^����i_@��ҧ!���JmIN�M[g��8I������̸8���%�i����bJ���"9�畒�&bH駟��������_2�Qs�_g� �6�V�7m$`Y�;�G�*�Fۛe�������(4Q�.� ��3��eU�=W��� eU�Y���_&_�[zn{�Dy�r'?Nn��O�#k �]�W׳��{~���݄ݾL�^0��y-�e�ys�2��%�Y4=�1|� �߸��"��Ɨ�Tb����++���}�J�o�X���K}M3qx�62�\������e: g����t�c�!Y�3�2M[�J��'@����t��:��J����N�8�N��m��~@���nD�Dx��v�*^����`_�R��� Z͑�yhڙ2�l�@�(U���ַ�ZJK?.��$P$�:���CZ<� �����-@4QU#z�4>S���b�tM��켜%وN pSΔ�M�anJ������/ ��Amc���ێħ��M>��pw�Q�h%B��B���ʖ���)�x��ʹ,�z��uz��t�œ���F����T���у����я�S���_��,�J��}����fㅻ�=�1n��w|��\w�1��a��61��2Uw�J��N��W�v=Ì-�3O�zvx �sw�d}�"�/�����G>0T�BC��T�ƥx7��y�O�kok�UiS_ņ֛��t�R7�B�W�dv�N����a�B!X) �BQwL ��8�� �# r~��-g�{�)��QF6\`���\L�B���`i��w=�1�{��( D�I��1�o}b�/��qʲmЦ/H��a��GACa�2�/�Ф�V.��<ʍ��B��&��:��.�?�_U�R�6̴Ԓ�<���+�L&�J�G���f$�&T���X�/F���K�sN�D����9��Ә��$h����?�J�����~J�z��.�+�����Oq˧���t~^�oY��2��!�����L�w�Ì��5W��9�1n����Eͩ��Ȫ��� �����xejR� 5��?d��6�_!���*{�G@�4�y�E� �l\���v�b�|h��@h{;�`ī�_ӽ��R�ֳ�۶�f��熩�`�WF��E= �!� E��YXy���1��"g'��3HޔPg�i���y��$� ���T�afsYI �Q>��ސ��p�T��������dh�?<2����֨s,�T[���'��a��Ĵ�e���pL\����W-jt8&�<�)17�=�\XX@02�wa���/H�<��ů�/~~b��#TI�e��9�ư�����6"1ӑ��u4���-~U�T����#�c����c�6��S=O0��s�K[������q����U���=�λD+2����Hl�����$6+�B5���dd��<������>�!Zꤙ��:����������D�A�-��t-g�9<�q�"Q��4n]���ʁ��m�(����펊��.;� ���'���{�����SC�AOΓԑ�0�`�{�ptR�^G�g�s�Ѭ�y�A��1���K�������EW/WZ�2B%����C��w��V��*"�>��'�p_8��-�:IՑo}�Z0j��aG�� ��{�n֜��S�S�pYvV����ov�����+=��h}��nzG�OwXP.����S5�G(R�w]�X橺����7*�X4!JM@,>&@��)�����&���˔G�I0���J�܂~;���w��oMfV����"u쀋d]��lQ��J.ig��x�����W4aʐyA#�,0¼v�����'Y7��쏲����6���bV����d��C)���#�o�w�1E����G�4��t��~|d��0d��b��j3 ��v��0�6� @uhi�T88���rFN L�o֤���I��r��%��V_={�F!����C��8?=s�#I,���gX?WP����X�����B�����-�MD�����H�E4Z Y�1�ʹ� _�g�����P��)Ť�^�u2�/]%��`���Av4�I�(����}'2K��ff�N"`:=7�uM=Z_{Z�LM2ӊ) H�����Q����>YY���� �Fcj"w# e��H�u���e���a�F|A�����ƃ|�{!0�Yd1�ع�:��N���� Ӧ�yM2���Q �sۣGt�A��"���A�N��a�ER0��n���� ��A�,�hݹ���4�9��n;����"��s��0��)UňeS'h�����c�%� x�(=���̼�.E�`�h���g�����۷��ӛ[���8.F~�����bW�$9���9������>�p���@l��gu}���W�ӈ~e��/����JT�����������[��f��#<�(�@��huI�:����iE��O�`y���B'*e��m��b�z���%��y�4a���:sL$ɗ���[�Ò|yX�LS���ZT5�kEQ��ؤ�@�:MU���5e��vk��I���N2y=�}\Wb�N�]6�����i��Ɋ�~o�.�S��-2�V�����S�� ŭ�K+z���H�C�"��|E�3W�@$��\8���lT�`�|73q���q�ÚU:*�x�\�5`N��y�{-����D5t�1u��z��:� W���1�&#�������2��u���ʄ��~? )��Z|��y�7 0Ј]��̃'��ȏ��T�J\Bh�+'���c�;��[� �nW;�M8�M��\���FR&-�Pft*W��M�$�aP�|Qc3�td���c�H� HƝo��/5������d��uq����\�\� �P*YD������(#g�S�ۛ@n�]K������af&�mg��j�g��2U\��B5��JE�O�����[��m��,]V�~�災]kɸ�řR��g��umЧ��!q���l�j�I�o���|�����Ń�Ҵ}BwBM/�~agK�3_���K�Q��$Yz�#���G�hRO�KO����qB�1�r��� 5��������[�s�.I��.���n����$�q�R�B��d!4��y�]��j2�4�`NX��xB9HY��j]|K'� P�w3��U �j+�5�T�ڧ��Y�`z�=73~�贊A'�]�J��:����s�#�����xL��NY!��R�.�{�W�����Ix��L�4��9�: f�����w���]_����Q��PX��� �bּ�8���0E3���{�r�oуs5�o��m�,�Z �&3d�6�qD�����NO���^Y�W�Q��a�� ) .s���Q� �˛
Static task
static1
Behavioral task
behavioral1
Sample
99e46709414f98d12b82d1ee7e8f648e1b05d4853880e1788a156e3bd0f7647d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
99e46709414f98d12b82d1ee7e8f648e1b05d4853880e1788a156e3bd0f7647d.exe
Resource
win10v2004-20240508-en
General
-
Target
99e46709414f98d12b82d1ee7e8f648e1b05d4853880e1788a156e3bd0f7647d
-
Size
8.3MB
-
MD5
e5d98f66f68aabea3d60da51571d6b09
-
SHA1
e81bb6f562e898b8fb30762880d9e2c53e2b5f81
-
SHA256
99e46709414f98d12b82d1ee7e8f648e1b05d4853880e1788a156e3bd0f7647d
-
SHA512
ce6bb794d7b7cd951c9c252c5d3d822cec40f432344e03b69a13da6aa473eea8c0b79810526ba4d93de52cb941687172801680d010a4d0eaa37eb1e15e47fb93
-
SSDEEP
196608:F3cmTfQ4HaFg03ZwT7ScUfTqO9jYDOQIRoIdaGHGfPLe:FNTX0C71CqOFYnUdaG4PC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 99e46709414f98d12b82d1ee7e8f648e1b05d4853880e1788a156e3bd0f7647d
Files
-
99e46709414f98d12b82d1ee7e8f648e1b05d4853880e1788a156e3bd0f7647d.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 452KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5.6MB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 32KB - Virtual size: 396KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 12KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE