�o�6��=�YW���#�����7&�z�F�����B�?�������M���KK��σ�)�� '"xK]V�^�\ `菼�>�/S��7���KQ�nmoYmH����������a�;c�д�0z|��5�ϫ��]�I��@�<��W������t���� %���\Db�%x�M�ks}l�iV3�o�H3ֱ��?�,_p �p�����x�.ձ`a�/e����VY�Yx# �ſ�-�[�!Og���r�P�_�iA\�z��:�E��T��^܂�e��ϯC"Y�O�J.�dQ��Nfa�aa�o��%Ќ��Z�����1�y%a����D�_��V���� �Fs�PA�2���e��2R�K���SG���%���*�餰���~z���M7�5�ظn�0~u�Y6�,>����N�5�����CDt��I��FΖ��y-_�?AM+����/>`,��J-��7�?_������x����}���=���{��C��s�hWQ��& 2���{�`8=��L>k�vx��e�r��1��'ƒ�3�V�%�Ҟ[���P����S�{Ô�ܵw頞u�]��2���D�Ao��,��a5�t��fJ\%�!H�x�/wD}=������kR�ZY�������wg�����f�ZlH'������`<������?dӌ�f�j&��7fl�:)'S�.�_(�9&�y�,��ڡe���0�}y���k8�DJ�:PU�{���������<��7������Ik� �Ib{����䤕|�J*�:z��;sM�J��Id�*5��P� G�+L���\��nft�U����<}���9��H u�+� 91�0^ �jDV���~?1��UW�@&^V�Aޛw�hp��(��tp~�0�u��q�w�x��8����z���p"��r_o$�q㡹�3�e���-]�p:P9D�{�\�S�T������������P�('�5I���l!JM�0^jߪ�x����{Z�� �Eǽ̌�¢- Ɯ8�$�zys�`�Sv�����r�0�F����$�H���)"� ��DN�.��tq��%'{���� `B�("���6��t ��W]�p E����Yv�i�&����c��4�I=�N|����`�M�|QD��b̹&�]v%c(NQ����xK�ƒ|��K�E�E?kd�|�j_ϡ� �7��F� .Dv�4 ��n��h�3v�q�F�\k\[��w���h���o�����7!�����0�)5*���ַ|3�,P�6�e eDޟ�e�/���7��^M�o}�t��+}���k,�QiA�,��hdr�mf.WRNN��㿾8���DYE<�fϷ��E�?5��6���mn��4��[����}���?_\������AFf�(Ua�@G@������}w(����N�8-��b�6�BN=>D<@�L��r<+�1+��`R�� ��{$�Ffﮤ���%aeR*ZӅh��|n�\/5�Z������{;��&㧷E��䌽�7�>�XAk���}��W��tɥ�x� 5��p3���|����v�CO�@��3 �T��������/j�aU���_�?a3�J��#�+i�@�I}{��V�������)*�A��h�R�R>����s=/��7-�����d��*�����cW@E����.kg�A��w$iS��L?o����t"s���J����p�����m �ժ�T���lK�ad����w�9J�mr�M�^ǧ��e�g���7�;�Ls��,uW��~NQ�BO�3�Pm���� Y��� �k���\��j�zJ��$��ګEwZWj��[�-�c3}������z����ϢY�����8���aЀ��\p~�� z���"%�L�4`�GO���t��,����fI��B$.�Zl��G��;uI���К�sJT�u܉���ֶ��w�/�W�����d�-#ގ��2vRچR�G���'��-|z�d87�5�fh��ȫ�O�����J�EMUS2 {Ub�nڕ�� ���5G�-R���C, ����~T<��� �}�Xi�=����� cN���H~��"���mw����N%=ycE�+��\��*��r ��L+fY���)߮)�DW��P��m6,i�1K�i� ƺ9䚙2�}��\t)|ѿl¬Y|s����e�4��������{LSA�![Lf�o��l�����"�C0�ٛ�W"���yV��/��|}+0,ڂ�����=O��k��B�������ĬJW4<�э��NB�K�k{�8�z��"X,MϷ5�]���N?�$p��m]��~m}xY��o(�iI���Sz���k�������S+Ga�u�˂��n,���������XV��q��ύK��3��x�17�pi<������v䷰�E�H#��{Ue�+�M�� y��mDr15�1E��Ղ�����P+�"}�,�,��}��(^#���,Ii���j��=7]�� �ocYVI�+�5�gV*#r��?A�s#EK�7��h���k�u�y�D7) Lٝ�P��)r��ߜ# ��ŋ.nYۙ.fyrno o�� k@��p|���j�^�� ���w<lD/PM$:{�e�F��m�,�ln~'}OD*�c'rsʼn�IOg\�Ӡ��C7G(0nВe�J����[���M@b��#N����(^��fhwR���F����ư�'���Ƥ V�;{˨���%�����T� �2�Z�����f��!KL� �hc6���0��&����Ю��]l���ۊ#��^��:�<��%� �ۿӘq�u�b��]��w|��F�e��b����Ϸc�M2�=��FV&2P��]�n#6g9�5����f˯Uҟp�_��,�/��M���w�N���õ���rm �l�S^؛����tě :l�UH�<�m�[>�B����w�\Q;��n��L�f�� �.a�S��c��=$?�8�v��V��"kMmd��0�0�zB� �zkPWR�6B?ƅ%_B��S9c�ff���Y�^�CYLf%9��k���[>�6,�GՑC^���z��Ev��2�9,�ԑ��_�dPz"/�S����<( zzc�w~&���qM�3�'&2�mB0E���n%�h{�y�$��=���M6&z|���V�zM���R��ȋ���h�r;����ɘh��^'cC"�$b�U�,t�lGB�A�j��-~u�)�Y��6`�#'�N8�s4h��@#�Y���O�W9�Р���i4s,�á0�I͋����v���+���FR[%t7�V��O�a}�XX ]�܇^6̏s��V�G�E�.ŭ�vr�!�����}����V�p��;rD&�-�I�VÊC����������
Static task
static1
Behavioral task
behavioral1
Sample
a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe
Resource
win7-20240508-en
General
-
Target
a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe
-
Size
3.1MB
-
MD5
395eefdc1a4acdca0e2fe54424c7b804
-
SHA1
be9feab5b3e29e776a711ba0498b44150a3cbc8d
-
SHA256
a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c
-
SHA512
e2de13ae4149ef9fd2c11d1560cee19df33fc684477d91ce183083c93632cbe7e755e24cbdc0bf3f418d3099f011ab933fcbb99ebe5124e4e9f275bf0298b2a0
-
SSDEEP
98304:b9UwCSaIC8SqrS7o425rwqgH/MaxIodzqIdZZ:xUwTFS57onRSTvdL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe
Files
-
a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE