�h���<D�W� ��3 ��]��0����zI�ޞ� �5Y Q5�'Gp�s�/^V7_I����Hגd��Ay�!�!G�87K�B��$�N�0����҃~��le ���r0�!��E��jY�Z�RH����G�[���!>�:�~�T%������pb/0��x[!��d3���Ƴ��h��Ԏ^�]���2ə�u�&�������xԖ�@PnvM���s���-q�/;Ґ��k�o|ňi#��Ra�����N����� �3Ohs�`�dZ;l�ƀ���Xǣh�)���q~��a�{��JVd���!��׳;���W����a����ba��A�-K��&�[5ՍF R�w5(��7�ŕ�3�!0T#�~ �$%V�D0)�R(������-4��H[N�5{� =1��q +�FmUNo��*��۪���i������\GUZ�JR_���$�L��^�j�i~x�Ko)�e��|�����[��J:�O��S����.����Ň�##�t��w�m\g�l��ӊ&-���\ULj�AA)�B�(���W?��rQh���G�G�0��\ڏ7���(������Ya �[ws��鍆EY�"[:�H���q���?�G��u��<d��y+���&�b����]nQ��b�X���PD�_yE{L���x�P�3��]�\;^�Y�j# �i?HC���M�� Cg��*���<��R+��)�N��U��?��S�yr����3^���Q4���Ƹ+a�<�Hl�.'��8���;rAN<^�K'��E��{�0D��:����ϴw�/�E;G�!G2��yB�DL~��ֳK0.wc�މZ\��0LƖ|,�o�C�Ҵ�ZI�K�T���7t�4�5`m�N��,p�������#��G %Qt���{ �D��"���g|�Z��%�ԟ�=A%io� �,H��)3HG��&�a�*�Q�g��8������$��[��Hpܨ����g����Y�Ѳ��U\���S�:%��!�c�)�����8\i�sT��[��i�;��`?���� _�Rl�g�c�?�0�w��c�Sƈ�K����j��%�����Nu=����q_�n~�/h���ѭ3˰m���L�������b�f���U��.�wyS}fI�r��xI���,�ߑ��x�a�yM�l�r:�������R���80h����� u��ůK�q� !u;.N92�PC��M�N��T��bF ����<*��@�?�ϲ��:��M]�lb�f2~'�+7>V���@]Ur�~�2�lF��,6mՊu���ᘹ���&�G��~�L�$�~�%{���s3�U廊�I��1/�� .=���űwxڴ�5Up�[�=п����i��+���сNUZ�Ur�Yń��~���6�wb0�J��:*a���nŐ�孖x�� ����j�&}�U}���L.�N*_3�W��Ɍ�k�pk��c=c � �6aY�\!y8ĕ ıB��KOB��Yp��2o�J�m�V=C�`@��j+����Bȧ uC���H��X%E����ÉC�Ĺy��<���R��K�J�/��+��G��rν�D�+ܪT��g6��A�eL��#J�N�D�G��US9����:��@4�ݎQ���3a�_BP��x������|MP��S�m��2x��5�}Ȇ����.ߓ���HT���p�{��p��zk~Lwm��gH��I 2�v���g�=,��Ώ��̢w��Զ�֯�~��Q�̔�$:�,|io�����a#4�(�%�Eb���qI�N.�C�ޑN:M��2���Hy&�ٍ��ƛTԅ�^w�]2��#�r�U�x�)-K��Z�:�3��tU7�dz�/M�ډ/���W��];�;:��6��n�Iܣ��Ζ����e��`��V�I#� 'ڲ��D��I:���\E@}W�?"�fB���Z��rG�OJ_��fH�b�G;�˚�5��[��HI'��ZX��������.�]� u<���DO��΅��I���349 "�V��jҭQ�G����70+��k�Փ�V�e�����x�n�$7/��.g��wݨ43� �Kb�����w>����5�>JZ���5V)��Q��&x�K�@�U���8n[PX����N���?�C��m�ި�D�>�䬷��R���#E��J�� �t��q�,�pJ�ʞ�D���ߚ:��-�"x�c9�l��t���F 4?�p;��J�>\Ȭo]�B#-�=(2��d&ij/3D��F_��Ujiغ�p��D�U�J�8a��ԩ(�ۈA�Τ�e�g�Y��L"�k<�~�d�{�j���E�(Qj?�K� TP�2$o���?��d�c�@ėw[���*��z��TSe�ZDғ�^���d�6� :8��:����SV�Mԁđ߂����Y�����u���om�U��$>�������^�i`���(�X�y�0�����#���h��(���ƶQ�Q��A��'m�B�'��`�P��t[s�@��gh�ַ����Y���cـͼ�1D�5>c�`�}wŁ�� ��L�'a��or�v��ޕ�33"�!> ��C ~)>������$�6e>N�e�?�UG�B��YF4��n�[����M�K��\�I�B'{l%?��r�\2ɦ�Ψ��7k��!u��t)�<�6B�aK,���Ad"���o\1�������&����a�*:�!��~C�Y�Q �</�6�f��l����������ɘA�l3]��X��Hv�hyD.'�"�KI@��d������1J��+y��v�^��#�h� c E�\���q@�x /��|�\.X�f ���Kh&_!���a���]�ZN��dx�j��*'�Q�V9F�|$������`{�'iUo+(�&=����Ǵ_onR���{hG�Z@{lnQd�M|w*da�6��p�C{�y�D|�mbbw�����&�;} ������~�p��i"��hx�e�c{�u�K!nR�5��ul� ���aC� 0���m���*���F5��N�#�Z?�~= 0�ο�:1� `n;�ro���['|����E�`&�@x��4�ajj}L�B�(�=uE��0K�+.�@�� ʟ� ��\Ӿ�$ �=x�%�n�IG�T����9���e���Ya-)�����W�Pb�4��lja�w�L��1�&�ŁJ��2�f¥�ld�����d�dymvD�d y�a�ӽ���vw�c�Ϊ��Q.��EF�ASxJoy���`E�=:���(��b�1�~<wх���4��{�Uʖ2�y����W$��5F�rV���c���&�*�aC���i���q'�?��n#B�$ݪ Dܾ93n^�����2��r����ɾ�.���i��:��D�6%�.t���u��d�M���߱G\Q��N�{= ���H�;$����}�^�{~jI���tV�<�F�}��f+Ŕ�ёT�@������ل֮��l2���[`����S�o�Zd�aj*��4�>`�ٲ�*��?��pU$M�9p�K8L�*}����OxJ+����� {"*J��_,�[�BZѤ�8c� h�f[��U�G�d�0-5D��� ��ㅶ~�<'�']}�T����|�v��x�� ! N1�b��ˢ�1Q��Ҿٛ�
Static task
static1
Behavioral task
behavioral1
Sample
264b38772eaed123b2529ac263787d47dd1191911c7a711794c383f91df6a46a.exe
Resource
win10v2004-20240508-en
General
-
Target
264b38772eaed123b2529ac263787d47dd1191911c7a711794c383f91df6a46a
-
Size
3.0MB
-
MD5
336ee253ebca57d7ed50034c09d7edf2
-
SHA1
f117df8aaceac1c7030034a0894b7e1cf9a4d811
-
SHA256
264b38772eaed123b2529ac263787d47dd1191911c7a711794c383f91df6a46a
-
SHA512
6257df136850e14ad6268d853fe957b25fecdb0f64002eb3d6535b2be6bf96dcf995d67116b153c1d042293e681d38d141c00e3730f00df41abe3b51228756a8
-
SSDEEP
49152:Io75lvb0GiGDcAgTAvCuDaWHQdfwsDCjDWk7na7HWpGIRrK0O+N2phDh0W:Io734GD2TICeafFDCnNQ8GIRrKLphVR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 264b38772eaed123b2529ac263787d47dd1191911c7a711794c383f91df6a46a
Files
-
264b38772eaed123b2529ac263787d47dd1191911c7a711794c383f91df6a46a.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE