/�a�;&�G!c�¼� L����1٣E���������(��|�^66϶�(�w1�k�w�ew_R���tdL!�5�Q���%ͼ��7�'-�$����� ��EmkyR�֭=��[US�hJv�*{��p�^ʝI�A�g�I�_FJ���i�5b0�H�s�9�]�gcP3�9��iXʢrـ�EE!�NZq�!����W!�H�A����@�c�{u7Qc�D��0���Me,s�������=�I�����I�$F�%�6�S;�����¦d�z܈�?��y��u���%�4�~�1��>�;�e��-����I��"=�,/�O�@֚������/���E�^��Ni)�D�j�9�uc�`9S��Q>��Yt��Y���ϔJ������ė9�.S� ����o�����G��Ї�Cc�a.j��K�o��-��S���Sc�1J�Tk��Yj�)ap���p�av�B)���j�X�����,��%��, �qx�l ��(�����~���D+��PV�uu�諛V����N� �72U�0I9l= 9�l����<���^S�w�E�4���&z������d̺� �����8�3o^���RH��(��il���a��4 ��jM���7W��f��h�k������l�6�qF��$c����B���`dRL||�I����<K�$�D�^�v�&�ؒ@;��pz��fu�j��Qm��X�#�P��%�W飜$�=���2���p0Z�r�nw��#��8�c�q'� �#'���y��id{����Ih�v�x��>��-ѷ��RT��.����~�;3*�:Lh!R�� K�tV�>&R�\�;�键��[L��u���ѬTT2��1��\�S�~�^��,貋h`B<��E!�AQ����$Q��9�9gVge�*� � �ٷgQ�V��M*筆q-{LWz /������r�������>�v ���->�١˟��m �l`c�5t�k�����"lK9�|��p#�%o�WM�p�#��?}��B��j"�+�T��{��������9p�ӍZ�.x!��Ԏ�+5�O��J�2�7R��|��C�S�'�����g����g���i6Up��,�b++S�\Y@��gO'Be;#����7���;��M�%%rH��} M��� �3�kXkH�ڔ��VO~�9�L�}��<_�)EǥŽ�Q����$y;>=tx(��ġ%1?^ھUI�é�1�=�.1�k�Lw�ac4z���U�P=�m8c���җ,b`V�g�pc��� '��|��k��\���e��S�D���Fb���^俋V��,�_���!��:q����%���!��:ʝ�9Mʢx��I�wm0��E����3�*|��e�z�lת��-5��Z�3�M�у�l�j�>bP�;^��3ڠ�|�� ��tƛ�_D~��7�?�>$�F��=*F ���C��pP���w(i}��V��kr�;T��co������/]��8����c�O@4�@�-6���Q����.yf,����O�9�%0��C�\L�g�9��j��d���_��6rP�Ig�2�������� ;L/��~E>v��z��,��i-bo�:�R�/�1��"T��M\=kL���F�9N9c�M�J˿���Zo�� \��t�e> � ��fe9�u�P����{sa�&7��X��)JOI�B7�;����U�B� �F��r��څݔE�d�zQ �#3�y��<��B�&h�X��\/�\�*b�f=�e/�!�fŢ�5���N��O7��p̗���7�%��M���>{.ޓKJ�-#�$_'�%�.=T~{���3o �S�/i���؝ wQ�p dz �nZ�^I���}�xW��.n�Qܜ������Q��p��/���遊v�"~gq/g-S��6<-;�Zܥ7u1{�!2�ص[�'D�Uc,-��o�Ev2��~�!r��u���U�����Y��,`l�Ď ��S&��3�(�?�(�KE���̌�u���^o�mlI)cy��f���l��K�� +Q��;���^���b��/�Idxk�!�L�r���V'�Ӎ�gS�8���5�kz�/��Ͳ@��l�T,{�U��`��ŷ�uWz����;p9�'��1�,�E�e&���Z�˨Zdcz�\?��!���Ӧ�34�'mo�>��ue���������+��@� Vz�>h�]�R���2�!���l�v��2�}�� F���!@�?���;2N���A���6� �;+� ��4G76|>���A���O�Q�Rg�84eU!�������\���#7xQ[����N���"e@ѯ�-�(Lᅄ��0H����� ��I��6���9qz��S�5s[�yۮ����y4�~�(�=7���ܘ6��Iݢ���@���n۷���� ��Y� �{8���9�0sડE�ڠ�𣴽����֊Xᄨ_2#v:Cb,��B4�Zd{: ��,�=�,�p+�? ]�"��w�~�$Ij�N�d���à�Ő�fȊ�������w�3m�ya��u"��N��! ��y�u�1A�a������%.���#�>L~&��f�OYYW~-:�� �&퓙���(��w-�6\���?��|~�D��<���)�8\�C2)ï���<U�%I�N �y��H)�g¥|o��r�a�%��j�#��V�հ��_�h�N���$$��{�1�6�hk��P��Y�)���8��~l��f�[ O�i�qaC5+�����d�ʦ�n}�o5�~��������8����."��}�C�4���)��l-D���>#^�K`i���3iNJ����5 ���+� �Ԓ����Y�f��|a�r,����<|X�%��m��P���3�Y��+�#|%�3�����Ca�ϯ=�U5u6�{���#�-o}�3N:���G���%��8w��K��� flR� ѱ(N���Wգ������R]�� ;RZ��TP����x��3�I+�_����|Y�&���L�WD{/�Zk^o������*4��B�0�ҵԩ��sz 47���=MLSS| .q5�����T��4�� �����%�+|�+�gGK���@���.n�Qִ�n_}�D��� ��4�7���6"� ��N닖Sr��Q� Vb�M��ϲ��_O�(׳�U�f����5�כ���gώ-��vxO� �>�ؠI��g&���={��MG���Y�/Tf9����i(��*w4W�n�{�}X�t�����1��PV���_g�N~RËV�[�D�[UM7�>����*�1��˝�eU���Bg�ߎZIF�y���Zb4�' �8��v{I���%K�9���yCOn����M^���Q�z����m5�i\��2���p�D�U�r,=���<� �Z�q��q�N�
Static task
static1
Behavioral task
behavioral1
Sample
29391895e04c1caa85e62d641e3cdb5aa40b20f178639c05ffdeb354f8e0ef61.exe
Resource
win7-20240221-en
General
-
Target
29391895e04c1caa85e62d641e3cdb5aa40b20f178639c05ffdeb354f8e0ef61
-
Size
3.0MB
-
MD5
6af5551d3f5b3d2242407a4f1409ebfb
-
SHA1
a75132c3a0ec4a027bf2066980e91f6624300976
-
SHA256
29391895e04c1caa85e62d641e3cdb5aa40b20f178639c05ffdeb354f8e0ef61
-
SHA512
ee2fa0ae19128c2f46903ef05d9d9a28a714a98791a148f11cb604d9867121422c1a48f945be5db3994a1f9071c93b61b450d77f4949b614f7262df90152abef
-
SSDEEP
98304:0wF8GteqQREbNhKIhr470UgNmS4n1Kn+PT:0BYeqQRc347OmT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 29391895e04c1caa85e62d641e3cdb5aa40b20f178639c05ffdeb354f8e0ef61
Files
-
29391895e04c1caa85e62d641e3cdb5aa40b20f178639c05ffdeb354f8e0ef61.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE