Ut�,��}l�)�h"Ū��g��Z���=~� ��%.�����5Xq�<X��ԯ� lE�����X0��/�0���7��_����I���9_���x�=gH��[T��J���vCU�����6��t��ܷ�����Y��esy�ȯ =L�)%��%&��8*��z��`H�vs��i�v��������wZ|z��4i=�o�� F�8e�iڷ� ��F�LEU�(�y�j�ȸ�hAǒM��or���H%|�dܞ���)��4x��?�S�c�<*߶�rV,#2���;�e�E�"�*�������C\�f��q+x!����-�N�S��Oee{���қ!l,��������K��%cd�\�\���燵�� ��a�y� ���QK0,���5���&/r��<R~����� M�gәf��h�v���#��3Ȧ��2u��ɱċ��"�n�+HH�&�Ǝ��6��0��QK3�Y���кn��}����߬[� ��)�Sl]V�ݩ��T���H�Ii�M�=� N�v&���$�a�4o�p|���&1�Wد�WV �'�O��D;���(o�Wb�����)��x��9XY���G�x5�Q��?����;E,�u��saA5S ��Q��BP7s�_�槟������n�s\����*J`��k�Bkc��t)wg%,b�R�1�fU�J+� ��:��p�- �� W��2�Bk�?�&N��/V;�͙�5�+8�N�F�w�&f�l ?Z�4{!��/n�������� ��4Y]��O�����9��9_��A��C_kJ��=t�j�Y� �Բw������m����C|Ҭgݚ�Vg�% @I�<��K�"�i&��Ŋ���UTޤi�HR���c_"34���g�)�*����7�K�v��a$rΒ����3��<�r����/.o�,��y�+!L�Gc��>��/�5(w�����D������ɏa\W���Roİ��,�|k�i����*~���y�J��B��ɯ�<3���������m5h�P4נE���� �WxZ�x��n ά ����k�����Sޚ�$=VmT�d�±&�qC!�%���x[��!�����8 �Μ�Љ�!İ��X�j�Jy��</'c�{�X7��&Ut�$�gT���8h��F>be"E��N��)��d>��3u8)�;����*�����W���G�[�EU��.̸ ?)��#����X���U�i����C/=�d<�S�����^�8=ϴ'��5�z�!nŴ�������ת���X�={��U�)�زJ뜮X�4��Hr2"�J�{�*��|�!���T�Q�Q��&��� ����8L8i��q�P�W�)�q,�����0gˑ+?�(��^~S��9�ޢȣD+�x��M���Yv)� �rI��l/�¿�oIr �|����<�I�@R���4���t����H��Y������V,�J����m�q<�#��2���3e"�. K �iH��p��a�stR�bY1s�K��i��VIGO�U��ԝ��w�!f�����k��*m�*�~�G�j�:"���i����pa�ؤ�5lC��j)�q���$�;�y�t��Vv�It�C�EwS�p�P�3�ip���9���O�����'f�j�c��_��ґC)��&�al�%��,��`x��'�)%���K��~Յ��2l�w��`�B�ۿ��>�r��F�� �^�UV��@jP�k�L7�$�����#k�xĮ�uj<�H�NOZ����a���M��Hly;C}3�B)6���'�#l>�(K�3�PX#����J�1¿�FXԔ�����Î�ąj�����M���#rOг��w�ˌ�_�y3J����o�C�|#�*�k���%����S>�}%&��Z,��!I�X�ɞjV�zu�a��P��V��B���7�*b�������\����}�R|@K���T�uvU�uE����i?�b�d���n��~�C��w;��ъ������8RSe�+��@����;���T��@��}�W��� �?�ޅ]�Jk$������U���D�ЊX*ؒtS����qy�{���tF96�M�Ff�2Y�q�LgI�y�(Q%�{c������.�7����x�!3�U���u��(}�A�ϔSD�$�}�s���%���9?�8`-(/�mD��)��gY��^X�8ol�>m�ڈ]�w��sH��@@���<���Y� ���/R3��"�v5CЉ>�#���p������fHte���1�8��|�s ���#t�4�����º��Z�Gº�x���.EuG���-e*�g�X�EN�9��7��f>�R(ɑ�{���<M�ܡO�P�+ŀ*��4g���!�[5��(~|�oQ}�h�#��[Q%�C\�\m�B&)$e}��`�!���k�u�3�ܻJ���Cho!��O��!Z�סl��^ e5�z��RsF�����O;n�\�ʐ=3^2!�B���-�VkTp����F&W7B��h� �}�s��֩�e�4bճ99�e���!�TlZZ-��~���[[���j������ ��+w�:��$ ?���)/��b��ϭ��Mʸy�d�Bx����&#��|�����_{[�n_N��8T[r���)��(/ �4D�Pa�6�|�(C�� 5�|��TzL��(�"��yl���+�L J�4��K��j=7�� `�P���X.^}d��*MiH�]�y?(ۀko;�������W���F-�s��� �dM�����X����>oxq.��/���`j�����j�~L��F=s3O���4(맘k �ӥ����37�xf�C���P�R%mI�Sb����M��ݳT��<��,�Ʃo� ��1?bڐA�ыDdl��:��v�M���C�x����$ #�Ll�H��s�����Ǎh�z!��x�� ��*j?n���sRb�m'��9.�/��Շ��8F��~������!�1~A���>��0µ=/�������ҷ}�ޑ�[7�Yg�v(��,s*H��}�āMŮ��4��� \�3_� �c���gس��U͏-ʊ�g�$��)���e���)E�.Á�!��G�1�m`G��\£dR�n��^�g�+R��I_�h��:Ɋ_�H_EbvF[�*�B�3G+�Dˆ��)'#7F�rb�� S(�8;�R�ұ#&��ص�W����R�L=K�P��r'�2����`2��-V�~�i�B9ۦ���h�v2�Z�t�9TD�^�7Y����f!+/ԑ�h��\)�f��[q�v4ۏ�)I��t��p�����(��X.�h�}���P_�j'M8Ţ�ѷq�?�$��8wUP1��E�4��8��}܉��;�o�ҟ�4F�:k�����q4�72����.J�Ӧ���"X��H�9��D�r�{����ԫ[u�,����(H�⭻��:5�=�YBM�(�]$���$S@��)�5aAL�pQ� e��T�_���K╨���k|���G�y�b�_��cGå�E�`� |�O!�|�49������x>���4&���&kBtL�z�\�\��=���2�������qX6�Ⰴ����[�� ��oz#\;� ��=Wј�M���jR/`�� {u�<�Q]���IĀ�������ֺ�:���֡�+�����0�%�́�H����p���G��
Static task
static1
Behavioral task
behavioral1
Sample
3253f08de729c361ae165dc234e011d4c3d373b3673bf44041d1c485c99b97a3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3253f08de729c361ae165dc234e011d4c3d373b3673bf44041d1c485c99b97a3.exe
Resource
win10-20240404-en
General
-
Target
3253f08de729c361ae165dc234e011d4c3d373b3673bf44041d1c485c99b97a3
-
Size
3.0MB
-
MD5
4ea6ff4dde2e83d0c1fb340094cc5c1b
-
SHA1
2a0cc84fbd517c32ef5de6922fcf8ab922b45261
-
SHA256
3253f08de729c361ae165dc234e011d4c3d373b3673bf44041d1c485c99b97a3
-
SHA512
d35ec10dcde1d9cf0fec328d41f47b5d0ccba9caf708ac4b408671d436c482e6b25dcb90d0b271791af1178df88626ed48fdc85db05ff2c1d94f9507a0d7bf45
-
SSDEEP
49152:F+Q8F2YgfYe9r7SO2ESe4cg0Gz9onxen0QuZ0zqI4B4A2o8kYjSgeTiiYninrXAh:bI5OL3gT9IxP0mI4mADLnrV76r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3253f08de729c361ae165dc234e011d4c3d373b3673bf44041d1c485c99b97a3
Files
-
3253f08de729c361ae165dc234e011d4c3d373b3673bf44041d1c485c99b97a3.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 589KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE