[��`D���u��R˸�=�UHR`,ggn#�m� "���i�y'��O�[��wx�F�N��P�>����")��g���*ȭx���?����8�4kw ��(�P�[.$��}���I)� 5 �x�.�tС�c$�\N�W݇�ё)ᐆe}I���qn2� �A�s2��\�������O��Z���}(Y�����Y���ա� ���LKߞ��"3[������?B��x/"��q�w�,�m 9��dB7����O�ź��t�����;���TYe��кm�����ϭ�+��pӖi�m-���=$�3�E����������ܧ_zys���>�"u��D�:b�C*^M��}��@G)[�ȷc�~��f �r�2X D<6�������u�[!g�2�IIKU��Hp��H�&�M`:�Z1�!������������e��qٯ[��7�5�e�7AuB�I `��i+�r6g�AQ'u�%��g�(sBM�NM��� � ��#�_E������L���>����]�Bۛ{xM�>��O0�*����ȝ�u�V�u��?���{��j�X�M��' h�V�C ��;����*0&34�Ņ�w��l�9������#�<S��CkT��}g|�`!1�a�����XW,Eb�:�D 1l�sд_���}e��057��������4�mhk+��l�4U��b���(�9�>Υ�kJf��8^���젵��f,d��I*���|]��{�~�����Ǡ� p�`J�O>���x{�KSF���~>Կ�����櫜���p��C7�&�^q�����sE�K��m���hu���E�C� ��3���PJ��3���������u�I�\��\���u ��8��^�o���S�D��])ܓ}p����Ѧ4/��o'$X7�!�EN݁��ta��T��qT�B��I�:<}��cPnn�LJJ�g��Jfo`�s6#m�@b�^X����HF�� h��P�9������G�MB� ��^$��-q8����S���!4hIO��n����(��u��B@S�������� _@ш�� ��H�N!<^LBZ�:��I�mΫt�P����F��J��a��z��P3�Ys����O6�Y�D���xL=�V������8�}&m���`�6$�Ԅ��ߜX/y��"����DV�%[ҩx%���Zw8�~�L�.�}��s�Iő�tH��'�%�!u|w��z�����Uzx��ɿ��)N���32�i^��pDS�T9AnӴ�yidW��E_Ʃ��W��[�ѣ���E�R��g�� �,=ٓ��6l�%���փ�i�̛Й�fV�Fa`js�QR��X�V ���z�@b��ov6��Ķ��)�}%��ʗ��e������2�JVH��{�9�5���/I�/6}�6uk (V�����:�ZJF�wu�@������a�t�tk{Mk8�1��E�&*+ȩ�1w���_�2�w.���3KU�[Y}�(%^ǭ�71J�l1(AoVq)���s��/}�-ى\���$�j�3(��[/�y���<\�q��Ûmk��-����i}r��3�z�f۬d�H�.N�>XE<�+���a;%!B��/]�+�@t{X%_Y����R�.�qs��\���b�l�d'� ��g�3&��¿x;YMw�ܖ�f�L9I�@�R�R�`�8�7$�|���Z�eթ��kD�<����8�%�{��L?ObO�~l���}�}�$��6f�\��{YB]A��,e���~<\���3&_���S�~ھ���y����I���]U�b�h���SUc�Se'��Z�Aӄ���H$���t];��z�Y��{�a����t�L'���ᲠX�[�L��N�~ �z�H���a;��'���w%��h~�Mr �{N�4ƴ+B���T�k����̣�i5v �9n�W2v= 5Q�1�d�N�[u�$�������.�ȗ��{s�eNϞ��\x� �0���G=:��2�����Y�8�+?v��^ �,e�e���3��S���4-��SAė��'�J��46�U%/g�0���Q�l��O��`=5Ţ��g�=X��'���R��F5ǖ�u��'$_遣M-/F5eF��ZL�����z��v 3CԢʸ8�:��+r��_��Fm�+�Ew�X�a+,|�BY* �r9M��6��F��?��3m��$)�ta�"R�E���n��]W��T9�,K�(�<���,o�n{�p�[z�F*Z(�9���}�+E{|�!�y��u��I�<"jD"���ꊉ�P`�%�|�{�4�IT/�����]���F�X�Z)�Wb8xJt�l=���Q>k���ݭ�ޑ} -v��HbO�r���Uټ��A��FO=Qg��\ �$$���a�)��r�\��� �L>�.�57����*��;����ڭ~~U(���j����Z��Cn�������o �8�fЙ��7��g#�hŁDsHh(;�^0��I}r���b&�v%�(RB܅ t���6/czr[�XS���D���9���c�&1�h� 7���i+f_P����J��[V� JmD�\ǂ����{�W��N-u>5?9X���<�W������%�*����$�h<��U7��"��r;�sp)ã���rn�%���&��MI��[�KDއ���.;���Ǽj�� ���� ~d!eM�w�[���~]Ύ�~͗��wnҶ�/�������T��x[��]�^"=�y����eJv�I%��ӹ�'���f�u����A�[�1�ص$�o�T��p�j�s��_<����t*'�H���x�V�P5%����3喲G���Ƃ��YK���MV��xq���9{?�G��e������k%#p,��瀱F�p�3�&�]ڪgE��ʸ�"Ts_͓&ʣ:�k����9 �X��z)�*��nb$k����G�&QI1��|��35���[�]���Yb��N�b`�Sya��������1�З(�FT����Y�|T�o���6���*����:�w��d�]��ڛ���04��G����f_�]�g���L��/��������� �*c��T�Ó��9�.�����䨥0M
Static task
static1
Behavioral task
behavioral1
Sample
791b6b934a15c29943a7dc42bfa6ac150406139e5307e21e5e18fae612fc20c0.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
791b6b934a15c29943a7dc42bfa6ac150406139e5307e21e5e18fae612fc20c0.exe
Resource
win10v2004-20240508-en
General
-
Target
791b6b934a15c29943a7dc42bfa6ac150406139e5307e21e5e18fae612fc20c0
-
Size
4.2MB
-
MD5
3022e32d76c4c8d24fccad035b2ef2ec
-
SHA1
25ed0dd99358d3867f7d742301065d7876beaa8e
-
SHA256
791b6b934a15c29943a7dc42bfa6ac150406139e5307e21e5e18fae612fc20c0
-
SHA512
f6fd3900f4539f5c9d2636d3791fcf6812a3e6e72ab5507fd4f3d1a86496fb30a05f95abd156570b538333b9bbd945869d6021debce9f7597c6da1d105cbbe61
-
SSDEEP
98304:s1d9oe0PjTJF/0q1LGZThQ08LbA+HX+BFlgSZMnOrQ8I+:s1d9D0Z3Ea08PxYUSZMnO88I
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 791b6b934a15c29943a7dc42bfa6ac150406139e5307e21e5e18fae612fc20c0
Files
-
791b6b934a15c29943a7dc42bfa6ac150406139e5307e21e5e18fae612fc20c0.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.2MB - Virtual size: 8.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 988KB - Virtual size: 988KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE