U�`�g�-S�*@�XG��l{�</A�V����Q"`��t@�/�$ >}�%�A��*�M" t�-W��Đ�м�j��`6!�\Zb\��%l�� |�Mf�~�}� ��o�������S�c��U�/��s��W�J:#���@Uogc�, *ۭ��&p��Kw��S��,�p��(&?��,�O �j:�8��y�H�f�2:������]1S�A�7ej��@t6$ M�h����tG"0��E�0�M ��jف�z!0�?W����ˣ~����^���f��0�Ψ��$O��O{�zE�4�Q� ��MV�A/�������b� �,�S�G��Y����vz��f�-_� �°�Ĉ�Y��s���o���K8e��u��� {`��囁V�8s4��ء�����9�ө����S�T6��x��4����LJˬ��"&��+M��Vp,b�6�87��iZ�s���% �g3L��� z3k�R�C�ԛ�k�G��"t&����{"���^����} G�����X�P��9;2gK��rH�K܇�����������ŀ� ��+�� �۞W`.��~��ƈ8~�>�m��Gf�5��O�"�[���Hd��]+7��>���%oŪi�F0���9 �;���O�*����a�ܺb�?Q��-�E�����6��U�V��}0�� U�0#����膢��ma�"��=�4)���tb�j���v>}�!��[�P�Y�ǤI?y��aUf��(i�Cw�a �P�<+���Ӟ��c�W�8w=�D�0a���U~���]망*��h�٦�F�S|�d���:=�� @����e��1����8�v���S�nD�� 4+�Z�Ly����ςֿn�J�IT��̓���Jd���}J6�`@x��V#h~��� Zj�݀1\u�5V�vA)�J��P�>��y�����@THiO���3v��hn���N�o˦ �k�� c�”*���K��l&��%�ܮ���t�����џq�*֏� ŭ�ܱ � V�S�.���G���)�|���t����ȴ�M65��-��^�0�!MS������5L�����IB������h"�H7�v<+�������m�`��@��Y������H �q��.��Pg�[�@�HLk�I"��A*x�4v��>in�r$u�t�s�����}m,A�7S��*��sM,�JX��#�4�������=:��=�.j�k�������� Oaِ���Fe<.���Gf��-�t��b��Š*~ ��5OQ�RF��u�S��u�.b\A<Ô�oK�QOccn�2��֟bj(_on��1�{ %:?8~ D��i�qB+�3�d�lf��y&�0Q(�㮣�j�v�ؽ%5� �P���\=������1���'W�)�0[)�g���=d�c��W�憷���ݬ�%ժ�����ti!��X�{ _���E�� ����?����q ��"(�%��,Bc���U��B�A�+�� ��]@���� ����WHj�)v9C\a�Htқ�=��_���yA��������6��GrĜ��`#Ls�f�Nm94��5W*�0|GB�WM*�����I)�K����@�t� _$���0��:^��Cv�(���14�.QN�Љ�E@խwL��̕���49��PJ����0^�X���.�[�%�Z7dz>25"�{��dd&�3�b�A����@������u�A�5�u��aN5�[3�EHc���D����WiMK�8��M�����{�o7�/>�J_b�~�Ӥ�+]j;G��d��ݻ��0vZ!?Q(�n���Hd��]��_�:dH�e��,rt����;d���b9ǐ���Ȩ�7u�Ki��}�P[��U4�=�N�E��GazY�<98/AJ>pU%g�@En֜��1:�uj)a� >���7`���'4���'�N�ZO�ѷ�����>i���t�?��?#����5����{y��s11I����nor2ځ<;)��&����� '26��`�DTXo�(����6�������[Ud��`V��֊���3��@����^=���w8Ř��*��1gna��ͼG���b��d�"L+��-g0Tla��2����,)۸��CSNM:��z�3���a�x�L"���F�C��+�cԙ�j$&�,g��A�cZ���#u��LB�zk����U��E^���v���7a5z�c/}AY��h]Oҥ�ym��*1�S�iƨ��p����dnt.t���$�.c'*�p���=�O��Iy_���>G���ç� 30StK�3�!��˻W�T�z�|<�����'.is���a�'�����ˮރQ�{�"��3T���L�ާ���7�N�5Ӱ���*�QU�삖�c���Wa��H8A�%�6��ʍ"�1G�-g��_K{$@䝓�Fۯ���}�_������r��t6��� cU�u+8��z���.R�l�#bZ�w��t���)}��e�S����/�b�۫��;�7�)�"�U�<���uQ*ŋ?��G5�U"��!�������IUC ���S�FS;����<���MܥB��4�0ȴ��5VM�E �`k���1Zފ0h�Zҳ� ���X�'�#v�Վ%�����]�"� sQR锃�a���a}rES��e�G�B^"����h'����c�ϩ�յ���B���.l���p&�R2b+85�-|$�e|U� �_4�G�l��v����V�<������l�gM���o=,غ�Hy�B�H5���V�[rF��Ma���]I3����Q�T���[�E�p�U��렎�j��l!����-H����M��5b@�m��#~P4��!6��q��x)5������.����/�\"��3�A=���h*�;2��s<� /��;���Z-��>Md��� 4a��[x�6BW��ۖ��iu����{�#%aF+D.3�5��Ϙ�u��������\>��ԍ�S���G���KT��Le��/���:���U���k6~3�����Iʽ��/u7��I�슀 �������ڼp����F�F.$|�1kt�b��Q��W 8��:��v?���ZV��\��G���i�C����sNc���1�6�_)ns5w�.Q�BU��{�����]�i0a���{I�ކ�K�6B|#'�D^&ـ��}�?���r�i�Z��g���#�D [���Մ��j1��6@C�M|@x/��q����0 ���� �w ��o[B>��`�g؉@�~�������wp]@na����^���s#��/m���m���%xJ��3{M��٦��Ub�#H��Z��u ;O����*�%����E~��w�4 ʵ��+�JM�>�Bˁ �7����p<J�+&�X>щ�p����t��9�q8�D4�(�{!Ko�V��j����D�/M��ҁ9�ZQk$H|~%U��>>+p�흍U��& �`S�A>��f_�����}}�w6S}�Ãw����^ٿF�)��n#�X�~�+o����K�':aLW�Dt,�\DP���%}�f�*����)�@X�x���_��UPu���S�����nj�9S�
Static task
static1
Behavioral task
behavioral1
Sample
c6f21c705ea0cac0fcfbf3937aae87c7645d28b50eb4e222ba318daa850883b1.exe
Resource
win10v2004-20240508-en
General
-
Target
c6f21c705ea0cac0fcfbf3937aae87c7645d28b50eb4e222ba318daa850883b1
-
Size
3.1MB
-
MD5
80b82a797e09fc6a97ff9287619e7b2b
-
SHA1
48752c5729fa761db715b5b186091c336ca3d9f8
-
SHA256
c6f21c705ea0cac0fcfbf3937aae87c7645d28b50eb4e222ba318daa850883b1
-
SHA512
eb783507b53f41c6797e0469b4bafe6f1cd9a55469b434441543ace994ebc97f261bb16db333cdfdf7fb51e28118f00fedbbe6e4d716273892a25108fd6f525f
-
SSDEEP
98304:aUHclaHHI7oW2dR2G904U/mKB/nVwjLIY:aAcgo7o7dR2Kun68
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c6f21c705ea0cac0fcfbf3937aae87c7645d28b50eb4e222ba318daa850883b1
Files
-
c6f21c705ea0cac0fcfbf3937aae87c7645d28b50eb4e222ba318daa850883b1.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE