Y��1��I�>��������ʵ�_���c�(K���`r���'���=�����0�t����ra����g ���hY$Z(�[÷��^~i��ʕ����=d2����0�u�D_��~�l���{g8>���q�1�% S�D<5U���7ٴ-;n/��.�9ŀ�-�j6���k�2�~���..��~�kQE Wz��.���Xp���t���H[|l_� �6��V��������x�"��=Tk7��� .ǡa@���~W�П9���YY̗�NA}`�qXm3"�Q�|�9L�i����u��`���?,?������B}#.(���M0B�<��I=,ܖ�ur��bն��� ��Wm� �W�b��yy}\��z��J�_huա����ӡ��`�:Y3�0ŏ�C�2�kX���R��^b�PG�n���Q"��U���8�D��.)0%��1��xf,� "pj�<���j@�jN7���M�-pz�����r��� ���{H��!v�Ek�(8�ʄ���diP�i6����&F�h�G��(��:>��n����{������:dÿOD��l^��0"�v�2��I�i�[���'B�Ũ1'��a=�=��e����Bpc.���]���sD�DE��J�����m�۵8 �q�u��]����Xu���k�4��qc����t��:Y��oSN� �zV������6���˖d���3�okˮR��(���7w�:�2Z!a����d-�W�����1Z4/g��H���R�����4 �~AEiN�gH-9�Ȃ�̞�C�{�9�������އ"�pi���շ�����ŲYr`����㵖Ɗ)�M:�Qk�"<;����*_�*c�a��7eS��?"דe��Ԛ�5H�;���`������%7�"��a�8<�HIDžn1�zq,~A�'y�̝�0ET<K����O �gC�2Ȗi'��֧�O�Q�?]Q���j���@(��9|�(��tdQ��t�nd|�ܰ�wEzE��d:���������"lD�AA�eT#R{:���C���Ե{{�uvp'_�=Z���u��&^��G_���Z�<���P^������=��e�=�d�Z"+Z �!p�I�C�x)������>E�?�|���i�c�p�N�M�@.H�w�}y���x�l��S�Y����ϑ=t;��+�7��~���o4u�K�����=SLS�;A�A�R���� ��֯O={��dJ�����/��`�.P)����$�Y]'�E�A�K��j��J��g�mlY�I�ƻMV�9Zly�d�[�'����s�([�QT 6{�P'��t &��k�|�3��e���i4�Y�i4O ��9���8��?�z��H;>���7��!С_Zػ� �M!v�������'���+�HP�S��L��x���T�w�ۛF.>:�rPX�é;�/X�����\#�:� �c�~Is10�ț� ��!G�g�Lfy�0���p-�q�X�߽1���6�i@:�$�i�g,,h�� �� �sQ;f.Ȍ;#XC���O�h]c=���DT�O����m�l���]�'7D�4[���U۾s�_;����:��H`%���#���+q�'[ ��h-�����6�# ��F� ��Ir<�&m���*��?S������c�h�t눈�n�;�>���^���#����� Ү�1���#�"�5�t���)-��tC� ,W�F��o҃���M���~F!�?�K����H&�U��^��L�kM^����Y�l�Ko���<���"�0<n+�� ���}�:�,O6���. �������_"�<��� �y�A389��y�l ���� �T�T��X��c���7De>�N�E�y�BN�L�Z ��9������:SM��vS�|&�@O`���P*DL>���.��,{��$��� )�B�3�%��ezIu#k�Q�e{���)��f�_ ���"e:R\J�_�n@��aȮZ�e.��U ����0��"]�V���.N����V�PP���3�m.J�9����|��B���&��t�<a�4X�O �� Ж��C;j�^�Z���ΈZ�o]Bm8Դ>��yX����̃����� �F7ⅻMg3�����Iƅ���Z�Da�md־.�r�9Ґ m��q{9B�+DkSAWl �Ua|���{��gG��C�3��"��5�FLT�,�Gc��XKޮ� ��H^�N����9��N�/�������d����YN����e�h��ʯ%����u�J���� 0{�fT��v�W����{ ��,�`�zX[�!%7�W�V/-�f,��@ZW������)��� ��x�ֆ�:�$W������Y5{x{��C��r���LΜ�l�� W4��P�A�p4ɳ�2�SK�砋9Ot �!ߝfLI��ct����#�6�K����G��n�bx�ڥ��3/��n��DK�h;.�{�� ��EB�� ��/e�4C���_��W�����I9����&������f�{PvܲL���oD4jikpY�X��7B�5��"�+�c�+����3>'�҆6l�֥bDAMy�&�>w9�� ��3��ă�C���;��u@:�5�����T���8���1#��PDb<��t:���='�p/v"�[YJ��:��7>qL��_��Wo=���*S$�1�u�%��fTȜ)�y���?��lAlP,���l�$�����J���� !Tk��5��o5)��s%��/ ������֊�F�*)D�V ��GC<��`��M�j۵��IC� �e�E�/���cS�b����p��GO���D�_���C6;lr��P�.���_��HUӋ[.�q8H�"ߘ�vX�s��bsO���<;��R�,�,��m�vG����SZs;Q���/}�j�˧�����(Ug�ٮ���Pq[*��T3���uC�MerÖ��:;EB~�j�e�e���V���[��jDe��H[���j@����`6�J�j������6���MJ�/�VR$��jLk���R�USG�y�QǾ5G{&Dd�� b�Mz^����@��Zנ� D;j;B �?�ݰ08���l-'�� cـJ�k}��;���ȸ��=��D�IO� ��u���g��/�v��hEl�=�rS��[��fm8i!\w����T0�E��?A������Z�,2�����~�}!1ը��O��ki�t����z��S��I��e�l�9����1�B�fT�b3��iS��<quU���NbY�������H��y]D���P=���������*W����V�v�P� �ce> �xerI��� ���+�2� V�@�er�"��7F���>�oj`�Fփ�I�qr[e�i, �
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240221-en
General
-
Target
file.exe
-
Size
3.1MB
-
MD5
9fd353d70e6814ecb7ab0c866feb6b7e
-
SHA1
8188de0d62262de70492c99c1896aef863f9d16f
-
SHA256
55e4ffb722e1d63bc290f049e43c140545bc42571dd18ff9e9d7d9cede622025
-
SHA512
816d27d6c47968538eb867ec2651e9da23dde6e02c8cb314f32724e22763ad7daadcbb59d3f02bdee034a1a202bef7573823047992e1886c24ae01862f14dcba
-
SSDEEP
98304:ixm5AVfEpAvUUuQAkRJxMJDq8aFo9JaNiKBz:nA58UuQHJeJDHbUjz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file.exe
Files
-
file.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE