bU����^�;�)ƌ��������9%��VR'l%Z}���A�X$|.�s���c���2�bոC����J�^H��X��P�Љ����d�M�d�|�zﰬX-�W������1�2�S5��w��b61S�;5�rR��[� �"���������~8cDaV��:�J����"���]7��& X��4Fl ���<�W܂����y��دB�4W���cYHhZC��+�@�06��4.�/פzC3�s�d�J8�>���؈�_���rF[l������c�މ���6|�A��1T/2δe���o�+�ᬗJ �3�2���Ts^����m�|�>M��eQw�s>��I�SA���rUe��URML�4Cƥ,es�B�b�~���b^�w�,�B\�������\��0��!�'��X� [ �Ec����P��݊/�h�T�� '��W�i��'ɣ����p~��"���h�O�;������ԋ�Ct������/� �be@Mҥ����St���"�&���G)F���ɍ�� �Y�h0 �0��Fd=BN���V��4�:���fm$��EF������(�A��⠈�zH�����C�AoQ�w���'������ߜvÀ��'�ㅤ��&�h1��JQ]�#�F94���r*nZ����V���k��[?���6'+/*�y'�ƥ?⋑��������ra>�7�7�����2!i��K�h@g��$�#�y�j��������C�N�y��S�T<z��~{Fa/��=�#���o`�Qe�a[��3,"���tA�&�t�����wPB��RR����3a�t��X�²�O���&��z�.�C7b���̙udG���Ks�q(3S1PL��[��-=�t%���Ƨ�f�Y[Փ-���\)���t�{�.���M�A����F��q���ni�b���u�[c��i�_<:��V���|������WK!�g���K1�s��9.q�06�+�" ��,����0� ��� 萊�b��"��߭ �w���Ƃ/T������n���9���Kȇ��Z��j�N!��$���bm�ɍ����[Ӯ�<T���R�똃���n�:"��z�v�Wc-@E�C�!>� ;��M�Q�����-:��!���m����0�4z���ۨ.��]Ê&���m��OV�-W�J�&;���i���52?��Xk?$1�뻒]��q��&������z$���9�����\p��������>8P�z���쇮Nˤ�A�� á`0jl����12��j㖇�����sܿ ��?Ր�x�:铖� y����x�'.�?Zux�����p&��چŤ"PI=��oq�ӂK�vy?���s���@Hk�������`��ڮ�g���};@j�+���Sb?��,m�"���\���/p �S�����{��t���i��Y����xQ�>�%�ZMW$����� �����V=J�vz��]%�2Ϗ����C϶BY#���6F�1.J�a-I�à3��{�A�p��Sl�Vn(���$p;�<s�g�7�?y��$����w��h.�6�f�����S�P����+�G0G~-� �ڰo�O���S{�.�[S�����2�xӵg�v�zΙ���w�� \}���h���-�y���Q�J0��1���@�.L[ k�_MiycyGf�i���_ͿK���`bbc�"��cT��M�fL�y�&5x/�%�VO����+��H��<2:�s\>�l��Ѣ����ƛS���OP��-���+��~����SZtGڟ��֦_�?p��-��Հ'7�q�����\|"E���t���R�w���` @>6������+I�(��`ur�����YO�� P��9�b>�����k)B.�p�}k����T���6�ɹ�;a�;e:��!\L�������ޡ�]�`5\&�/�S�F�(�SO�.�6Dȿ��q82�y:(���Ԩ�T�m���e�����}Q��ta��w�������N�[ƈ��\{�����P��%���}��C���g�<���0�;�r�БhL'7CJ<6}����i=�" B]}4���p��(3��8g��e���{a��2F+6Pt}�R�����-״^��'��HH�4��<r+z!۵��/�������� �;��������&zb��8b ; �z��{�ΑL�e��oh�_���\¿ܩ��6�֞JY��`�����?�k�uI��9`D�������p��u�U��[���A�ƩzE8��q�.ݎ3T�ֱD����sQA*8 ONic�.�r��<��#C���}�ډ;�p.�`���dr�E#��#P(�U������>�=[�� �I84���#�O�ӄ�k�F6�3��GU�5B�� ={{q�u�S��#����:�D�\���uv����bTC���e�<��ZC�!�� ֙�?4rN�� cp�� �����b_BhM �����Ě�=m�h�KZ?5�p�@���l��t�e�)d�ٚ�w[�`[�5,D_8�Eb1ħ�^ �R��O���sR�� +�̨�w�S�|�r��z�]�Ő�o�5ѡk-���-���b��1�C'��Th��-� �J0'1О�ݼ�>.�M�R�lJɂCc+�)`/[p�u9)o(�v[5Sќ/G�,ں2��bjJ,��VH��c�!�P��~r��8��������WOhP�7s��1�V��ɅL��y?f^WD������o��z2a�SIݯ��� ����n�.�&b���xwoB�|Q��� ·j��и��Z]�����9��2 �,���ԛO�a+Ȅ�w�$�Bdp���2-��;cw̛�۳|o��]yz�2�{�)���]%ٙ�S��t�rײۀ{X4�WM�$�aSӐqa���\H�"��+m����-�g�SA��ӌ��`�<�>��vL��,��-��F�9ѭZ�O=�冃m�������_"T�r'#�O(F�2m�VV���uA b40�DD�AW�Gy ����?y��Y"���F<�c^���/Xt"���<bI�)ߒ,��>w�m�c�����_n�Fm�3�A���ɫ�����B���u�ԩ��I���I~�ɂ�g ��Q��r2����9��T��Y����r�����8�_� �2�� nQh9N9�hFuܳm�P <N �U��*���Pگ�D��F��{z
Static task
static1
Behavioral task
behavioral1
Sample
540b9ebcebcf6cda9d21153edcecec883f108442422def941aacf3d8e735537b.exe
Resource
win7-20240508-en
General
-
Target
540b9ebcebcf6cda9d21153edcecec883f108442422def941aacf3d8e735537b
-
Size
3.1MB
-
MD5
e823604de8e1907f31935dd778dc6686
-
SHA1
9fc01eda45bfcdc628117ccccaae83699dba2c63
-
SHA256
540b9ebcebcf6cda9d21153edcecec883f108442422def941aacf3d8e735537b
-
SHA512
8b5bc6bf00c8ac3fe5bf7c964b28a988bff70a5eeb97995ecc28d47c090fce1d0907a7c7deb3cd652e61f7055792dfb73de5cb028d31980d75b6a8ccc26a301a
-
SSDEEP
98304:FHE2kyn+hT/V68TFm+5g0v5A5PVci1IXH:Fk2khVd1xA5Pl1+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 540b9ebcebcf6cda9d21153edcecec883f108442422def941aacf3d8e735537b
Files
-
540b9ebcebcf6cda9d21153edcecec883f108442422def941aacf3d8e735537b.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE