Zu� ��(��$�<E�&���^v���w#�Q�ǟ$���.�R�sH�bb�$oe1���-1�4J���+[!�>�Z�u�X����u'�Y���s�S$�w?'x���� ��G�$6r�� @��d)IWDO�����q_㖉j�8��j�?T^��N~bկl�ho�"I�d�Z�j���G@g_���d\{�Vt����^��_l^y����w�# OC����nkB�V�8�`p.[�JO�y�$T��M&��d���-D5E�{Z� 䶐Rޭ��z��֔K�fĎ`�?���2��︻h�ۡ�&e8���n��/�l���,�Ss<HI��q�8J8��nF�ur������j��X�����f1�XvЈ0���J7�D���I=��&�@[���� �uNS�P�2t�>�� DVi��S�!dQء�eL�6�G�ˠ���G�&���Ʃm�g���������_�w�B��y�0�����i��\�&����8p�}�>�}����#@�Q���5<����LQ��*b�6'4g@���C,1�v�~Z��Sϵ��h��6{A��W�'�� zˤX[!Yˆ�B~upa��p5[����r0.re�Xc#M�ET�L�w�XA�O����d��zR�]����1�EdA<\�f�r���9��g�C�%,j2��F��A�!�{S3���^��RK�Bʗ&:35��Cjͪ���������r+�g���.Ŕ�B��JWS��0)��#��y��J�K�7�%� tZ�KٌTb����&�a.���, v��)�6q���|[��K��d3$9Gӊ U��}:0���<ii�֡�$�߰ʼn* hf��� $Ms�5��t�jr����4�2��ٯ�v��i�-z�� �Z{#L� ���N���8+��B�C(@(���O�-$j�W��/[/�~�|�ʦ�Q�y�&Q,�r�/!���̐=2���"�AEǶ���fe4mc<�OYZ�=����nx��J�� �"������1���ؚP��t�d�_ZA�:N��i�1�8V��E N%�q�wٮ"Сm�����Q�|VN ��I�-�U�ü&o�t�Uy8t��� \x�о'a�i���d����ۯ����V�����l�a&���W��imLI��u�3I��%�#� �V*�U�#SힾP���y�t�RB�l�j��ѡE�o�ٚ�C��UF k�����ݬ������(@v��8��f�d�!K`VH�V����������SYL��x��ovk���F�5zYe�v홭�'� %_�U�s:�W�>M�;a�>����|�4y�s{��,Yg��J��A��b)�@b�Y�r��s�;9�����%7�Y��d@7�xLh��� Î8Y��6��Ȟ2EY�[�,xm�. ؑj`�)��kX`"��H�����F������!�Cu6*�1--�%3�`M�uC����S.Ӿ�� � /���&|2ϼ.yƓ��@�����n�� �V\��ӫ���f-�1�.��p��JM�@(O�Oy��Vj��������oZ�~Xy�v8�N��/zN��ٽ���ǃ"ij��ֵ������:>�R�6�k�S��ou�}�˅���x)�*�f�r��f`�E7��?��ljLf���i�y4���>�����j��f�e�U6�����?V�+#�)�!g�j��Ƀ2]�b��kX۹w�\������@��������(�m�N\Kx/��5����^��g�+����9�f"�Q$���u ��Ι\��1`Pm���ݳ�:�%�AT��o�s���y���ᝯ�I���u9"�cF��8��Nb��+��� �r���� �C��a�]���)�m�Nر�?̣���?3ʙ�6�E>��2r���j��fI��!������{ �v`�,k��.��Qh[D�}�TW˿g�� V��vq/��_�h;��l�^���w<p���T0K8Z�|b�� s�;(O}J���i ���{��IJ�]�bN;��9����-n�� �lԸ��g�sl{�L��c)�@8��{��y�p��������z�>�hB�`�,y��ع����A��+�jM���*��2�@S�U�,���W���G��ɕ���$�r��������>:��=��6(?�H��m�U��{���R���(�G���mB�� �'I��QC�J�u����u/TL�3�9HӰap�ʄ����E-�PMX���aWO��a��J��.��6POuߗD³��<$������o>�EwÅA9RtS��<��I�� �%�q�\X�lҁ����i�b�"�-�ڸL4��6��}�˖��ɿ���lh.&4|�@Ls����*�N*Ű�7��|�%X�$1y���Yʕ#�"WP�znz�����ԬCb��`vC�������@�#v�$>�z�wjM��IF_)���a��i&�Rz��ڴ�+�<�jޠg���q3����er[)��[��H -B��moP��8�� 8��ޛ��A�P��� X�qs�uR��^ [3���rC�G�N�.\ʌ=���3��!�J�������i־I��-~3z �Y���r���dDŽ>#F�xl /A?�V�б����G����@R�Y�%IIȔ�����D��o�vt:8� ���������i���V�eg� �j�v��-w�NU�Vw�n��[,�,Dx�0�R�c�84����eo�q������9�7q��s����+Qd�v�_ N�e>m����ȴ�k��L>� �㓣]>?�,��� ���5F4�X��F�q���h�蠦ƣ���h:�]��Q�6�>�·]"���A�"$EX�����H)�e׃�3�Z�=heԒ�T�� C۔�1g�F��~N�'t��b��>Ω0�n!��(�`�8V2������k�@kS��v�j��Kovڞ鬾� %� �qݟɄM#�!�<K`�������~ $�O�w���� ��"����7�$�P犛��a�?R2k��a��H�i�س�oJ���uP��t�$� �4��ɬ�;>��_��rr�ǯ�>E��=��f��M'��ylz�[m��=�� {ػ"���4
Static task
static1
Behavioral task
behavioral1
Sample
1fe356dc287cdb894099f7b061f0fcd28c9d1a5147ba480b8c3ffe1e1d1654f5.exe
Resource
win7-20240221-en
General
-
Target
1fe356dc287cdb894099f7b061f0fcd28c9d1a5147ba480b8c3ffe1e1d1654f5
-
Size
3.0MB
-
MD5
95442268eaafdeb3c1af18b599522ab5
-
SHA1
ae7cf318e4795bedb93417da6ce6a5626a0abc44
-
SHA256
1fe356dc287cdb894099f7b061f0fcd28c9d1a5147ba480b8c3ffe1e1d1654f5
-
SHA512
eab4c5777f80938b406a8f273ec8651f213a58c0631c887f0f914cea15ee0515c917224ac3c158ca238ee54dae087b16f0f63919ebb98929116979f80d342198
-
SSDEEP
98304:MuA3CPEkRxidlNwflqAWfH4s+vVWKfxLk:MuA3CPEOUlNpAuH4P5L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1fe356dc287cdb894099f7b061f0fcd28c9d1a5147ba480b8c3ffe1e1d1654f5
Files
-
1fe356dc287cdb894099f7b061f0fcd28c9d1a5147ba480b8c3ffe1e1d1654f5.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE