��j�����;~P��Mꍿ6��WSl�p���Y��=�F �:��͌շ��_�Z�� ���O#d�S�~�n�g�Z�k�+��SL@�~����>,�%�qV{d(�r��B�����͈ Q7��:o�gP٤R9� j�r��꽤p!�H[�^^8L A��y����- �5?ݮ��x�l��V�� F�o�f��K}0F}J�ؔ���c�>r�Wa������?yh+(�������`T��I�D�R�K4��G_��8�A��s���j4�C��B7��,��Iuf(p����g�l�1B���3���f;�M�/��Ì� *`:0�PA�����W�"��;�Y��~�5��#��y�F�ܒ��R�M���XP��}R�3�T^��Cg���Y�ŞWli�$K��tR�90��ch����ų�{4��� S�p��B�|B�)v�O�h]ڛ����-���~��u�\k8��pm�t�О��Y2����LXWH�mh�������N�i�+������_7k�VF�٩�o�~����8�1~����NB*�i5�_$&�TY�N/�36*��bQ��csX���^����� ���(�V���6**�ny�'�d!���w�zF�҅CV����6^'_��RxtX������Q/Q5�李5&�(��Eh��r+~A�S+=J��O�� s��*�]���֨g~W��خ�P���vө��1��`|ڮ�R/�K]>Aֶ�h�#�R��k" u&-�*7�gD�t�#���L~6O���!,�ɿU�7��b�&A3|_dž|���~�H���9����������-��)`�\^>_��(��0��8z1����� ��v�G���6��d���C����<4����H�\�`J2�aȰq� ��%�xh� g��x�pAIя9��v�҉�3���C�K�8~-N9�c���<Ҩ�ɵG�$E*�%~�hi"�Bu��J�|��?�[��Ҏ�B�#���$|��VcX�x���ǃ�Y���)X�lp;kbAo��.�>3�GNh�`��%�S�VT]��ԉo^��S2H)����q��0���ѲF��hJ�w�4�����7+R�@���O{�)��p��)� �&!��,���1�T2sD�GKkM*1ϓ�M�����N��)��Y�*�0�.���8�� 11�[B����b�ܝ\�Y�}�e0�҃�0���=\y�5x%D�������¯��r���o���48.���P��R�H�P`Z⇪�"�͚2�/학��[�Nm+@JJ�pi�qB���2��$��4>G�������DP���W����[j+����'�Fkn@>c��I�˭�ԃ��W�A\�,n�lA�e;�Gp�0�ȶd��Y2���~�NNY�NҘ'����ga\�����ƻɔ@��l@�b�oAU ccpv�{ύ�ZR��ĎI ��/�3�3��p�أ�Y�b_MC��d>�����d�Y������A'3�^Q4s����J��3���ק���#ѽ�e� �� �L�߄������x��@��������?��snT�nf�r���m_�����c�Ñ��1������Wu�����S��鈳��.�m�г�5'�Iٶ���}5�/Kl��9��G��w_}&Lc�9�b�g|QaUa�4O�� 돲K�|kQ1#�W�f`���D����uڟV���8`FE�ɣQj���0����g����*j��l����&8(��O"`��9�%9�}XZ�t�C:ܕ��aV��ZL���a3��Uպ����kƥ�E���k�tu"�6�25/~�5����fU���obS]!�%|��tȥ�#�G�^]�����h�h�����7��Q��G���+^�a�S۴�}���2<B;"�d�C�ؿ4��c���]�:��+�x���[27K���aZ�D(�Z��A���O�>&����uga�+2�����KȊj� ������F[����z�'T���N)�N�1;((>eD�w7ٴ�6E��x�?E���܂�K���9���4 ��T)Z�g<UKȲ�}Ais8_��)�}�]���3�cC��<��/�{��h�3�[�/�R���ވ�1��e\�G�;55����<�s���k��z^�%�Ξ���ҋҀ����$8�T�%�t�����hTG���4͉S�W���ߏ�Ϣ���:^ ���.3�刊
Static task
static1
Behavioral task
behavioral1
Sample
d8eaef16d61598442f40a983786ba614dd3945aa9afa65634a49acf56c69e761.exe
Resource
win10v2004-20240419-en
General
-
Target
d8eaef16d61598442f40a983786ba614dd3945aa9afa65634a49acf56c69e761
-
Size
3.1MB
-
MD5
b19ddab2241c6d007fa2d2bac4b44a91
-
SHA1
080c93d72af1618b6597bf6186504481d0f601c9
-
SHA256
d8eaef16d61598442f40a983786ba614dd3945aa9afa65634a49acf56c69e761
-
SHA512
103112f2e5e8906d6d14f84bbba599ed278c43b5a196b41d34a2c510fc64e8b2d547ce88b78eb0f83adc8742fa8887cab26961d3b9fd21ffc9515fdadd34c6c2
-
SSDEEP
49152:k0u7HxVRYKV2kG4mDOAoP1wxNSOc/d+ByJtljGX1HU2d5pb2WsjYelixD:k0qHxVP2Jr41wxQIByJHGFHXPx2y3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d8eaef16d61598442f40a983786ba614dd3945aa9afa65634a49acf56c69e761
Files
-
d8eaef16d61598442f40a983786ba614dd3945aa9afa65634a49acf56c69e761.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 589KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE