������0�(I�pG �4�0Oh����v �U.���D�E��ZH��5����PA�a�[d p>�L'7`��y6�k�0�S,�Y�´\��� w��W��!:�)�t���G��g�������6k�̣������N�� -m�w�*|wK��� �{�x�� �G�VA�X ��^��!�2j5�r�m����7!j~�~4��W�7���?�|�������N2Z���9�E��-Ao!��z� ����<�v�M�۳)l���+�!�v�h����d� �&�n�|5j�����KҀ��uD/�cx�,b���CŐ�=r��&+�>�*�,���m�[_mk�x�}h��*�]�a+�o5�b��<���� �Z��q�-Ⳡ����!��6��;���q��� ���z�Y%m�����w�f�f�&n42�UX����^fj�������R�(Zn��m嵊ù�E�V�Tq0F�jn#/�W���S��Tx;�i�̉}�Y��b��c~'Կqht�v�`��~����Z \cT��;H����5ė:7�y��Wp�E_r^�k�<s���W�S��M{��A����d@�F;�������-�T(�.�Q�3��R�r�VQ^N�ߣ�܌5�,����I�ݒ\��YF��n�T��P���XY{:�:�F�4g�@hi�&���f`���-h���o0�oB�Ыz"�?Tת~t4�v���8/Ԧ#-��SC�>���'�pe�a&@�ޤc�4���'�;El-�Q�U�X|Iq�^��wg�2�����k���0-���c�nNI��-� jrw�:q�%���������%�3 VL��_�~6#c�ոa,+P��4ݞ3̑�ޠ�!^�u�s�[�Z�N��� z���M�-%o%I�o&Gn[M$��3�Y�?�PW��\�0H.xFV��*9�!��~�״���`�h��s�����2��\��c��0�`w�2*����.��Ϙ��J��`������n|�T(��K���8A�L����[%��ȧ*��:�mׇ.���[G���\�������ZnIo�<��yONSV(�⭃�ѓx8����N"\$$���/��k*�ڏ?h5�]��8s��#�܈�J�� 1�1���Q�06 u8w��^���x/U_M�Erp�f��%�Q��@�N��n�XF�x�sg`�A����`.l=i���o��+���(����*�P���l���t��3�^uS}�|����X°n�b����.s�X�Wb��|z���>h�� X-�՞�Ck�6z�ŊOx����C��@D��ˈ3����C*x��'h���z�t�<g�(��������&�o�q�wvi�6��9r�3j��D(��Mx��]��=���%C�I#NiK����L�Cz(�$�WeH��Mv�ګ��d�$�ɞe�߃�Y]����+��7��Vѯ�+.A���jd]E@�AU`�t�@<հ�Ո�ތ?[\�T�vםf�0�'�}����+/���I�W�t_���-�Z-N����_+�R�9"��!0ߵ�ȳ�%�#�47�Ɠ�!z��8o��!"���4Z�W`��S�z�O�=��ݳ��������Ơ�h�%��# �}����ľT�r����������>���T��(��M�.%0�Ԙ�I;�(�B����&�H,n^�\pk|�}��oB��ɳݜ�����a1*���ݓ�a{��_e h� �*�z�\Scv���[7��̩�mI��{��I�z ���g���������g�b&�� B�rY�L!�����SJ3�@��ck�Wٷ/=�����"V1�*C,��d��J�����xT^�%i���\"���vB7�v�Ļ��,*�z�{���"�ېZ����H�PWEV=�����}��Ļ;v.ܒ=����q��{Dj�G�p:]��I�]��2u�=�:h|)�R7�:�k`�'���W5�D���T�X���}��@����إ���*X#��{���`�N��hx�a�����*ƍ|�枕�q��� 1g����ј�Z�,D�h�6͑Z��cn3Z���� �VΎ������%���E��8�Qݤ~���u<����;�<j��0���� �Bd��'yyq��@�U=���gk�&O�]?Lf�1����}��U��U=1���"���2�c��_�þ�t��CHvIy�n��IXM��]8�Qk�[c&�Cאu��z'�%!��Z�ߛ� �)���*�E��o��Ӊ떅��P��?�")�.�z�J�$����>��b��Ӵ寔��x�FEb�/���'���˶c�8~�a�ϻD��6�{ب�8���ڻ{�%�����m����-�:��2��kw��dd�,��@1���C�r������x�Q�u���<�Qv��g�c;�q��Q�B��tC6���w�W�:>2�JY������B�D�.!�4�Sa[�au��I�j�F�zW�5�%ٍW6��q�n/�,�<X �, �Q���;���[�� ��x�R�Wo��)��q��c����!X '��Q�t�vPn[��� v���̇��ek��5��k�� �U}�mȾ��Rd]~�)�9H!���<�L��aC�,@Ui�� �EG I�ud�����+]��Ԇ�;tR���ϴ�6�;+r�O_��Mܞ��W����8�e ���/�ĕ¡;��"��EwvwƦ5=O��_����`������>��� ������<�1[b���s�D FX&�ͬ t��9���_ᤵAG�&��@��6�l�A5��(�۩�;�'\ן�#W~�M�gƶ�]O��-���Ph@$�6���f��Z���M�n�p�cl� ���'�"r�lg�N} �Ӑ��p�Nz&%� al��iI�[�@M�")R��|_uZ�p6)Hv ���?阺��~� 3)ې����q�9dI2�D���&�.�Peɾab�s{�^���ʵg���ʇޯ� ]8[�T ���un��Um��p0��4j�+��+9�f=��^��殫��!�{�cceD�nd���-�6^��Ф��� �zE��h�j���~.M#Dj7�����k"�N��b)�w.�O�W�M9O�2�G��pHwIw�����X~[����T�,���0���E�J[���tU�t��XY�����* Z����?yZ���1w/���:���G�����+��-9C��0et��D��%vr���?be�n��Ǧ���X��õ��X�S��4Sk`�s��J�r-Mk�6�����mu5�Tž��p/�[e���R�RP1�̭�^g}N/L�ӡ�Q�e��s��k)���o:Fd�ʹ��u�H�,EX�n����i�T�� �������*@?�.��_f��oNֳ�L�f��U� ���P9��狆�~�R��?�i�\�Y���<��^%ͯEޱ�6��7̀չ;g>�Xi���!E���4�;�M����osz��S������6C����PIP��l�r&t=�߱�~�I��S���m���� �^i���y���O��23Æ�R�!���znf5/`\��~�x�;w��N���5�Ns��_��fu^�P���T �6'�9��,J�}uI���0F�< ��8��&c�}�p{B^m�KU%��ӻ�E���� �}>cS�G(�y��ٙ,\�+\��L푠 ������.�ߙ�̞xXr�-�<3�g���i��(��
Static task
static1
Behavioral task
behavioral1
Sample
6920c9983098e5c93496489ed3011dff0b5a000c269adb193d5360f35dc309e5.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
6920c9983098e5c93496489ed3011dff0b5a000c269adb193d5360f35dc309e5.exe
Resource
win10-20240404-en
General
-
Target
6920c9983098e5c93496489ed3011dff0b5a000c269adb193d5360f35dc309e5
-
Size
3.0MB
-
MD5
f7c7825339fa135c613924ab784acdd9
-
SHA1
c4c3565db16a4d733284392013c2d941122e2009
-
SHA256
6920c9983098e5c93496489ed3011dff0b5a000c269adb193d5360f35dc309e5
-
SHA512
b6ec659b06d3fb319d00a504c5a27a87ac5344ce2f76e0280ee6d8e3aa996b52d9028f74860412dd6ed8369fbf2f8746af4a47b8a9e7ab011ff35ff544fe79ee
-
SSDEEP
98304:lTtn/yAADHhVTcXuouoZqYBEwL+VksdLMat:BUAAL0uQzCVksdLht
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6920c9983098e5c93496489ed3011dff0b5a000c269adb193d5360f35dc309e5
Files
-
6920c9983098e5c93496489ed3011dff0b5a000c269adb193d5360f35dc309e5.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE