n��������Vrݵ�>�=�a������Kk�g9��i:/�j�э���r������;���n��&Q����5h�������� m�E����rA���n� G� U�o�/}b�� t���|v��}���͛%���Vg� u��ԽحH&G�@�X��`�H]�jk=���M�0 �K ������|����� ���m�o��%�<�35u�3l���w O���pw���eM��]�K1�iނ�/�4~!�"�ٞ�:�����߷�PM�������QX�k�Xd��|Ӿ�멦�-�~P"���?�.����,S����Td��)4[@+�;���_-<�hO'�0Y�����V�5;��x��:��&WyV9Ӌ"�W��ѕ-�R����;�tC�����"'�=5�<��ƅ����n��KM���I2� �3Y]��luD�=��v`i�y�*���"$�����VY{"8�L_��!MFU������0�UT�ь�2by��8�HG�w�%��I��qJ��)g"��~�?PĤ4�.�i@�r(���[M�Ѳ�s/ٰ\U�Is@F"�N��gBm;�Fj! �^!wO@T\iO~9��M��[�{����3�� �T*��G >V���Zݘ�QA�?S$jy:�ˊX�V��u�p��V:h1��F�P����g���)����?.�����1�f>*��h�Jst���:�+�ړ��]/��e��L^o��n��=�2�z��ף�N�(����'�Ȣ�ob��(.b�Pp� �EIy��#����QZ��KR&p��N9�1�$������g5.Lmף�6���J E�xA�o��P�D��q�J�Α��� �{�lF�^i'�t��&����:#� ֵ#�+3CZq ���mc� S�� �@��|��ш�Mt��;�`l�9V�#�$鯗���BT¸,�'eT�$�WTH� TD�x�����{b�(��m�9Xʹ��Y����3o�6�i7S���x�#��!YtUK\m����Ʌ�t��j�д �3����]���h�-����w� >?�nu6\�*fF��r�a�[��zen�Ԫ6���R�������:J�)Ө�Vg�"��sT�YdE��I�����%Fh6��Gٙj�*c&��'���:,�!af��<]�͟`� .j����.ˈ�O`v���mm�q�v4l]��V���z~���5u}q֞�$:܍pM1n�ц��j��(Zj�ZA%a��?�7c4 A�7e���������C��~�T�_ 1���**�&1H�����@OM�e�@7��3��5��scu��iZohL�J�if�����AzeC�?WjS #N;�jҤc�\��o��fc��E �u�bY�}�1,��%j���)�{�N[��Ɉ<�pbd�������z��2�ž��[g5�U����l��~�~7N~������ .d��4T�Q���s�>�|�D�Q)��ֹ!�?H�D�bL���,w�!^h1E����sI|�H��SPK�oV��a��)#���OʠNL���Tq.���>5%$�G�,r�!�7�!-˒����?�Jc�[�,{Ӱ�1����)�C�m�L��R��k_�jxqtf!V��;L������n���o����*�����G��.��,~��y������#ٔb�8�b��@�a�w&}���Jc����!3ެ?�=b��`�E:@f%�������/S���LF�a ��-yWK$�MqAA���_1Uso��A����� �*!r�i�k�-�5��� ���~��*^�Wn� �7\���-{p��6�+��W ���?-d�����/o6 Ӵ�9���S�"i��.����O~$���6�芏����+ ���E�$0 k���NM%�Kȼ��0=��n�Eh�y�cj3dɂ�����>J��y�[毷�bb��(��ڞ��w@94|��k�6_��lF��8荾 I��=����6PY�9�H�+(FN�Y\��u����v?�&��G��[E�/t��{k��kܿ���W+���yӆ~�B}����8�7��eK-��7\�"�� �q1�Q[�"8��Z8nX9�_�ށg��$�=+�����Ne#7P����38��a|���ww���^J�����.w�"�+��,J ��Ӕ!DQ3��=�5U��d��{[�c����g��5���,պ�)��>v�Tf�0粷�<��Sq#k�|[@P��V�8�CM�F����ť���`|�L�dƬ�7����z��&p@���l!ԍ�ˉ������zsI��D�Zܩ�9t�t�~��A�l)D"Lo�J;[������r���I�Եw��5�n��3����ϝ�I��� �b�S�ю���?�����ۛ#� u��Q��9���Y��xp,�bg��=�H�W�@}LC��ݲ&��n�(ᶊ�R��m����o�}�������b ��B�7m���O��� �S����A|�j���qω������bK��0n>[a*��N<�x��|<�TXI���=�WK���}5XE���f��~�r��1<�l0���N�B/��!B����|�T�8��1�M��q�U�Խ�� \,�S����ϒ�� a��U�}����[ �r�f���� {n)n��;�{:�+@���I�o[����!����sڔ��X�"#HW���cS� �<�Io����JR����+�"��&� ��2�6v9K���˗����OkV���85�".�̲h22i`<Z0W�$ŁN��Y/N�_�v�ɿ^���l� mR��s�3~�� #,�m�t(Za?��R緆���*��E�]|?H�d��C���(�7�=�)���f;�غN(T�r�QuП<_�q(��[2�Z+ w�#M����f��,���P�?v�� ���4������5������+s�ź3ZS�Vg<A��8�d����0Fl�Dړp��� ��{�9�}��)���a�U3� 2N���\���*@��e�fa�$�iZnC�o����K��U~������(܆H����E��V����[C/�Yk{ۏ�?�v+ YHt�VX�cMy @M�����������Z����"]��ц��|ӣ2��M�"7�pbI�y�)9�� ��n.��AuȤ�LԷWrߺ?���������Q����K�;��e�����lxR�ɸ���ԁO�^MњE� �%�F�����|#��I\�`��/=���8�����$�7���Մ;Lqc(7�%�F��0���Q[�8.�!&��Xs��UC�YjT�ϊi�1:�G8��Tc���H�:�O���{Ek�QCQ������b��ˁ�[�2��zxpq���j�.�g.y�P;�P� ����Ơ��M�����[X���f�!�k�/�����P�_� �EG��� ͬ��u
Static task
static1
Behavioral task
behavioral1
Sample
2dea2ca6c3ea42cfdcfb3a250384e4ab661496a5b8dbbd194a648a401be1989e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2dea2ca6c3ea42cfdcfb3a250384e4ab661496a5b8dbbd194a648a401be1989e.exe
Resource
win10v2004-20240508-en
General
-
Target
2dea2ca6c3ea42cfdcfb3a250384e4ab661496a5b8dbbd194a648a401be1989e
-
Size
2.5MB
-
MD5
e7fd7aecb774b78a8ef6f6753d1850f1
-
SHA1
da9db3340e65dd08378bb76acfabaea299b743fb
-
SHA256
2dea2ca6c3ea42cfdcfb3a250384e4ab661496a5b8dbbd194a648a401be1989e
-
SHA512
a33557e0d8fd3d7292e4dfae32df4f3098716ef42cfdd816508b7e4ab709277741a173a1d83e3747a7514f286debfdb5a96113ee5e945a454ce6844cb9ee2e35
-
SSDEEP
49152:pVKv5Bl8Xc+dOhXuDd93VuDXd+549ixt3LInYXAc/N5bzI2cZ9eJZ:kydlLF8Xs49St3LIYXAc/N5bzIFCJZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2dea2ca6c3ea42cfdcfb3a250384e4ab661496a5b8dbbd194a648a401be1989e
Files
-
2dea2ca6c3ea42cfdcfb3a250384e4ab661496a5b8dbbd194a648a401be1989e.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 28KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 32KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 204KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE