sb�N�)����R����q���~�֖d� F�u<ɪ��BG���@4�X�>�K+I,V`Z��q���x[�Հ�ȱz:�J���\��ïcs*(QPD Z�x7W<d �T^9���&���|o��/᭞N�V�&�u/?;*~��c�>�E!�+ܰd�U4]��j�(�K�9jl�0IS�>�]X�c��z�h �xЀE�ël��N���3��w�Z����5{֬��jBJpMޜ�=/�m�*!@^ɾ���<A��iN+ِ��8���iy��6�j���٘N6}�d*v��jVy٬"�X�����v5��K�cS�Y"hKR�J�[Fu�"P9G�<��������OEheZC�p .X��o������K<���v�$˳s��6(O��.q��Pd�X�p�v�k����j����v,�6�2T;>�����>:��/RGC��p�4�$Vα�?���-��� ��C۸���Sg��ƾ�/"~��$���[��߇��1��"�@\/��RѼ�;}�nY���'�le��i�vH�_�::!N����I��m�M#���*�;&�XԖ�_/.�߹j6&��D� �j��cX{�YR�,/&�����vP�i�UNU�~"���A�����}:o�FY�(d#��砿�_<t��g�f*F���n����9�mK�x�^�t�D33p@�4� $�� ����Xw��@Vѿ�@�f.،,|���_&�+gt�e�P�إv�E$�$5�'�����Vl���~Fb���U�b�Eu�-��������>��`���7���}KHO�;�^0�j���Tq�n�����`��d���V�ʛr��E�v��iz`�o:�"A�}��ؓ*W!b`%���r%�K�I�+�~1��0�rx����1�D�na/�k堲��H�a��V�#s�g���0K.��,��<^���;l�p�a�F%���.P/֍7� =�u,��7�>����vzy���([�?c=9 ��r��s���ٞ�%�:X�����[�`5~!S��gk�i���~�1-�L�W�n�a�#�D��"C�Kƛg���Rئ+.��}`���@d"�����a����^�B�]D??����3���� ��%��>ê�"�^�ȗ��)M��RT����A� 9pN�����0>b��v��ƶC��iEy�ā.����T�q � d�ӫa�`�������3i�����Ff�����c�Q��q������H�h-_�x�ۤ���ꀕ���Ȏ/NA���g�������Mm9�ֽ�Ν����o+�� Lj�D`����r�+w�Wc�}`~�%N�27pkQ Pn�����$Aq�� �@ D�`l�r�U]���)�v:Ճ�!���yc ��}����&j*AP6����c7�=g��m��:Si[�X��6��|�I �{��OA���{��H0!�@�����6��Ij�'���/[u��L%@4��:��j�➳ ��4�����o�s�{wi5�F���P���u(������=�rlGT�ɟ�:4�\O���m""�� �4}�ڍG��/�RCD��}Pz��~eT�H�#V�n����?*"���㐬����f�J��=���C�i6\��s59g��3 r��p�c~��B�I��ZE�PW�M���@}���3I�٭�JA���pPR�0|��O��1��se٧d��q�!59鴕8���J`��QH�[.C����B^�~>��5��Wd��1�3 ��Q���>��$ ��:ZT���b�ʛ*�XM����j�qǻ�r�!�K�;N7;W&�Hbb����7�w��_w�Ft�9�d�.���3i~�lu�c���]}��f.U����I��%�FUC�l�baoH�[T &�����w,K~1���! ���bH�8�0���"8�hrp<��VٹS��� B2�vN��&EB�_F�Cie�ߌ��0`C1������_9�m6A~8Xkƥ4\�,)9Bڳx�#����d� k�X�Y3a���kb�O�0�1����K �� � ������ ������%����$?@?�uH�:�e0])�\yA6��<z���;u�����c���3�6�!.C��ZȬ��x`~ 'nuj�����^�,�W�i�w�0�xN#�s�փ�F��#���a}��jX�\���ʫ�_�aQ�`B�,RQ:n�Kl�}J3�3E��<%�%R��:g�I�P�%���]:~<�#���(�a���uE\&pȆ����1��(�_c� ��ȇY{8�$��=�8M�x�\� ~�=4F�}�������EUe�Ӫ����0�:Ea�].歪e��y����M�o:n6s�� ����T. �5+���R���m$����[���hȪ�>�WVR��t��\� ����*�GKl���o�&�@_uj�ﲒ"�Pm;P�au��j0���U<A�v �b�W7�$���$k-x&�6�ʺ��7�op��j��\?2�-k"���M�X��f(OZ�G���3�;�IN5䐆l�����`|��x.z��C]�c(Sk^7�)� ��ZD��� ���I��Q�m¡J&�\�V�ϑ'!%t�/ɶo};����UNˠ�R]ԒɸO�G�#��sQ ��P���uB�{O�Ȋ�*o]�L;�i�����+R�&a�Xl���~��n���[�M���_��̣J�#�1��Ca���}%� 1�TO����A�o�B����P�CCl=�j,�^=Mq�����nȉv|��f�G�r��hO�2���&s��ۜ��(� I�����Z۫ѓ��/e��u�B8�W+/�>�����V5����`[[��;J�,oB8�ּ�Y���!<Ҁ��˜%&����H�0��ݎ� 6��ˑ #�.sKC�$��O���f����OA?�3���L���U-5�ghДt�~�����lͦ6בD�wpĢ�Is������ㆢ�I1�u�By07s�f#/��ǩL'x%o�� ���,|��v����ː��~�[��5K-��ʌ��gʟ����X��7�|���٥���-� ]��ގ���tDj��h��߯k�GhY~����!y�J����@[aA#�� ��LƉ�>��X�7��\��C�=#�<ܻP8F�3-M�g���U�7�a�fc���X��+m��If�6���N�6��ܝ¬�*yW���;U�x�2!����M�ϐ��o�+�����Rʑu����FLIؼ���!�fEMĆZo`X��UߟOf�~��C,����X)�-p��j��
Static task
static1
Behavioral task
behavioral1
Sample
7f0b67825d87e6d41781efadc23c5c28e546a1aa6681af6504c33ecc9cc038c3.exe
Resource
win7-20240419-en
General
-
Target
7f0b67825d87e6d41781efadc23c5c28e546a1aa6681af6504c33ecc9cc038c3
-
Size
3.0MB
-
MD5
04d0705594d4277a0682f9edbc154c22
-
SHA1
6e4cafc6138eed8092981b4052903726b59e35d9
-
SHA256
7f0b67825d87e6d41781efadc23c5c28e546a1aa6681af6504c33ecc9cc038c3
-
SHA512
4e1b345a115b0479bfb1b521da978a291f132fe90bd28c69ae22513793d24f36ddfe30ab293f7b145bee58868f35d788ee70fb7b70934dc74108a4530c4a698a
-
SSDEEP
98304:rPxzN44BRbocnSruwL9oLvJNShZLmE5u:rP92wccnrLvJUDmEk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7f0b67825d87e6d41781efadc23c5c28e546a1aa6681af6504c33ecc9cc038c3
Files
-
7f0b67825d87e6d41781efadc23c5c28e546a1aa6681af6504c33ecc9cc038c3.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE