$�ٴ ��`�\)�\Y/u �کx�كs�8pF��]b���nn�u��Q�s��[{��9HW�YTRy�o'H�����E����W�F�p��!����'��le~Ӎ�.���p�vP����!5��+�#d�};gܔ�8�,��U&�Խd��#WC"�V*�'.��ز:_���(0��蕊���(�M��'�{�r��(~�[�3���5IY���h>#Yd�}�m\������b������]u�|�.��j/��W� �3��C���C@*@ ������8v��R���l��fc�K�o���kĕ��q� 5fk�(BT�jբ_G�W�ڽ����Om��Ŧ�f")/*Vo��2�SнXƁ''���,mm� �.�!���0�\��-D��@��)����d�d���̗e&�2e$BD���B�ˍ�+��R���x�s��^%'��U�香���gT������9_���.q]���d�ٟɈ�����S 95bϝx�f���'u�V�@��W8R2�O7fg�̃�s��3��)�#�2��i����zl���~�=��j�?_ɭv��3��5��U�|0J�^������}����>sAZ�b_q�a���P��� L�+n�����伆U_"�9�n^�'o�.'/<��|B�*��<��6�o��9C��I�Z���~f(N����Ͷ�9rF�`�$��6일'�����ä`�\��͜��y[W�����%�`X���s�!��~D>H~/��|c�Y�Z�^�hzYK��Jk +��o���4�N��H���<���>��h=T�Y���� ͘����a�X)G��|Nj%6q�1�� M^](��/ӗ�h&�Z7��+<t%��=�)����6�* ff�B�g���D�U�ؚ�l@�;}�:4��v_�p��68����]��1�F8�p� <��Bd�P��@��Z��2��,)t�Yf�%�W4�QT�ng�}�t3��)�K�~Dz�g�����?���y��¹9��:��2�������������V�OQ����R2���Z��QӳY��Q�VM��qv�����K��i{6��j��a�?7��%�}9C��'��K��=���E�����m=��?6�K`�J���>H��ˌE�D#�!�Se���v��vq 26L����h��O2Ԫk�P� �q�E��Nh̃���Z��<��R��})܋`����m[�|�?:x���==ݿ JQdB:�i���wz�UZ���d�aI�����"�U,�f��#��&]�r�dD��Z:���~�����w<�����;^�������q(��{ �?�EQL6ASJ]nSFn);��T��x6���� J��Lm��&(k�pn4$�o�%6���~f��1��=W�caך;�5����?�ÂJLMD�:�h��1��T���J��F��jѬi�}�q<!* �j���A�A \Q���Bs���P���h��CW�T�ڳ�ꐣ��g�kb������ۏ�?�`3$v�~� �7?���WJ!��.d��*�*����)L$�>*��v� ����f]u��b���T���8\�sH���:j����Q|Ɔ�cM A*�V�01���v�̀�/��8Ð:`)���8�Zt�$J��?���':�/K��C�^C���l4T��vi�pՈS㤃�1;Y�'�A�Q\u�2A%R}c6��7���W_�q�˷�.^��i��hʹ���^��&G8�� ������EZ7�Pù�@.�y44�1�+fO+(�.04�E�������B���0y��n�� -��K̟�� @��L�[V,��)�E <L�/��#�M�U�x�����̨��^U �2;p�ۭ�?^�Y���0j�'s�>bC%0�w�\4-�"���D��������eH�k�v?lt��5�~�t�k���hc���jQ����2���yLS�G��dx2��-��#!48�I���)Ao�qǏm_1����pSE�旅��mϧ�qN�{1C5��;��k:1<���Ϛ���ٚhS���ՅH'\R�����E;s0CӐ%e>.d�l}��U2U����2�HlK]��f�ri����#�z�%�7}Fw�5�DB�.CuX�XQ�,����䄔]�Y{�����P����e����=u�R^� s��w �L.V)�L�r6�R�%���p���n��<�f:�^��;9[� �$��{���Vr���&Xoi��7��������N�ԥ���ggTM�V}���0MF���|H��{�u��{����l4�tF�T�e) / �ΰ�Z� ���]+�i��=����\�H,�,=��Z�� ?�N`�'dns��0Ώ�ļGHI�R�����nܜ�m�pbȀ:��#臲\qi���C���٫r��T'"K�hڢJhc�+��O�����6:��N�WK�o'6�#SwMe��/>�/x�E����Hk�s7��~G'&xK�z�[;F[e�SQnH�]Rq�$��e~ҨD2�� ����M�6�6�a��D�50e�Ga�hpE>��@�M-�]x���tD!�I�5Y�a��{�2��K�t��?r9�NV|DOh%}I*V�z4C�"�J�(��A����v�����[a��0��[�H��+Zb\�o6�*V�5sN\����kb������!�����>FH%�F\�l����Д��4����K岓D���>v�V�T��p<����m�"SQ7l���1k���n�L]��A0����ajꯧh#�t��Y|��r��2�hǃ"��3[�������[������R����N�3,hS�����l�\�)�iU��q�e�;CU��ip��yeF����c-��c�/D�j���f&X&~��BdcI�ռ�:���2��`*)��һ�$�ehۈC�R#�]���V��_��Z�(��g;O\������������W����G-ǹ�V�����t״�m%v��Ǘzŵs��Ӹܒ_8ljaF�����o2�~�T���a���!����Â_�APrR��˛��"h�)s��\<�ؚ�F��G��y�8���s���h��<^5X�#g\�"��R�L&�,����/>�|���QtW��c)A?5�������5?y��ړS. �T�^EϢFC��`;�wa��w�@��a�ay�P�ڤq2� ]̄� ���;$]�H��Sݚ>S�t�ԑyA�ۡ��j�<h>PAA5�u��>q>���. �� ƫ/eY������0|��
Static task
static1
Behavioral task
behavioral1
Sample
8e2fb04e334931f75bb918eacc71fe6939b1755b099c9e8773aeef2444ffc740.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8e2fb04e334931f75bb918eacc71fe6939b1755b099c9e8773aeef2444ffc740.exe
Resource
win10-20240404-en
General
-
Target
8e2fb04e334931f75bb918eacc71fe6939b1755b099c9e8773aeef2444ffc740
-
Size
3.1MB
-
MD5
67ac002d9ead8027e044e30e3eee8e59
-
SHA1
fa70c79db5cfdc09c2d4e3ea495cfc31094705d3
-
SHA256
8e2fb04e334931f75bb918eacc71fe6939b1755b099c9e8773aeef2444ffc740
-
SHA512
3b2e9882dc12ddd08966ee379fd296b43c4652885a77d2d46f0cdae1dd789aecc67996f7ee3550ee68acfa9d482da8ad53e99fea93af9faa4d52138cc3ac9eb0
-
SSDEEP
98304:ZgarM26QfU7WUnVUhLg2fts7I1EkRIQ4941yhc:ap2vkVUhD1sc1E6IQ4W1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8e2fb04e334931f75bb918eacc71fe6939b1755b099c9e8773aeef2444ffc740
Files
-
8e2fb04e334931f75bb918eacc71fe6939b1755b099c9e8773aeef2444ffc740.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 586KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE