��l�c�r@��C�Ӝ��8���gl��Qz�+�O������U�_l�������Ǵ��gE��^ȫ �q~��8��HF�ѿH����*]�7�0_��ǜ,[ ����9�M>�����2e��Z���N� �u������/'U���0����GoV���!5�vZnY�[�98��bb�`�ں'���`���n�P'�;a⠞�/�? ��� �9+�۪�,��1Mj�"�H�)��&᷃�@b�����&rH����������:��N�^Q�����R\�4�U� ��I���Z~��ˣs�Zq�>>��5f�cҀ�4ɐB0��b�/�o�=���MB��;�N[�A�����1���K��s�/py��ZS��7�����"v�ո_�9Hd��9�� ����]fs\�z�˥�S���ZnF�-B!9h��H����!�8��_ir�Ϧ,�t�ͯ�Xp#8�ç���wax3���@o� FC]�l&�_g�i��������u6�B�V��'}��|�(�lh�����������}'���������/3Ɠ����_�&ǘ>���4V��Q���,���Q`�����0;G�3�+'�ܥ?��4���]/�n��z:�P����֢X:�Յ1 ��B����@HE4�Mt@'�PpU�:�;���'��o-y���"���o�j�߭ڋ�«���+d�%OK'�Gi�w[V>Ἣ��B���4�_�D��G�p�����>vt���v���9��}&,�ʤ=�U�E�3��V��F�@���t0��6�%�0S$z$Mqd�q��\�P��{a�hj�:[�7/�)1i��ChbP��K��K�Aԛ�/��d���%�q�V���M�v��8�`����u���3X�"Z��84t˔��ܡ1����{�@'cʦ_��x��Gl�q~��c�Nѭ��סr��뢥�O��l�G���\�-����ݥ�,FH0&���:�߶��c�n�=DZ3�bSi�Ł�(lh[%H��U�'?�(U ��W|?;��A-����6ب(�(�� �� eѕpwXYt�Pѫ���P?��To'�+tkX����l�h��z����I7a.rH"���I����-u rx\ X�ukGP��<��?Q��w�㶤�wS��9\.og B^xB��K�uQ]'��^�L��-����?FS�3\��}�lh��I���-5�V٬ƖUѕl]������x�����Sy�o!�5.�Q�B�cY-���D��C�eQ���u�NM�6��=)��"d�R4�[�����*Q���BXڇ��xH�O4yB�7�DC��cj ' ڈͷY�jl3� -."��Ȣ�Ƶ9���Z�~�.����@S�/ϱ-��Mc/k#[�b(Q���hT{���t��9 'G�� �&C�G���i�Ӝ�b��ky0��o�L��DO^�~��u���W�m�L��\��%� q�4�V���[�U�R{����W�hѳՏ�*_Z������=���a�e�,��F���D�t�?�t�#�h���=)|J!� N�L�i����+*�EG��"�h����s��u'���?�'-r���]w���Q��;��`ItRn�ݠO7�/�\b5a�=T�o9~�,����������#��!`qT�I� y����j@'J��i^�Zf��W6��I��O �8q?ya�ڽ� 66:��^u�R?L��l�C��6b6����*bK ߕ>W�ȯ��N,���_��@���Nዙ�|D*����K~��W�Z�Hs�s2��ZJ����K%1��욓��V�W+�)o/<����N�� ��(Z5e��D��S���� ��9ڕ�a�f\5�����i�+Sw,��.�<�� S���J�篛�0��W�6�I4���\ ��fݜ�V�����{88��s�[��{���|�J��&����3LṙM�S|��vg��9B�n�v1��&^���=�y3ǴP��㒲���:`\钵y �)3u[K��γ���3�l���ܖ�����jXEK*�0!�w��|'�6ü�I� ,������i�O�7�st�$�M���6!y�3�.S��Z�'���~�w+ĺ/���%�r��e_�[��+��d��"�>� �۔s�j�����g�ȉ���"�\9�_��Ŏe��)����^��9�4��Y(3�~p=cī��$���ն���O���7�D���90�{�-���E"�,@6��rk�5�����e�oT��O�z��5�$������G�훫������B�8���E�w5Uy�w ��tġ��r�3����f~.�!~��+�u���fPY��J�|\��iξ�l6�jcmSg�s��~��t3�����p��K��{��&��Q4 W��z�W;��L~gt��)\�;��@�_%�1�U���*�W�_��9!��e:'& �'sd�-�,����|4����o�De �� ~��6�vY�3Q��:k�l��`<sC�s�S39��r�`��5Z(6]y�x�/�ޯo6%v*&�1/X*Ǟ��ӵ��E��W�ꗤdh+���7�ů;Gh�����������Y��يRÝ�䁛�y����ny�2�,"��D)σI��P2M�%�7��� p����Ǎ�S��~M4c�X�v2ޥ��3>�Ą-�H~�$h����Ql����U���D1�����Ƌ����~H��e����(/yr*Ih���q#�L��I��T`�[�|����ˁw��Z��g;�<2�'�y'�O:Fvk�(ΐq�����I�z��������18�;EB��C ҕ� ��u�W�7�7�.g``k:{�Y�^��!�M)�-:NDHc2���4U�>�'��F?���� �/J����~�o�i~�}��/O�u��֕w|v���rd�<V�L=���<]蔛�?��zJ���x� ��Z�:�C������L�i�̟���w���1z���}j��xcy�*�q�h�~��"�/}���Fd8��ɡ�g3�Q0��fb[�����;�[�8�N%�m�����R 9fa�m��v:&��4YTc��F�,J���{9(.�uEQ�h ��b��?!3�B��Q,���5o��mK�p8�ʗ���'P���T��]k5�s��t���#����6eQ�M��Q�NY$o���ȤI����%2�Ӣ���,��LXR�Sy�S*F*x�욱��m������lu6�7�!�|��Gomt�R��z#���^}A�V�O�S�~�PM���Y�� ��8I6��)*3Ln؞B���z+���W9�w�iw�-`eK��FB���k3� �B ƚ|�s��pD!����U�Ugo�g��z�<�8�b-����]��]��6+�t���z�u/���?��`/$�x��1�g��b�E��w��sN`��:�q��1lS� |n,)�e��L������^k�[�st��SM~&hb� ��Ia{�w��c�R ������X���!3 ��Ny���zͅ�&<ӣ`�}lA�{r��5b�7������t�.�q���cR��7y�:OD�l ��%�2{,��k=� &�%,����E3�/N���"���ک�w3[9�ߛ4� ��ǣ�
Static task
static1
Behavioral task
behavioral1
Sample
627aee1b86e768c6a0ac208f373b2ff8408526f62cee2266faa9b03b3cf5ba11.exe
Resource
win7-20240221-en
General
-
Target
627aee1b86e768c6a0ac208f373b2ff8408526f62cee2266faa9b03b3cf5ba11
-
Size
3.1MB
-
MD5
8b97f4d3f302823577afff0f3f36bd63
-
SHA1
b8c1b07568b848bc525039a9149f47da8eea3768
-
SHA256
627aee1b86e768c6a0ac208f373b2ff8408526f62cee2266faa9b03b3cf5ba11
-
SHA512
bbf7f6258d059e36c4390e87737e43ec4eafb69d41f2e5d0767c8384c3e1b4c65b1bd06f75f55b39e4760b07d43a058ce91fd9cbdd3a812fc8fd169387f0e9e1
-
SSDEEP
98304:mfVkI4idrFaoLQ3elrNymf5z2jcgFfmqy:CkIfxNdh2jNHy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 627aee1b86e768c6a0ac208f373b2ff8408526f62cee2266faa9b03b3cf5ba11
Files
-
627aee1b86e768c6a0ac208f373b2ff8408526f62cee2266faa9b03b3cf5ba11.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE