h�K�s1�l�e%����xM�Dc���sFfط��)��ڤVD4��#�ew��P�g���˻!�Ȕ���(���*����H��������&r�D�ߧ�.g.���Q. �@��8c�k�����s�ԕ H[_��3G`�a8+y�h�M�I�^����-���|�铲"ЭXR����B9�I.a�F��Ϋ�̤�W$7g���� �j�Թ���9ҩk��3�Ԝ+��H��ˊ�ׅ���v�Sơ�/�=��(SS���,ʧ������[:���ze��`�Kڜ[k���Zj���B�2υ82�����-T�� ��QM$'T��0�g'W�\��0!(�u��L^�UbGB6 k"���+O�!�a�U@Vp�_lc�h!�1�[�m�M\�X����DcZ���8u��??�ӹ���q��&E�&���k����9T�Y>���}�sr�F���H|ڝ�Y����.�P�;֘@�N �vq���x@�/=���Spb�x���p��Xl������?����'�����%��Km��(������|a�E���Aa��N���h6�B��USm��tY���Ω��oz��+Fn!B��!"�,�2��ug���U-L.c�F�<[)�-�2�^DrÛ&��|��[cI�o=���� ��r����x)���z�_�0�Fc@--]r�����%�(��c�F# <�ì,l��?7�S��������sٷ㢰������uw��|�\y<p%�d��9��@9�-���V�B�x(H�1�W���b�2���ɢ����1c1d����r�+5%Ԉ����KQ���U����������|g<��W�gB���>Iֱ�O5��B�!'O����e;\��XU�{��Fc>�D�wh�Ć�LT�ĩ1���:�M�9���݈�:����<�z�����]��������`�,E���4 �Jن��&z���Nho��^Bl��~�+�~��7�i��H+F��5����f8����#.H��������s �wt�. ǵ���b��U�����[�4O���(A��%}��Z3� US�d�%������'���Zıt���(��[�3{�3r�Y�A��� �b�)�JO�nfiD3Nkc���6=ޥ���U�������;o%�m ��N<n�f]�[�Ƶ�!�,��o:��a�ƊO�qE�#�x���W?�vN�Q����q�I6�9t�d�lx}��W4pZ����t��{�LDX䀕�t �zNF��\ǝN?�Cq���1�EF��j%m�Q��Z]]��X���<��h�kwE�i��0��ݫf����$R��)�,���u�ZkT���-���%��]x;���Q� �X!���U�cJ��"�]���� ~!L���jd�_����.תO�z�YF�;ec1m�T�2��9���V�4b/_��t/Z�y���r��ӻ��Ԧ��Ҿ �z7)W�����t��Y�4l����й��0�)�L0���FLJ F�0�O�E�gR)�c���S������Y+�,T�=R��0ē���|� �D��Ǽ�+�����,��q��H�2L|.�일�� u��&�ʏ�(=,�Y0c�9�i<���o-�4�����O���m�Er^e��\�7��>��g}�h�:M�W�)��$���ٮ҄�̊C2�wB'{$,���]���3��2��e���J5A�rم`~�/�Q�`��#��4�F�Q_��ΰ�R,7l�;���?��������^S���\Rv( ����W�p1��R��p�Y34�YB�O�ц������c\��䜖��RnL]0ax�k8=�[����_�}�Y<��%(|N����qy��o���D*(��T���b<����6K�l���������촑��B���Ҩ�� ��:����B�^���,���0)�5���^�[7�Kua�k��s�E�+(�H ɿ8��E�mO\�jO�0����FХ�)cl^��֫�öw�FY2������K�2��C:'�'���eٟ���H����B��+p ���ʀD��j)���;���G.��mq�w>�Q���I�&Gz���Iȷ�פ�>��wC�m'�������Í��M*�P��NJ ��[���8�E�B�{=a�]��Cz����܄�lPPgx�D��B3�M0'�Y��u������}3�R9��_��vj�H�]��|� p���z����8�E�[� ��� *l�U��vٚ (���'�����U�w�ߏ^���ɫU+8k���[|E�2fK�P�S��rX/~�h`y�2O�Q9��x��J��ٗ&�."���)7� ����!�%j�Ӣ��B��=����n�%��HWl% �l��\d�r�/pۇ��� O� ��Tۆx.-K�°��j1�m��/�`۷)���:5�^�v�����>�(��l�����twy�B��I5~OE�p����)��1��,A� {��S��^ r��uU;x��Pp�H{&��<�.�<C(����~��K�Pč]HvZ�RzAlOi���\y����tt�[k�g�������8� !� y�r�*~�G@�x��o�oٞ��u�O ���K�ԁ���R&ʝ������T�Ǯ���Vq?a~�}Sk�Dc���U�2e!�[]��������0��f��5Ǯ�� Ӟ�R�'~d&G��VU���l�ה���������Ja���IڴzR_0�+i@8���� ��s��\��\ ����@��ΐI!&��c^���$���g���Ié�#�I9ZUc}�7:�l�7��rش����Aj�mY�;�!���c� �L���7�C�&2��r��� '"L�q�I0�j�� f��4J�x�٘��)ݍ&K���Ȏ��0݄�@�x2'5����L�j��BUW�)�^`ԋ TB���˖P����쩇I����y�6o���r�����Y�x�1o8��ȋ�)�ѷm�J`�[Z#�|,L��Z&�&�2���fY* �;e9�3�7��9S%����x�Y z�<O���ǣ����� YڥL��'ȳIS4�q/<���B5�a������;��N�Ŏ�uC_�����>��<�A��Qe��UM�m'QX��� q.� ���kH���?���{r�T��Ɖl��/q���+��� R�f�)!}".=��^AI1�i�כ�"���ƃ0f���,���� ��;:��d!C�i��nhV�J��j�t�Jo�ܸ��ciW��R���2�@�~R�" F�D�ثVJ�C��,�s:���i����9!���> �y�$��?��H��~ kA(��tN�-�v��!���C��fY��u����EI��/=����?%�pط�zL���Jr8�х[�R��f�T�E�"����"�w���V�3ܸ�������~V5�`�a�4ԕ�,����_vS/ݩ�{_sB�]�����>���uō��FG�o:���~Q�4�i�&�rV<��/\��٧^n`qW��N��O� 2�M[�c/n!��IY0�Tݻ���n������ƻ���p�8��� ��Y�?+���l���i��|$�K_y+w/�L+oa?���/�|(�j�\�2�^Dw����:f<�R ,� �1a·���,qYR����,��B�F;M��#Z���K0A����Lq�k;�:(������ ��dc~Hov_����
Static task
static1
Behavioral task
behavioral1
Sample
fabe4a0d95ca7b6677e40534fbbe3436fcb00efbb2bdd7f94aa171acb660e9b6.exe
Resource
win7-20240508-en
General
-
Target
fabe4a0d95ca7b6677e40534fbbe3436fcb00efbb2bdd7f94aa171acb660e9b6
-
Size
3.0MB
-
MD5
394e7365ffdb195a4ed2425ebc21ca17
-
SHA1
986208f8a971726628ca857e3bffcdb8ba65c09c
-
SHA256
fabe4a0d95ca7b6677e40534fbbe3436fcb00efbb2bdd7f94aa171acb660e9b6
-
SHA512
4b6c44042b329774eb1885f14411482fd19be5f65d505704344e60bbd6496a17d068e3e546ae5f82f9b499712ea69f58256621b7b519c6cee284b75cc23e7e4e
-
SSDEEP
98304:ih/qdPNhvDwefkS8DLy8DyxZhfxT6MyD4:y4YeZUGsyX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fabe4a0d95ca7b6677e40534fbbe3436fcb00efbb2bdd7f94aa171acb660e9b6
Files
-
fabe4a0d95ca7b6677e40534fbbe3436fcb00efbb2bdd7f94aa171acb660e9b6.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE