4��u)XIp��>�:�.>*�~���#���C�^�W!�¦�&�C��%�� �3>��'T��G+�R�H�Vw�Ƣ��W�n��DM,VA܌a��j��Vuz�J�������U�kj�6��:���p^���ׅE��?~��W~��c�Ǽ�ZJ�p�,�!;vN�p@ڟ�|37-�9_���z����� .�R��!�g#�噶��-���5��%Ӌmg`� ��ڜ<� \�*{��[w��+)��q�%�m y:F�% �!��)UD����""Q���d4\�_��it̃�L�"�{��ewͲ���Ă�I7-%�"$�'Ӗ�eo�>ke�JA<9;�x♉݇���jA���&*�Z��N$����yцw�i��g���-6��@w �d(��y�k5����f�7ԇ�~`�C���7ڏL�E9�e9�p�t��kV������ �Cy�����h��oȍm��m��F|�f'{h�����+ᶱ��픙u�~"m��I\��� ?%����^�<��s��ԑH���AzDF��Jq�A{j�NV\U��΅iG-�e:��sß+j���b�=#92�ҭ�!) n�A�r�Ƿ"~�1:ۊ%��_C�����" "u0s�O럯�n�U=���=��[�ם��w0��BȔ�Y��o@��Ly[M�l��F-z����e>E{��/��?-GL��U�h?[�VۮŊ�F���s^J�Ղk%���7��"8_3���5R�f�=[,�b"�oP�*��u-(k3�+���� ��0�8@���~��Z����,��]-tn���o�6�����ƮMNdo�{dz �S_���yE|�.�2�Nb�C�V�/ �sa>�~�_E�oFKꪋ̦y{:-���L��hqh�b�o���Ԅ�3"�p���m��%vvYO�V+ C�=�)v� "�֮�G�MV}t k��9 �<�g���L)�����@�$b]R���Y�H��A�p�gE�Զ�ik^mo��^��A]�l��$^�R�x��/P�4 �_�}u�o,���&�$�}A�hi����@����*)��u�w�<t[ ����^�<��M*��F�v��_����G���m�*^˳�6��v}\k�ƪ�Q<�p�5q"9Sk ������W���cç4K��(K�<*��m��(�+9��^�gZ@�+ >��}N�O��H.&(���`�v �F�����2h+�GMp���%M���S�K� p�%ƥb9c�,��*O��#�m��N��pA3G�.}�ܪ\�Y��{�T�����X���������*��� ��Ak��z;唈�uV�������* ���Ե�e���}��Z 2��<��' Y��%�w&���]��[���@27牉T��Ǎ�"C�*Q�B����J)���G��=�͆�� �9�W=���m��9?i����+ �)��x�����K�t�}�ܳ�~�^�r��C�J;����!���Q�RN��܋@:8h�E�~��w�=�U�L^�!P0%�0�k����]fBͿ����xn�����B;���6z����%�.����OBy���$ъLw�E�2nQrG�D����t��t�S��Ah� \^���N!�Sh#ʂ�k�.��j��i Lm���٨��`P�]�,��7hի�ɫO�J�4ﻒ�����;.K��d����N$֊�-�o���L�߲�Ŭ��pM;?gR%U�`����Öw�����W��@�f����4��o(�����*���fw�ΰ @X����X��6O�����'&��������5�+h?�h�̞4���,�k`c\�����B�d�L�:(��H?�H�8呧E�̧2�sg�ʌ`OM,[����魴�N����cxS�Q�yu���+`v&a%��7p�̉�i8�4� j�~���37J��%$�Kv��@aM�ˈ��=u��Wԭ���QA^��E@���ZS*0?���_D�k��4=eIE�(���$�����6B�Q��s���@7M8��"�i#�D��>��+,j�2~�O(�6�3�������� &0��Y�n\U�%X �]�D��c��=#o����3.b@�U���8Y��&�ɘ�,�`��D������i�b��H���,/��h�Ƣ]{=����̱lys�����",�d܅j�Ᵹ����70Y�4�z��l����˭�V�+Jo�M�âA#�������w�+��1b�¿�vf��҆�W�����-96���g,UY$/^����M�`'����M���rP*ES��8E�2�Q�{:;��)�B���%s\� _0)�Y�1`3�z�l�'���>0^� �a�l��!l=�L�T�O��$������VE�Ɏ��J�ғu^��I`m�[m;������K5+�;�H��$T��� !��I��#c�mvY�����Μ^{�@ �[ƽ�[]}�Z�x����y~Ji������G ��tk���{e���f��� '�y��c��U:/�z��i,L.�\��� �iќ�&(�y���0^k9�&���K�a�豟S���ga��ձ� H��݄����ȣ�Ʃ|4H��-�R���Έ���̕� o� E]�Yu��N��}I��nl���H-��]>+�����2�I�U� ���� zR��qq�3P��&j��Oz��2��m.@�dM�Q�?� �rw��I������v��ۂ��J�I�0��=<u����c��Tל���Q$�Q��q���dR(�{uԮBAj8b�����N�<pg���Y��?�$o8�g�(ԇ�oĉI�j�f'�����"�Ӑ�[�`y����z���X�m��(r� �}w-@��\V���K=&(�-'z�(���N�uF�����R�Lm�g��w������5�AV�~{�� |����G���4Q,'<kxN�����,�Џ5Z��h�R� ��E�PD���@����a�@0��@��������e�mI�s����n��-�x���#�����$6��E3��q&����m�SND鈬��D#������ �wɋ���Y����in��0�s��_������i�Lͣ�� T^�%���7gC�[���t��A� W�ʻG�����_� H_)3�<�?�B���m�/�!����Y��sī�?��g��a��Mj� w�K��CX;hN;��f�O���Ƴ45�L3���ϙs�F?)��Q�T!��F$��A}�>v�i��*����M_#XBԳ�(�����+ t��doq筓�/��]��Y�B�*(���8I{�����}��~���������,����� ������_Ť��1�+��'�{E�O]�v�&m�A��XC�)�����\�{S�_n��;�oe��A��%�)i���Ȝ��0KUq$��H�[C���\_]x��$�b���B�H��,���9���s�Cy\����4 �X��)vԓ�-��ڎ)���!�������;c�h����= ��c��A7�6��1è�N�U��s�y��g4�N y�Z�uw^pihаt¯q����b:͠;Ѭ=!uQF��cc}�zʏ�n>�:؋�s�Sʹ��iF�M5�YcQ x|�+ ��nR��_�u}G%Kw��Ԛv����ܒ�Q�@cr�J`T�i�V���Ƽ1����y?0���,�u`
Static task
static1
Behavioral task
behavioral1
Sample
c99ffc20899fccc6c8bd1d083dca14179a49fcac0e68995994f957dd5ea062c4.exe
Resource
win10v2004-20240426-en
General
-
Target
c99ffc20899fccc6c8bd1d083dca14179a49fcac0e68995994f957dd5ea062c4
-
Size
3.1MB
-
MD5
21ec1ddf068ab00c2a297af01d29c90b
-
SHA1
02c5e3f5d500e6c3d48b201bf44b07f4dc5d6e2e
-
SHA256
c99ffc20899fccc6c8bd1d083dca14179a49fcac0e68995994f957dd5ea062c4
-
SHA512
14576628af5ea15c6ba02bb0ec963666b89013f446d0ac1c0920114c0afb56f16da5a7560dd851ab128fc20cd49192855e16778bd890431d7c3f0a5a1e2a569b
-
SSDEEP
98304:EIb706HGC+ttERmZwSUVimc9bwbNsu4c:EIbYNC+tugwFipK5su
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c99ffc20899fccc6c8bd1d083dca14179a49fcac0e68995994f957dd5ea062c4
Files
-
c99ffc20899fccc6c8bd1d083dca14179a49fcac0e68995994f957dd5ea062c4.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE