b�.�d�8%�M�g�!�{��}1�c��a��p<j�7�Xr�u4��ۈn]W�> sǞ4�5�lp�ʝ����=x����;� \ ����S͉Vف� �3�퓲b�Q�_��W P�p��ʐ``}�e��<�:}�Q!i�ǔ�Sac]�xIV�e�&�Q�Zp����+>�i�SL}����N�������_����� ��B����̴!aƚ�:4*���������Cȧ1��-=k�M�3ZU,�C?*�" �sSlq嶞�7����n?�5��P-�B�=�scD:A]�R�zy»�� 9ۻ�Ue������������kχx��d'B�� ��&��"G��]�>lP�w+�0�$|���33a��=���ҿx*�<`���k�/�EBR�2-v22v7���� d��L�7@Aj����8����5M�1���P-���L�a�t�3ͣ�V�ɒť�[<8�3��-ͻJ4�ea���_Ьd̕��Fϱ否m���� �"�{�d��w��aGi��`��45�"�-��n���}�����y���"P�����H��t_B���sk�qO(ğ���=?�#F^N��z�_��� :I�9n�3dR��M��U� !'�i�!%�8w��;� ����E9Bn �~~�t'�1��"�lT��~��Q^W�i��w�\�����G����T������K"P�V��1OJ��C:���2��T���Ӊ�I�q� -xa�t��Lo�hM��Sv�R-�]��_/� U%u�h�U�fXk�`H,�G_O�z�m��uf��O���' `�@�ѐ̐�|��24���56<��ڡ ��Fć�d�ƺ<K�!�E;n�~�e� �9 |��ICf� ��^�Q*Y�C�����m(����H8<�ib�R�l�Aw�8H�+��Lw����2���P�WMMb�w ��Q��4dxl�[��4lB�p��*k��J��_f"A�mEE�����(���V�ҹu��b{�������XR�ݑ-��i0����9�G0�Yz�w��r�A#=�<E�+�N��v�N�xB�zD6LSؾ� p��g�_�I�l�~�QPEЍ� y��?��-Eﳺi�A����x]�<�e� dG�P�s➕��� � �U��Fw:2%��A�9�u�yt��`�Q��G�t J>�e�tH���w@��XOdg�a̛f+�$@�ܟ2G]ϡ`i��P]���Mw��2�x.g|���;�æ��=�����J��S�_2 f�X�@�/��i�$Qh�*����[���������>�)�'�J���đ���+��pc���!l�=u)�;�Zg1�,��D����������%O �}5�B����S־����k{�&���l~E���yĦ�.��������Ɲ��N�H��4�����Ay��ݤc/�pL�U��B��@m��G��6Y/�cō�yO_�HW��/F{��^1�!wN�t��������%|��%�d+��Ű�p��,�/GZd`�F�<��� ���'-���� Tj}��A8��G���?�*����� t�O�����@���{����j�t����r��o���P�]n|O���a/�>2G�*1���E( 2���;��;�Z"�c��릐py��u��x��xzY��Q(����8C�Z��/����^"��l�TT��I$�����ޒ���w�=f�i��FבS��j�]2I�8|�����sF���Zͻ(g���X/��K�f����P�NJ�֫α|�KK��m:l����劺ğy//��J��)k��(���G/t{�����(2��:Ʀ?|�d��j7���eh��T���[ɼ�˲!]�+�/P��Υk�RJy��tu��K|xP�>����\4{T+ibJ����ɓ�ˬ�������X�2��a�8j��[(�3�D��Z�4�7��}����JfS�,����'amA����<!��K�����!�*��;��#��O,��/?�{yu ��Qx�F��y9&�~٬�H&�^A���t��I1���'�{�tA(���ҧ� �U���aB���QQ�K@0 Z��y�HC����~���:� y�\XqW��d��Ii5䝱�w �bWSww��[\�ۏ5��J��יg#d��>��N��'�qw�ӗ@��ȕ��(�F������z�f�wQ�g�"\��h�P˻jy�◱��T����K���Z H��{�Й�FZ�e��1 5�@��_����1[�!��83ҋD-�`������Z��nÄT�_�ZL��& ��z��f&v���e��X�E�D���x�k�K��Y�P:�yk٣2��i���a�w �4I�ܪ��'95٨�u�֢���/�l���l6���<��w)'���ʥXf���2M{����nx�9.F"E#r�UU��:?���(~qg�JI:k�E�]��Hǀ����\᪽C$g!��bt�w���Gk�:������K泼�2F�ճlWbn�ϔ{҄:�1Dx���&���X(���Q���=O���K���AzV����P��=a(�&2�\�"+e��Ϡ��Z�-��=���������Ruލ���|Hq�ĸ}5�>��1obM��������ߥg����n�xkX�n'TOμN��Z�������a����Y����� ������6T.�����Ec�������WQ�3��C���uÇ��d�A�O�����7D�,�-��4xД� ��5X&;JL���&'��quV/t��,�����9�G[���uVkp�� C@���8�5y�7�7�m��Sp��NN��r<��h�Z�&����s�������;J�L�K\�?�%:����ga @$[��G���V/a�j��}Ѐ��g�<l�L��A~*w����Wke��ęg_��1� Y���Q�M�r���6�:W�ߓ�V�P�v)㙏��'Oe�9.���UZ��t�#FGt�0��a�|�H/�{��B,����B�6� zV�H���U�N<�D�3����z2��K���,�{(;;PC����[��T���mT��*�8A�M���|�v��� z�5��Z ��=0y��?��p�Yǽ�B��~<��بe��K@��2�W� �orWz(IZ��h(�*�bi�ceC�>��s��j�-T�ɏ����ڔ����-��OFHo�rq��.~�e�.�q;��]��L����������E3k����R���/lɮ�L/N�������Xw׳h��g1,[Ϝy�7�h]L�B= Z��,���`+"�".h2H:6�j��ݷ�����6Yh8���O�F�o�+h��>�������1 �����8]6������X�I5w���U������ڭ.tq��ԝ ����+�=��@�d7��RGυ�%��El��'��f�͋�s�8P��9������h.���&�F��JO������~pLtl1�QKDaS.7P2b�$+��^3�M�Uo��bd^M�% ���z�6����{i`�,PE�.Z�.u�Ent�$(Z7X8��lw'42)�ѣ���@h��.Eދr�$$F�}5�
Static task
static1
Behavioral task
behavioral1
Sample
6cfad9496a2bee32a0f4dda1de58005c6592a59e7365623f5314ccae417b1055.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6cfad9496a2bee32a0f4dda1de58005c6592a59e7365623f5314ccae417b1055.exe
Resource
win10v2004-20240508-en
General
-
Target
6cfad9496a2bee32a0f4dda1de58005c6592a59e7365623f5314ccae417b1055.exe
-
Size
3.1MB
-
MD5
d81c636dceec056448766c41f95c70bd
-
SHA1
c96b12739c67bf3ea9889e0d28c783d9597ee2c7
-
SHA256
6cfad9496a2bee32a0f4dda1de58005c6592a59e7365623f5314ccae417b1055
-
SHA512
7632d9bf30cc28d3d33465a356f3aff2297792db2cc2ef17e24de7adfaa55057a4acee06c206d8b531cc2b3bc870b301fe1befda12b953ee1d7c4dc4e4ffabb4
-
SSDEEP
98304:Yr4eEcuQkLynvc8wG43MeM/hFfTII9EDg:YrecuvLycZu7Og
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6cfad9496a2bee32a0f4dda1de58005c6592a59e7365623f5314ccae417b1055.exe
Files
-
6cfad9496a2bee32a0f4dda1de58005c6592a59e7365623f5314ccae417b1055.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE