w�$( c�!0& -�:�ɶً���N��n6��v0�nn!���.��\��/r�Dd�J�hy���W�`62e���ײS ��zʴ�I�.Y���x %\�d^�7;��ʠ=f�� �Ц"i녘���`�G�S_���',���D7��X)Q��2�˺vy��#EO��Fg_4�y�gnO��v@'L���ȟ&�eV��yA�@ga闶�J{nN7��s��}0�,�[��e'�(�������]0��l�,/ː�����ӿ�����Os*������ȩٿ$@��K�:Y$�Ps���e� iLw�BՌ�`p��C�Q���m��Hb��<��^�>7|��c�cB�g�_:���q+�ԯ�fV9dk���ː�� �J��"�}7^��r����x��o�^u1B�>M��Y5)��832�'E"�7��>�����#N����J�6�������_sG�e��s�D.ѭ0-ޅ��~��e���H���(�O���N5���r^k|��)E�#���J�y�c�n��� �O��F�z��i�%q!܁ wW���ͥ,/�b#;��x,oݖ2��'~�$�$�� �D,dP��:z�x�<�A�6[�Q����JSE S[�3[��c���������_s���U�� 3���b;b�+;������_�-�*���^���akq�*H�6�i��|5���~S�z|�(�*��9��e�5a�Q���{��(S<*�e8T����;��&@�F>h�Y��Is űH%b\��5�7!��i.j���a��}S`�=J�+qH�;��扵ӿ��N6�$�v/�R�O<7M+rK2�g{�z_G�������վ��D\��3IJ���4T�OF=ŧ���W��+�Y����ceqx{�#@��K*�� A���Jן'f�V��a���U��q|�J@���i �>?���n���L�C��U��(� �6�cL&g�8��BE�%j{a�:Jjo��4��;�EV@+�/�0}���I�$77[� ��e{9B=���aPqR3䄨V�Q��6���\���[I'����M�Fa���T���m' �o=����.�l��s-���@�p=�qUj���r@Z5J8=�a��E�{��1�����eO F&�Kְet.b/4�� � 검�>���{�h�D��|� �ƟҎ#���6��"��ʍ� ��2���DC̈����/:f��42m��5�#E���������A���o�ź�[�)|��2f���?�AN�*qRӞ�~�S�Z��������^Iu<?�/�"iw��P�.)g9�]�� ��*�{��1��o�ₗQ��j����n� ��i-�1lo���.���h.�_-8&�Z]S��פ ?��@� �iF,��K��Sl�D�$� �춱wh^�ZA�H�[2��}��<U2�Yۮ�x��[�$ӧ-�7:('=pGTE��S�'n!�F�=D�S���{�� ���Trjmi���!b�����6�;�~��Z��RL��V\yO7��z�딨�]�4�N�@$5:������`�x����q&��M~3A�� �y� ����*���7�1 �ج`���s��@�)0qz�0�m� ��r��$A���(��C����+s �J�;!/�~��l+��}6�v��F�b���#{���CU�pQ�.�O7��|��teU�]�/0����\��#6*���}��Y��P@#��$��s�o_r���g_v�S��4w�G���gy�vwt�������Zz3a��m���������A ���<]�ZJPWZ���!y��0B�v/�0���J�&���ߞ��-g j"xE�rM�`@�o��S8�}M{�:9r"������O���7q��y��%:���ة�ТĮŽ3�X�%[[0 �m2���.��s��=I!�����g�v(Ɲ ~׳0L�r_�4h�J٪3r�pt���&L��|sO V��_��;s�(�|e�ˋKz���Q����u����v�7���֟"Wq��է���MՀ�]w�'?���A�0�9�l�"֧H�S+0|m��lC%��x�o(s��b��s��<H�`; ����rR�a�T;�.4��g���:3�;qB��/�~�>�sLI>�������D�������gأ;nW)�^6�V��ǶBkh�$X��d��k]���������J�!���8J��W��岣YΘ�;��\9ٶ������d�r�u��p[l���Β)�b��Z��˹�B� R�=�n̂���9��IeO�B����[5�c�%1-N�Y�m�,K�b����i�!����]���=!h���#'))8跜 �!B��~�]*��Z�L7�v �� �����r�N��oBQ�"�&��6P�'γC��IgW�4* b��c����fUS��{���I30�V�e��Ud1��@(�R�(b�7��(־�t���#`Ǿe����� �b��c��`�诳�w��,,k�� �9�W��3�IǶW��0h;�=kl�o3�:�½��Q�o��7c�Lm�h�Ul0~�}�'���^g�!���\ȏ�B$sʂ��Ie�$&1�G �t䂺N 6"�7&�2��_�nj�z>G|�glp���E8��OL8�S^��V�k�~�z�7V#l_�G@9���H�o䒢��I� A�9,Y��yV ���kGQ˼�O���Ϙ1���v P�4��@�3��/�L�V�<����=F�Ṏ���D%����;j���Q��4,1eL8ӄ��Z,�T��+<)�H�AM��sČ�'63���� �C�#$�%�/wN�f�2��:�܆��=e7L�5I&�uHg�'���~t�4JU.nUNº<��B9�P��k�P�F��{_r;�7�]'+��d��W�U>��{���~�[��-g)�ŪZdz,������""��oF�S����W^7۶�#g�8e�e��� ��E:������j]���y���l[������t��Ȋ2K�7�MW�<�����۵V+�.� ��5��~2��[u3I(��l%�Oz�)"�c�C���X����`�E�9k�����p�~?��$��PƟ-74�L�A�G�D����D�eʍzP����Nu��߮���`�C����I�5���Ƭ3mr{ ���A���c��*��"��+5�;�jVo�>�`���Ĉ8רf�@��ŤXk�b����� M(�P����9��`��#;��{3�!E���+���U|o�c�7���"=��v֓��Q��R[k���͒UA��Uz2�Zϣ7�3�����r[�QO��LHЋ]M�4)��u��)�3��������q��:F�w�'�8_��9ӝ�""ʈ2P)�(�BF,7�$ c���l�f������1�E����/�٥nK��F�32����o�7���Rڹ3���i4y [�H;W>����3�`�>QQ�Ǵ���s��E����p�[*W��ƌ<67�gh�,Lo�Y���U��l��s�x��^���q�<���84��W�+�ظ���P-K)-����+<t�-%��aZ����5s�X�b���Q�?�g��FQ"�,��]��I!w~�fO�fț��T��v*26H�q��NJ�{'���6h�!��$&KW�E�F\+�����DAX�b�{�ٖ1��_k��Y�2�`�WÆd?��ۙ1�����V7�.�fN$p�BN��z�'�Z�"y��ݝLd[w��|iBQ.O|�y�dD���+������_���-{]�6|X�y|7_Uf���ֿ�搘�'Ŷ: ��܀�W%ޕ
Static task
static1
Behavioral task
behavioral1
Sample
c2a83391757a0e0cfc35fb319965f1b823fb2e17596d15c548b621c72d187069.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c2a83391757a0e0cfc35fb319965f1b823fb2e17596d15c548b621c72d187069.exe
Resource
win10-20240404-en
General
-
Target
c2a83391757a0e0cfc35fb319965f1b823fb2e17596d15c548b621c72d187069
-
Size
3.0MB
-
MD5
3cf0f00d5ad30d11cc538285268fc1e7
-
SHA1
5c1699ccf71fc09a5093c9ba63f74ec4ff2e4e0c
-
SHA256
c2a83391757a0e0cfc35fb319965f1b823fb2e17596d15c548b621c72d187069
-
SHA512
19cc557cbec9ff947af31a14a43ed0fc816557b84dfaeac597fc6eeea380fc69764be4c76058b99c1b687523d1ac475e6ec0d54f3a616dddffa31fb1f8991032
-
SSDEEP
98304:Pjj7rkLpky/jm3XFHIaIEA8ItPyv3LhL1QyW:fojm57A8eaL1CyW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c2a83391757a0e0cfc35fb319965f1b823fb2e17596d15c548b621c72d187069
Files
-
c2a83391757a0e0cfc35fb319965f1b823fb2e17596d15c548b621c72d187069.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 589KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE