d��+Asg��YCMG�=�������l�ɭ�I�J����n�� �źC(���f��6.��c�V�4mk������W\�+�EW�1����0���eZ7��(���o{���k�(�E1�����K���wيuz���_�3T������ŏ�:b��y���'cu-ط��m4I �K�)�j��1��kyJ�u�U���Y_v����-Z�y��Q[���>Zi�_<��L�#z���`$�+�n��N"-�Hܙ,�wak��P�G�rf5���=@ �,� ��nU�¿��Z�� L����(y��yQW�uڤ����������u���W,�b�KFE쉀W)QF����0NI��n��N��,��|����*��)�8z�d�<ߖ(NQL����-������+��1o�����u�!P�}-�J��Ɩ�py�>x@E��WI��t��s���@�V��t-ӓ��E�Uz�E�0/JҎ�OΤ���u�Kݥ~m�L��ZW��դ���0~�P��X�8l�<;2SVv�A+�va�p8Yk�� ��l�4��~�W�M,�{�Ե����|�Qn�� ٌ*m�D������q����?.^��_ycG(PDžY�!��3͇�>�jn���m�Խ�1o�����ꑻꞔX�y��? �k��*��jKK�.��8�����)I�S����w<��T�~�J65���s�(+����9���y�t:��<>�q�T�,�/��8 k�ȧ��א�ZY�,�]~��b�HS�����8�?��D e���� ����)4�H�]��E-PmZ��n��74h ����c������O���[l~�mt�=(�LNe�X�B2�OgM�9����M}�Q�1!5��b�M=NC��$-��5� Um:9�:�����|�@|��]ey����>�C���5W63���]*y=5��i6�H�_Ŵ�z\ �9o��������=���"��ٮ�1�Z�|�5�~1�X���O�i�.H�^C`+�q�ׁ�O.k������ө�ԛ�;���.ifM�cƋ�l��iS|K�h �}PN(O��`S��� ���^�G!4�X���d6���m��㌒w'���y(cC��!�v��D?[у��?G�+�{B���M.�������Tp;�������Vva�u��>�8<c؎%�\͝�x��1r^���2�#c�?��ž�8�R��X�{9j�RJ�0r"���ʢsv��$�۴`���J�d��'�Ο�a��9��`s����2�L)� q���1�(��1�\)����@(����y�`N+�)�8����=I�+rؗ���0gx��@�P��u��o�sZ���Ɂ��H:%���@���#��(�F8H6��D��k�M����N�%ȏ��c�Fs3-� �w0���G�Q�f�T��!5�(�zH)��x�7xK��7�WUC"&��`㔫��m&�vƿ�^x � �6l�9%����J(\�gr�5n�}N�n,�j��g1W����B��mW�-�d���ڤ����:+K��.��}(�������u|Z��fRpA���kW��yZm�qPLߜ�O�2|,�l��X2�EG1v�<�w��&rB��!�8���K2 ��j�N�J�>O���E��@�[����D����y(��C�$n�Ô@R��`[�C�{��&8sU����XDT���=������Qh������p�T*�i=v��㊮{�2��[��T_���Ed&��=��|�]�?&��2��[̆��C�K���쫩ga��I�{���6JP��[-ѫ�z�᯦\f��^�3S#�tB�VsR�'O%y����]:\l�%I�������+"pw���Dp{�@{ŵ��U#�����+.����=j��IR �E�7X�o�X�t�paA`�i>N+f����;}�V�XΈ�xT�q����L��%���Vz�����س�S�� a7d�������?�e�qnhU��NR9V�q� `��uƵm�&�h�mBz�ф�Z_�ߴ�����NMٷn)G���!}Ra9��'0T����w�}דޙ2� �[MZ�B�V9E��x�*�:4 �� � xc����V;.�%�۞;L�������2���"��t�g9r�f0��<�)`o��Q�-���[zw��{��X`B�y���0\,��)�p��T�;�#�7R��&�� �y�m�^u� }�xs�6�����O��u;��DI�[�5u�<@�SΌ�b�a�b��V��)Z�!e�UF�ٛU��K� �@��Doa���5rg/8�������X*x0-���M��{2��E�����3����ĹwU)��S�����w�u�F� ����ف�R{n��xI��욊m1��D�E��`e4�q-�Ӵ�E��m�(em8,�}@7%�j�F���N�@f� ��q��h�t�JVT/�AN��qs�#�E�Y��zg\���ʚ��G��-Q����5��'�ج:����"M���#�'��H���$?s���|��gD(��J�C���!�2PH�lr�=Iz�����FB��S�,����T�Wm?�{!.��3����,��Q���^/S��E�T*��k=h����]H��6-������[k��z(^u{�#�r!�����ls�ϻ���T�K��H2�;6|˚������*��"�RQ�J+��˪��\�x����'D�T��bb'.���p�zT˔�z9���Lv͞��2w�����R�/5�G�n��\�j+�pb9_�j}���FMh$0�~J%sb-rK�j�Hʆ�(�+�}�L-�����4Ӓ|���i�9�~�P�{H��� �*�T�_�k9?ZK�/%{B�t�lSZ3�~���x5v�7`����|�ɛ)��k�9�RQ�}YWa� ,�,(�ʹm@O2�G���Bq%Կ����P�����7���h|���2n�p<��u�R�`u�vH�l/��|,o�TT�~L)�t=l��x�J|�L��<S��R<3��K�k���x��- -����oge�dž7p�����{�� ���M\:Є+ۓH]�X1��0��2}� "�}T�V�6�:�r��=]ڰu�&��Ѭ��Ͱ@���(!Q3�bC��[�����\[][y�C��k�*h|�*u�Njь�þ\�I�_q�Ŀ�k��Y+b�MV�x��a,�8bC���@f~�M���p�)�1��
Static task
static1
Behavioral task
behavioral1
Sample
565bb4ee35dcec8571a2ba642377456ea75d4ac3db5ac611019f27307299ead5.exe
Resource
win7-20240508-en
General
-
Target
565bb4ee35dcec8571a2ba642377456ea75d4ac3db5ac611019f27307299ead5
-
Size
3.1MB
-
MD5
708815d64ec729c6f18731e83578833b
-
SHA1
5c71ad9575ad1cdaec9a06cb80a3325c60dde080
-
SHA256
565bb4ee35dcec8571a2ba642377456ea75d4ac3db5ac611019f27307299ead5
-
SHA512
77514cf49078c20b0fa589757cc5bffd1ac73a6c7434f3c579075c87550efb96122f14b9096cd9087bde9e47a5ef0de551cc896a55d9ff1f1e5bdb4045fdc6c3
-
SSDEEP
98304:c8touowQk8qpCGw+nCatg02tPBUVQtmH:+1s9Z20Uq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 565bb4ee35dcec8571a2ba642377456ea75d4ac3db5ac611019f27307299ead5
Files
-
565bb4ee35dcec8571a2ba642377456ea75d4ac3db5ac611019f27307299ead5.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE