2u��2�D��x�8浡uطpb�b4y/����������Mm�!�� ��wr�*�(��#���-��1Jq��=�e"8�haHi���ͨ�ѧ'��w~)�蔡Ҫ��:��e�ۯl����~j�. ?�hZM=��Ӌ�G��1m�␀"�H�� �<�S3����Pa�(���<7Y���ˑ5��B��U�gLQ5Uc\/S����7l8�¾v�P�� x�ufz�B��m7CϪ?�;t<���1�h)�K��v_y筁�Ҍ�?3�@�Z������P��1BW�𣶽���1�y��+o���WΆ�,�w�������"}�>�pޘ^�Җno$H:#�A��4�"9�Sg��F��w����[�ĵ'��L�w8@b���%\<P��jP:��@^�6�H��B�I�弞�����ľ��]��ΨT;��N�I�v� ��c����\Rb��L�g��9�&"�@��sHЏ�Dkǽ���m�2���xw��_����pu��&���'��q���a�t����t��y@+Ԁp;6�/Q�j��+�-܉ S$�+��t/����þ��|���w,Ԓ.S���9ý� (�'��GP�ۙ/[TT&MJ1'hw������/�/56㠷����a;o�����t�9hM����u�� �1iP7>f�Ŵno�x{_�������@Vg:}.�A�" T IÉ�P_zA�4 ߇%�C1LK��q�U��#��MLA^:l3���dW�ґ�Tι|���f�� UN�{f�z�]�;�U�L)�,1iCq� �,�#z(��p��D���Q�"4q�Z���H��Bρ��#g$Dq�'C��,��������uPtN��176�����BirR�'��;K !���F�Y��駃_�I'A �}�,��-{���ƺGdJ��ӂd����D�>g�� V��:^nDm%�JE�����\=��K`�� ��e��P)���t��n�b1[`X4C(��~f8��z��*�wi�L{��"��g'T�����J�p��Fb�*"߬F��UO!Y���S�<�N��ŤW��H[L�h 4�|Ma��κ�<��ji?1i�mȯ����:�}��Â@�ʆRS�X�X)��� ��`�B�:I�b O��րN���"@�T_�o��i���z�:��K ���r�wΫ����4�G���Y���/�J;�q�����`vp�w�f�ȸ��[��������M �H慣�d0�F��$�XkJ,%�(��~g[/�(��;g̳Ȕ��R?�A}/�{�ۡ�Lm�A���i�2U�\�}���P��i�z�r�������љ��:0.� ��K, �9�'1�]�BO� Y� �0��5�>Z#�"��G�禨H'������ �I���Pa�%���^ca��S�������x������0�d3�7�]T��G����~�;������Fcr�4�=J���p���-GU�߹���B!�8IH�x3�2~�y��n��t�hF��H�������#�Ɯ�I3��?�h��P���T�*�H��m�1��p���D�����8��R��\p�h4��Ѯ��ZcTf��o~������X�#�Ӟe���5&[x�"�s�@�ǯE.��v�Q k$m�9���`#����e]'k_M�@Z� ��t�/�^��_�� y6���k�8�'W1��<o��Po�U�8���;�%U�'c����W]!Z��.�Z�>�iׂ� QC���x6�(��[!���&��YRWb*�msʑܭ$�O)P].�%mǁ ����ce?��N�qo(}��M�N>�����p0��/_c|5���d�Ж��+����vhXGJ����2%��B�J�ٿ��]���� ����B́�NӖ+�0,E�]V��)$�Y�Cϙu�/�tؠ����G"<����C���O��(��,�uJx��� ���O�t ��p������jM�w}^� �6.�!_�f�� �V�<K_5��]��a��7Qv�$KI�JKMqQ��������"�Ẅ\����G;Yd-�� ���/����]��Z��@��H9�w���~��_�u衖u�Rz�����8*.~ksh<���?w��h��Ai0�c؞>b%�b�K�ǻn&<2�(�/�E���5���)���cH3 ����y� rkY�`k�̩����z6����t��ltoӖ%��}>qi��9XN]*�w�Ȍ��`bE��d�^Q�Bһ�K��ouC�:�LVp6�k6d&+����j����14MŷPΚ/D�dd��(�!��=��DdH��s���L:��O<n�,�!2��',&�x��L>x���f�5*B�ѷ�R�(��7���t���&i���J)Q���V��<�i�O_lY~�{��N�HKw!����h�z�;5֝Ŵqq�����H"1K+i>o�i��y$�-�;D|� z��K���/^'����|;>��XX��\ �9�(�#ar�SW��\� �v��ū��mKd�M@��\�?�&�Z�J/��|x{5i'�R4`�+����~�ؔrό0�*�e�ti0�#"*c7�,�����p���.I��+��mn���y`&Е��s��E��7��⑩6���X���X� ����ĜImmL+z��P�3���(Z��V`&̿�3C�Y<q�TBG�U��z��KRF0I}�]"GE@�d�j�=]��Nd\�4ol��O��\h�g̭�������%y h�tŏ^f����!��x�w��/R���T־kP���\�6��]7$K2�� �Î����vsY�Ip�%�h��)DxE�6G��Q�nB�hY���MyXl�jC۠���gC���[0����DM�����Le�BR<��P�T�,���f����Ku�����>dAڌkn~gHf�/x;R�R�L^����bL��%D�P��5�j����x�T�����=�_'�_hvC:C�G�aBJ&ۋ�N鰀�az���t�U�w�Bn�`�vTx�Ao�'�+�a�Y����|�\%t,�PWh3y�I����x���ێ���C�C�ڼt�R������f#��\2b�Z����̥�o�n9&D���@�쭥Ow�G{�,G�u��:��R�J�v�A=��ܩƨ�\�=��������=�~A��T��C6 u�q�N�e� h���"u�����x�cJ��^�s��!-�������Qa+�����h��AX�iI:?�������u3B�+\�a_��|�7،�������$�)��c�I�5�����@�b������<�4��1�b4�G��d����� L��y6�!:2h�41�x�Tjv0[qCX�./ԇ����_e/��z�$ʞ�(���ɱ���N�����)�4 v�g��E7>��c�٩}z�=T�h]D�;@/��w��z��_�\��� ι�`D���o�<���|����L�>Eh���2+��Ku�����lF:�aů��ʇF�ׇ��������͠f�,*�^�~����ឆ'O�Гي]��>Z���J\����n a��������u됍�Y�2��0<2�d�ܫ�����'=�rr��\<4���6RM|��e����#O �h�ڻfP�
Static task
static1
Behavioral task
behavioral1
Sample
879b52a48f0b373c91925434204861cf0b65f249c7e66c2e29ae282ad1a72fc4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
879b52a48f0b373c91925434204861cf0b65f249c7e66c2e29ae282ad1a72fc4.exe
Resource
win11-20240426-en
General
-
Target
879b52a48f0b373c91925434204861cf0b65f249c7e66c2e29ae282ad1a72fc4
-
Size
3.1MB
-
MD5
dfa06acfc5137205e01c18ab27c0e328
-
SHA1
b527181ba065c9a5da8227d00b464329cfffb7cd
-
SHA256
879b52a48f0b373c91925434204861cf0b65f249c7e66c2e29ae282ad1a72fc4
-
SHA512
3cb2554f38fc07f8d23686487de693fb778c002dd03ee6ca748db40b9c6a6436d1f5e6be6f04b1402b6570ec41a49b8a3c4791d83f11f64ca2192f46b0bd30ae
-
SSDEEP
49152:jC9E1d32FoQQ3K9XqYbdjF3m+V8Ou907F2nd7pNL1Ut3CwA2B9GvDQlN1/:jlL3Yod32Dmg/52d/G3C37Y1/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 879b52a48f0b373c91925434204861cf0b65f249c7e66c2e29ae282ad1a72fc4
Files
-
879b52a48f0b373c91925434204861cf0b65f249c7e66c2e29ae282ad1a72fc4.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE