��d�>���h=�R��9bpl���`y]�3���_�xη�x}��[M�B3��R�����E�8��^�쮦D��Dd6��&�s-��#���Sk ����J����W۞��u��'@�=��e崤�֏M��R�&`���J�m�,��+B=L��0�+>rA4�&��9��0��s�r���f' �4���u�����yI����^�DHjȵ���t��t�!���aP�v���y���L������s|�PS�g��d��r���L²#���V�p,n^q�P�v���:�1����G5[(��w�L�-i6Kl ��Gr��C���2���]�<긍uH�!����Eډ��[����vA��ڱ���n.��5͜�y�����v����-5�Y(�yA�דEٿ�iNl@q�͔��p�c<v����Ϙ��7�Ø�k����+a���������F�ʮ_�E4k ��\�G�P'J��-���'i4��4�^���s:&�z\p�S^������4��B�����4���w�����R��u�ш.Ĵ� ��X������V%�/8P�4��.�k�� �6=���s���v�?n���_t����.S�% �^�^H�bJJ�3*�o��o����e��01 �.]C]��5( ��E���m��y%��$Z��)�=��������L������]�t��=��>dLJrXE=NE�3�v�'��jb�u���q�Gqn6r�$�U%ߒSk��R����"��wS� Uϭj)�0����ó[N硌W�̛:B���p.�1��lԮ�#]3&�jh�*���0B7���7��X1��.�f����Ö ���vf�/� I-(k�����U+�''��҅^Ê�4%[0B�o7�͎8r�ĉ�y�8�x1Ӂ���K��ͭ px�ٓZ�-7��;"��[�y����c��Q�ҩ���Lm���{�_y�������������4�J����5��ZZQ�]�+�m��Sr�E��qns�Q�:��nMշҪ�P�����ʱ��}�u�FͨO6Y��B�r�v��I@�����w?Ox�d?�iJѤ��{G.� e� �7&�Ӱ�u�g�� �*�_������Tr�%&�@�s?�8��'�t�:������_v�p�h 8�j��z��f�==�U�$:e7�����5-G~i��-}�5�o�/���3���I<"�����k.j��p������K�E������\ ��Oά��=>ph"̈́l6 �����L]�!R�#���b�c �p�66���HC�%�Q�7ޕ�����B���p��鯋RWN�R�Vn���Ll���VӶ�����g�R�zJuf9�=B�Q�M�/E�� ��P��; ?7��SH ���D߽8MD��������*^��$4�����*�rƆ�� �(�4rh��$�DFG:8�]�&oyĀ���H��4���n��vi��� 4��`P�ġY�G�b˼�=z5 �C�9�>x�$��rtT��Ï���YV�C�>��RV�gVT6�hᨨ������$��H�?I��@����������<R9��fw�IO�bma�?C��㓤Dk�$aw$�u�ů�YG��&u��(>kF����^��Nv98,Gz�r;F�j��fe���N�>hU�|AS��2����n��!5��d��ygB@q�ԡ�cї}'��F҄V�x���&Y�\*Cy��w��=��B�XÎ@�'�L!�r�8/���I ���i�~��8����Og�a��@H��w0pš����4�K����}G���D�#Ǧ- �۠�]�Y���֗�kO<���]:3料��M)�c�vS�&s)ܙ��ьx<2i�G*�^�蝸m�d<O6"�D�������D�+yq��і���NL<1���/�C�\��6�^�bz&�֑K1���->�}V���#�s�0$矄�s��k��<�ʤ$���w�bt�_���`�:L�NWwX�R�*Pt���Ĝ��ŕy �������:��k#��n��'�2b� d��.ǻ���<5p�����BEK��i�a����M���D���{���-��/�V�]�Ħ���-f���P[��Nq �t;�S٥��Z_w�3<�g������X��GX������ل��Op�++R��?��>�FH�"_���a�_��?7WN�ٖAX�9�!����>G"Vlڙ`3�rF*��7���18�ҏd����ؚ$8\��J͖xcհ�U�k��� �`�~�(��rh�rp��B9�"߶�����5��0��fMnF���7�W?�3v����gtd"5b���<ٝ_{U��� +�u�&C� ����a��)��#�M����C?�2�����w(��gR�w�5�\Q�������̜ )���ѝ�c�=頠�1$�.�QXN�iF� ��%6���c�i,�zY������u~�!J� y�W+�ta�d�����+ �K��^��y�V��u������.�< �����|��٭�0��f�zŜ��M����;v�t�1z���{ڙ�y�&���Ar���T��2���<):U ����i�Nj<�&�|quAw�����1{�yԔ!���� y�G8���B2�`Q��+WbcH�z�����*Ý���:^�T�w/������Fog���b��j�:&)�?�&�cᖣ q/��Ƃ��e�{`����:�P�~r{�V ߍ���b,�S�w��#�"�bՐ�r��� ��� �p~\����2���������#W%�n���'�s���ڴR�V�;�f��d���h�͔�^�]�=kh��V�Wg#�]��p�������> ��ۀ�<-��+�� ��WkP��EV�Sŷ��_;��ȩ��L�(G�*��<���:|��wߧ W�O;҇?Gg3e�1��(��NԳ��Ә�!�ߟ�Me��+fك z#ރ��m��y��SyVĊ���t��e�� ���x�d�����G�b�p�EN����t,���5��{-���`=?�{�j���%����|�7�U���2��L�i�∁�Wkb�.�τ�guE�H~�?ھ����.j�X!��8��U>C���2m������ʊ
Static task
static1
Behavioral task
behavioral1
Sample
79b1948154151c1b3143e00d67747609ca029ffac2b8fba87e12a4e91e155cd3.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
79b1948154151c1b3143e00d67747609ca029ffac2b8fba87e12a4e91e155cd3.exe
Resource
win10v2004-20240426-en
General
-
Target
79b1948154151c1b3143e00d67747609ca029ffac2b8fba87e12a4e91e155cd3
-
Size
5.7MB
-
MD5
27c63d00937c71cabc1079160ec3695d
-
SHA1
1309ecf25aa503afdccaa781b731a36f7471f05e
-
SHA256
79b1948154151c1b3143e00d67747609ca029ffac2b8fba87e12a4e91e155cd3
-
SHA512
b7cc3ea1432c2e2618073ac6f87691520e254c86b41958bc3ea6f0f91eb1b62ea445f3b946c7b5ae094441c138b75d856cafbfcdf0c9dfde43452ea1a7ab99cd
-
SSDEEP
98304:Vn9FdRU6/Gytu9W1R6RphO0ypVlq9s5BnkPmHG8EuVmpndxGB8DxppRL+:Fnw6/GyCW1REbgV8mvnkWREZpdYeL+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 79b1948154151c1b3143e00d67747609ca029ffac2b8fba87e12a4e91e155cd3
Files
-
79b1948154151c1b3143e00d67747609ca029ffac2b8fba87e12a4e91e155cd3.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 1.0MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.2MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 99KB - Virtual size: 896KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 297KB - Virtual size: 12.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE