h�|�������Z�g*y���,'�Ɛ��*����a���bBj�s���M��l��C'�.���Qܗ�����G�:�j7����Q_�����̞����kv�o�r���8�� |w��U�Uw=��r�L�)kl��Wym�ɱ�r;��d�V �Տ������wF'��kyذ!�>H�B�,�����_�0lj�x"��,p�T�93�~4!����sŐ�& Q:����0sF���>r��u'X�/����xD<���ut�k����T�� ���.=c-k�p�X��$�O����Y�X���� �8np#�*�.aER��7�}�������|"Q|S�X�$��/G�G�Ex�UGU������/ 0�_LB�?�p�~Eo�4��>�e��L����̛<� �� e��\���>m]�n=A�N�}����p�Ú�R�č�r�I�21��]�����۹� �q̩ӽ]��;P�����݉o�FBi�k���7�R*��.v��Q���+�A�=����s��{���cEI�0u��t b��1$S��h��3� -j3nN�v8�Pb{����Bv�!�u���/��Q��w��x�~���AR�� ��yb�O���lUC�5ndz��O;�p��(�k�T/���7|9���<^~� *���?�í���^�N{��܌����Ids ��W�h��;t�������L�-8p�H�v� �#��������<�$�s�#U��H{�P�g�n�G��ida���\8���n���̯KoD���� SFd ��/olj����Q(j�n�g,��llxZLv\"�sry䫑��2dǮ�/vޗ)��B�ߠ1���|�-1�r�"JA�Ԥ]�L��d�A��|�*��� �mM(���`B��8`�#���5,������)k9���� �@OPT���W�݁ٔs�-�k�ԋ9����a ��1"�}���ͪ�.k����P��Ǎ��$ ye�@���E� �K<Fݤ�u����$��] {��@^6_Χ��8����� �}`%1���fiI���KrϨ3։+q⨽�K�BHh��2��"Ѓ���y��U��.�؊;�T���Ӄ���)w�V����4�ˎ��������� ��p�������CR^C$��j8�L���8���Y���2��b�*��� ���jӝ�}T�pK�����\��W�� g��� }��΄��I�M�k�G{'�M���Hɥ�K���|[��Ez&�"5l�O�/5�d��ra��ۥ�[��X�l��f�N�ˣ8K�wcyn�������qw��̐��5G�%%&!�t�����p���2lΔ�O��!UЉГj4%:�+��?� a�v�!�/�%�9�z�{}�R0}��ǑA����V�V�l��[I6�W/��oiU._©�����E�5��dP�x��~+��G�vL)�+MP�?yq�9:��N��A,�V�5uA̖^M���ā>���Aځ������:h��D4�;M̰a��k�����E_hx߄�������������������K^��ԕ��B�n�PX.}������-�)I���y�n�+�H��>B�%�"��ϚebI���a�}���Gg��w��Je���0����!q���B����쨝�ny�Ã̐�̉��~`Y�s�E�8��R����1�fvK��C��w�]X�n���m�O+e�z��gR�@uK��I##��>n�>B�{Ϋq�q l7ҕ�c��,J�>s�UTY�w2�chI"B.A~��h9,>�����գ��°F�RoL�*W��̓�,�h3��^���Vt������H��>�w�{U���v�o�d��X��Wyb��A� 8Q�!ɿ@�ay5A6"���`+�A<�c��T�ݺ�ŌYF�d���BJ�n*�[�%᪕�zO{����"��O �@쓇U�}�A��$�p���/̒߱"U����G&��_�^���{+0�aw���t�G�3'��ؔӮɝ�Ν���fVZ[��5aE�P���}��j��r�{nN�G_���������ggɤ���,y]��=?]|�Y�>l��*qOg���)��c�b�şrE���̗Y�?��U2�C�W`j\dY9��@��%�s&�m�{'��݈ۧn����gl��}Fv�ꆈ��/���c���A-�$�^��cJ�w�@�����u�!�ʹݳo�cd�[1�g�j�����6MP�J"m�Q��m|��]O�G[����;�%u�AK> .e*�a�IV�lx���r�D`wv��f_zz 4���-Ta�x��v�j}(ʸb��[��`�K3Ŷ�`I��&�s'_�2���g��8Jr�Od�u���A��OĂ���|���N-���i�T}��G��~���)�Y�+�o��zq��P$&Y���8������~�z�Y�[��B@���7�+���O���8%_a�3��0S��]��h���h}��-�m�'�Ew�R��� �������Cy����p)��[2�BI�� �� ��٥t�@���m�d���x���գX�l�<���c�.t2��B��Fw�v7���9Z����î%K"0N�X�Ui������'X���bP ˎ���ҭ9 T�D���і���l(�_��ÍE�����#f���m_Spo���eLuv�G!�f�[���I�D*����ە}1"�,N����R\����N�, �����!|�\PJ���b���TC�E���M.�6�.��u�X�������wD`1�,�k���ߏ?D��R��F+���@�_�n6�W�a�2�/���մ��e�Mi�3�"/Z�6��e��D>�Iz�6#��d��:#�,����'0f��+?ѽ�D+�T,��&hOm�q|�0���S�n��LS�U��JW�L�b�؋PJ�7��:9�h�l$ㆇhyk�q������� ������Ly����a_�����-YJ���-zt�O�=�p��O�:C/ \��!6L&(��s\�D��t-(h��ǥ��tr����w��v����O�"jO ?���Þ:;���.%:�3J^�7�ۊ6�u*�j��v�M�a�Mhϡ���[��4E5��PC#&�T�:�YW��T�����,�e";d1j�!������`-�gg!��Y3���n�'Ů;��O�q����.�;��YZ�k����λ^��Oo� ��%>}�R�b�p��*�eu�[ʵ#�P9��sh������������(�Õ�D�eG��_�����5�QeE&�ߍ=�6���p0HXM��Xq ����ڛ��ۀX��l
Static task
static1
Behavioral task
behavioral1
Sample
db2f47ec16aca19926f085c7a1f8be5c51338d6fa3aa61ec1b4a4167955d659b.exe
Resource
win10v2004-20240426-en
General
-
Target
db2f47ec16aca19926f085c7a1f8be5c51338d6fa3aa61ec1b4a4167955d659b
-
Size
3.1MB
-
MD5
7350decf18c5eaa688cfab918040b6f2
-
SHA1
2a541939443c22e3ebfa525ed40e80dbceead2e9
-
SHA256
db2f47ec16aca19926f085c7a1f8be5c51338d6fa3aa61ec1b4a4167955d659b
-
SHA512
ef4b89e2ac631f5521cdcb450de85b1bf1428927559a49a6346ec93ce99b49d5f3e4483e376294c911a22dd2c532afcb3b49c1b105fac6861e6311caef36c745
-
SSDEEP
49152:VqPExWnzaL8JfET0Kq+iyYJMDqjFrd+VcoO7h3Tl6Uh1F6ggIJ:BxWnza8fET0KDV27h0w
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource db2f47ec16aca19926f085c7a1f8be5c51338d6fa3aa61ec1b4a4167955d659b
Files
-
db2f47ec16aca19926f085c7a1f8be5c51338d6fa3aa61ec1b4a4167955d659b.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE