å��|�^����Eqȳ_���N-��⇆��)����2�)� U�cV�s�&� �4���L��������߭�� ��G@�~�@��ָ�Gg��l�Z�M� ]\�|��Uǧ4YP�1��1Gf��1��J���~�N�?��W"�gΠ��[��0)$��-����PY!��]���d�����u'W�"br˩���^ݓ�Y��8��Wń���EʌH����9����D�3��n��|_8 ��Qz3R�#�,�v�<�8-�M�S�%�$UVѾk�*6p�Z�:�"�����2v=�7v�,W�5��L1�����|#��ŗ�+ҍ[܂Ba����^�iዶGF�%R��؋�k�A���x�2�F�e�r�|�P��� E�?����c$�b���h�Ӎ���Oz($á��*6�!�T����BAםr;� ���?�@]��#At�L�Y�B�kׂ1����8CP�Em8@K�Jp��e�X�DėՕ��5ܗH�$̚T�zgH�2��؈tać&�0 ��**S� }�g�JN�n�m�12fU�@#���A�e:��'�c<M Z��n��L�u+�� �ȓ9V�ԝO�&�H����.��+�,���U@��vD��������AL@�����.�Ɛ�n�cOb�@���([��*�q&�qA�\�(SM/����9���@F���L�������S�ƃ����Ln�(��%��{�m����M�e����$�U6�GWP�5�����_�z�A��P4�+�F����s���S�-l��a�&��'.ɶ�靮�$��D��N"�kI������م���#�]���fv��_m���˽��"x!���U��@��:%�F�0ԖpŪ8 c�=��p�n*?��2��l�� ղ[�[|mPgF����gZ.:��g���|�`���Q����s vh��1ӂ�Q�YJ.H�}O�[d�={��|�c��k���=��H�Y� �T�L�[�M���;ۏ}�q$��� �L���6�t t�� `�PR]���*A�Y*:�h :�|�-ŕ'�b�x�^��-ɾ���l��~�B!�%�3-,��\��S�^��,Yk'�uN�y���l�����V�H�Cf�6��4��^m;JO8�='��G*w�.Tκ9�;S�X���F�9���NY9�P^"}�?�64�H�u+L}���\��Q/�I�ا�W�&vP�~o+�#Ր���'���BDL~�}#5;���te.ֲ��S�ՙ�!;�6�V��*��-��L��{Q#��H������<��6p��E>:���:W=�mQ�;�T����,>Z�f`��t���Q'(�&U z��j�>�!,q{oC�oM*��F�3;;-��g\���',��U��d���-����ޟ�փwg����K��dN�B2-�z53�S�6�S�%Eİ~u�U�nA����]^Ɋ%&�T\y�(�&���$�r6i@xnK��r�,�x��/���T�������^��'�+4�֢���}��sp���|�J�G�O�����Z�(u����{P��F�o}��d�Ec�.��a�m�-���D$6��~��Z+$���Lp����G��-N����Ԕ��{ �c�;�Nΰk�Z�k��3�]��~�U.|~�����+d&�~A��0�¬Ĕmٙ q��G�!F��p�Kc�kc�bhn�?��S�LM�|��L���[D�Z#��E����I�[��"�Q�K05�Y�c_C�D���j�������K�f�鈽wF`�/�>{�!��5��IjN�z�U˅a��]�+��Da,�w^>"�E��p�Pt��bF�OH��(C��8}V����eS?�mzD��-�Ă:*\"�� ��0¨B� �А�ܬ�hm#f�ۓLn1&1_�^*��,�8?����8��y�K��|�4f-�n _]� ��+Rl���nѧ�JU��b���LqOz�*�pާQ~�5�+c�E*�W�� ?b�rI�����"�u�F���x�o��h�K(�H:�{=�Xr�\�:8|玏����`E��.U� LOe�I���9�3o�h�Čr�&0���q�ɲc��n���HA�"�a6�0�����H{�-����)xuur�C�20^��0[a��%]��Tz���-/������%�#�p,��`�E�9ÞH��E��'����ǡ��u�s��s���/1�uY�N��.o�&��2�E|�"H�R~�~���C�:q�\nD�BgH���w殭��{�"Ub�u���=�t��D��1����D��}iU��4�J��($���f���m;�pC���H���h����ꪙ �<�>%}>�{�~57�j��2�&����#5k�����s�S��B��Հ�(�_�F�ꁜ$|��}���uA�9;�=v�Fr�'�إ�-5Syi�Ԫ}p��h�e�,��4����!"x�i�q����#�5�-��R{~��5z'��M�;J;�\��/}��fx�7W�DI0"��N榙2BE������0��r��ˠ��6��t�>��%��F��;q�÷�>����U����YBt���٧�����8M��|�䒍 ����ˣ&��f���q�-��[I��i�!1Dڶ!ބ}�Nk���O(�H+��e�O�~T�&�vxH�Ou�5u��N�lYm���vR%;��EQX�Ƃ-?e������]sb-�@^�^X�-�H����[��h�t���1��A��jIp$�n}8k�P��v�2x7ꟃ8w�;XW�1��/.�1�7t*�K!�����1�T�^4ɜ�����K�QHiô"�'�刏�v��V��!���&b�)K��$��Bl��J��ߤ�xĿa���ku���M��u�����u����L��Z���'ŗ@������͡��wmm�h�7��Ֆڟ��� �7�:�����귰��B|Bj!+���-9O�lIV;��V�4�&�.�b�� ��������t*h�e�2��43P�%#]��S�ѥ��h�Կ>�*�������͏B!�ߋ�� 0�,5����ƒ|��a1}iexM%���e���*yL)[홏�uOE�I\�'�V^O�sk �l9�Nw̨����|������$+��=����L���a�e=���5������e�2<��',��q���P�ޟ�vChS�+Cs_"*�������:���,��s�1'�QN�Gu�f�N�5uh,n���aݽ�oc:�� ��&��&J��^��T�~���\�J�2�*�ӼtY�?si������),�>���"�b�^��ݦ�s�B��g{�|�x�er?�H]���,����r����>���o '���v�C�?�|���bb�p�o����h�+:^m������j�E:Ң�>讟� �e ���3Vv1�b���e�6���f~�41�t���F����2?�튱�Ff���x�X�E� ɣ�u�I)������u0�e��:�6�q&P�P��j#��!���YV����?��QLKTK��c彞�bA����"ݽ�3�\<M�H��c}��(,Wd������D�V��Z�O�((⫹�$��K��ji;q�zC�gwr����,�~`|�#a���f{���"ƣ�֫��S�j,e��{pZ�$a��f�=hX �<�3>S�iY3�L~X!�YfD}�+4�D� ����_
Static task
static1
Behavioral task
behavioral1
Sample
66381708e8030ff4aa71eb2e9b3ba7228cacf01ed9075567af789ddf8213ce77.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
66381708e8030ff4aa71eb2e9b3ba7228cacf01ed9075567af789ddf8213ce77.exe
Resource
win10-20240404-en
General
-
Target
66381708e8030ff4aa71eb2e9b3ba7228cacf01ed9075567af789ddf8213ce77
-
Size
3.0MB
-
MD5
3c4a9f8c5db491793ffc5081f4ff794e
-
SHA1
20b9440fa5bc10e2a1d152895d9ae16cebaac074
-
SHA256
66381708e8030ff4aa71eb2e9b3ba7228cacf01ed9075567af789ddf8213ce77
-
SHA512
c22021db99918c2e4737c981a993d8402d8f4edc8a2c09e6e83073570ec66d7ce94fd1c9571162c5689a68a5e00cf66e2b11dffa0647b9942907f099ae0130c9
-
SSDEEP
49152:wrfTGnp7rZamgRFRNeZKelUe0wg7ouOqORb/XPWTI74MNAK4wUerFpDnkE/JP5QM:wTCnpvZgNkNUBRH5cb//X7NAKZ3hpDnz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 66381708e8030ff4aa71eb2e9b3ba7228cacf01ed9075567af789ddf8213ce77
Files
-
66381708e8030ff4aa71eb2e9b3ba7228cacf01ed9075567af789ddf8213ce77.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE