`���MD2F�1Id�e�I���[%/N�8M�r� �u�(�[�?:�n�ӥ�If4��R�iy0��)��l:�1T}�x����J������*�eKu����������͆�sltB�5�L]�������@�˳�l�%��A�[�)3 <aꬄi9�;�R�b���a���B��Ϲ�+��K���|Ni��&`ޭ�������ݢ���9�煬=��]���e-jQP���ANsOè�k���,iղ���t}»���� Z��:=U���>�*\ �9�s�յ�f�����;�t1d)E��� ���U<�^�X�V��FX���(dy��Ʋ�ߡf癔i��Z�1H�� �"{���⯭?2�M�*��D��Rڈf��X��� ���l� ��m�D#�ia����<^x*�[t�>D"�%�X��?��4t�g�ōL�q��*~�ʱK���G-t��w���o�cК�4���P=s嚶�"� �v�| e�}:��_���׃hm{vR�a+(��B`�6��^vs+�.%>��4ܑڒ{�zn���I2��8 ��_���,ə�u�>!� �^A�i�v�.K���H�O�3f�Ve�<��S�L�oz����}�����lG闳uIz���pPCͅuh|��Xq�i���k+��IQi�ٝѫ��ՒE�]?��.����� ���X��y��Z���j�0ڭ�a�p���yg� ���:6���:<�*��|�y\�����Xsm��v�ȭ�G�s}Pgѽ8ax�V���8U�6�.�m�{����bg/YlmjXt�������!A���-��"{$6l�4��^v��C� ��:�u��in�N��&�����X�V0ύ�.6���)�;�A�d'�|�壘����'�M���h��|����!5�G�³�C�[��">�'ss�c�}ϛr��> v!��ꄬM �~�ﲗw:�K�Q�+gt��e�`<��)H�)&*�9�b�������lH�� �j]�(�uA[�����woX/�Z~��{[��>�K��y�L�����)]R�c� 7J�) x;��^s_��<�@�d�4F��b�勾�.���z��%���AE���a�0� v�ݺvq,��R�E��=ˤxX��ů.ƅ�_���-��I7�SMs� ��3vf�.lnSZ\���:�mpA�BƦ봤#Kׁ`M�]u�n%��%N+齨��i��*�[�|�5��F�����#��O6�U��ZӍe0��jC����ٜ�z�o)���*g9���xP���5��D�����ob9x��\����&�6?�;��:�˩��Y�xoc,�����4'�[ja|��W�T�u���Gz�H��-��~� �$&�#��hQ�s�K=��ȱߕO"�o��=|�9#�mmO���K3r�2Ϻ�� {��y9��=kg��yS�Eb�S��h�%L5�Hj��;|�l�����8}g �����'A�ќ ��Y�w�rO{�Uɸ,��]��3I��!iƟ���������O�.��S"E6&"�Q~U� �>u����վ[&�G���Ը����v��k ���G~pꊢO;�����j`.�v�-P����< 矚��iuu��'���T�yP�ia����x[� � �R�8*2r?N�IHi�� @P>$����q�Ig�e�"���9�,�3�Q4xRQ��*\�Fj �/*M&E8P�m����r�JWcNY�,<��c8j��ŋP~*�n�J��h{ͨ��,���6^�������������� �qW���P�w��ugq���.i���W�O?r��$�5�6$dS���(�F;&��7*��[:�kZ��ev��D������0�J�k={ؿ�&;�ϴ���]��_�08[�^��]��BT�!zE�oh�s��η�F��F������+. ����p�|z���]�^��Ҕ=����bi�|���PA��|���<��ܶ�<�uҐ={U����-G�nU��M���S(������N"jbn������qLi FA�~3Y���1��& �m3�@�>8@`%���dT�/��K`�þx�h�;n����B���[�w��H���X�U_= �8�(]��g?p���c_�枧�^C"�� ��<����� �z�2�H�]14�2�zz9ˁg���e$Z�gp�� �'�\��&�b8i�@��8zg���#W$Y7�L|=���bʒ�69�����dh��H���D�z)�V�ُ��g����3ɔ����5������p(e0DG�h�yUW�:\_q����{/O@��Z���T.�4&C������Z�;p`Y�h�P f����)j�X( ���������E�`m�����c�9)������xk�H�q��u�fLa1@^^��T�v=h������ZFeg�Y�*�&��HʋK-��0g�^�,�"��#�},���o��C��%tt�(ըXQ�e�n�/�v�1�:���1+r�{I��]K � ��q�\��Se�\�2��z.��;�Tip[����淘�{y��`�-|�����@����?�_�Q���y,�|Wn�k���W�n4�Gn�L�jҷԔ��3���t�#�̬'L�-ɰ����_)D�k+�Ȑ�F�5�<��Զ)�=0^@��_,�S�_q�`[�3a5\��XQU�Ӧ��[��鲻ͲJ�3E��!|h�WW�wm�} prN��.��J/��r<��=X��+��.�o��4�e�]�鑍m'zȨ,h�0��5��>��v�Άb���dPUg(z�P�����<���Ң4?)���!,*��=�~%:Ko���x�Ү!m����J�Ο����T��)�rg=ɌA�5�?_oN�囜1(O�(B�nB�.j�>����J�By���Ix�G������i�Әe(��#{�Qȋ�u��0��Y@Ӗ�T�(G�a�+��KS���uJX��(��_���9�<-?$�۰\��#(33�0k`��? �؎�ϏZz�l��S~o�Yas�龬-�^��|���ʮ��n vР+��4���s�� z��U�3zUb����b�yp�:@��]2���gn'LG��B,%N���W���Sn�aJo�yp~2Nk.ǣ��v�?��V�V�H�����ew)���]�������3���լ�_�+Q��w�]��VVN���:�W�^��)�m���G�����'Zنp��N�d�P����(b4�ՙq����MA��1��_�c$L&G&[����z�[��m-�qf���\�$D��7�F�ʕ�9����r�*�~�A�kH�>���Xʧ��2#L<���ZiUx��'��'n�D �+��[?�H��(�����1��,�/���04��� 0Î��������R�m�/�R{�s�Q�"ᙒ�|�`��~i5���I��Y��AL��j��V�����eabFޚP����)Naw~8��y&��������l���
Static task
static1
Behavioral task
behavioral1
Sample
def2f136dd2cfcddf0f2f3c324cb60690b0e3c593c0e54189502d1cf6df8440a.exe
Resource
win7-20231129-en
General
-
Target
def2f136dd2cfcddf0f2f3c324cb60690b0e3c593c0e54189502d1cf6df8440a
-
Size
3.0MB
-
MD5
83e95fc9121ff6ff9b9d3668283cd1d1
-
SHA1
9ad573a84718e171405efcc20efd4f1dd1f51442
-
SHA256
def2f136dd2cfcddf0f2f3c324cb60690b0e3c593c0e54189502d1cf6df8440a
-
SHA512
dac07eef7990a67bb85ad57e27dcaccc78307f5596005a06e24dd698ead7b025f63f9410b7f3cdefea4251c87f72f0d258cc4028090ac3759c111b8bcb898b85
-
SSDEEP
49152:QoV0jAVdo/6+u6Fr4pYARVu0mLw8X0/QQRuHARq9MOId38R+u5jDbyT4Y3:x0kt6+rRc0Nn/5y9e835+kY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource def2f136dd2cfcddf0f2f3c324cb60690b0e3c593c0e54189502d1cf6df8440a
Files
-
def2f136dd2cfcddf0f2f3c324cb60690b0e3c593c0e54189502d1cf6df8440a.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE