Z�Ms�.ʈ�g�`�k�Ϯ��� ~Ũ�6�8�X�cjXwNK�,����mć*5�����5����되���Vx)fv�@��S� �Ljy*�w�_l���a���5���c^2���L�����@�Kc�1Ԙ����\;ޡ��#����G.�Ib��������f���b�Ne��ާ,f�IK0S�)�* )����Zs^�?��u�Hph�/���k����yޯ�!L;��}o �m��e� aIB���K����C3��a�&��-}���Ē��R�,��<&��r$��(� 4�⛺��D�m�q�KԸ��c� �zIr�x��==�o�rc �lS�=^kE�ۍJ�h����Q�J!�{̷�؈����<��:^�c�}+�����w%�Q��G����Xy�����D*^ε���qr����Cu��;d�;��ce�R��Wġ()��;��J-BT �_d�/?q��aɰ��6��h��S���ժ����|�m��R��дc�`���x��!� t7Ou]�/bC��,��D�ˢo���6��;�bk�)#�QRQ:6]�����"�<�w@����1�q��an����� M$4�ڠ����}p V�j��F���n���F�GϮXd�8�V"��Q"g7꿌��A��x6JqSR�WY)�sCo�yr���93�k�6�(n��<I�A:�/7S��\����l'`��h���|�#{�1�R_�kFS{2y/60�w�w��]>�WW���:��%�Y\R�ۦ\��{?���^Tl����T�b6%�L줯�@�'��� �0�� ������X��D`�O�u�����;ܵ����c�0�� �I��e^Tß�Z�m��k�Ɍr�[��b���� r[)]P-S�錧`�y-: �e!�S��F���&]����j�g��`�>���N�1�9�+�歔_���N�iw0 :��l����`4^=��1CV�3��PnkA�-k��\~H핉���n�]���T mU_zo��_�� �0D-�>�ƶ�!Jl{�y�`�eaF!�C(zE��B�Yl�U�={Ѕ��_E&���p�<P�̲|k]ꝙ�R���Ƒ��sn<J��{�����qf����<����66mqr|:��Y�2Y�X`����Kŝ2�*��w�\��}���f�PH h��ʲI<Գ� `�p ov��p�)�e� ��oD�HBY+;�t%����K�2�w2~�4�#�q!��@�נ�����e}�J�R٪W�T�5;����jkl��P��+��/�����d��l��s�r�f����%���R,�� >!V���F4�uF���&M��[ԪҤ�+�t"xS�z���m�L)�m��h��2�|���]d:�/�c�)��6ECΩ�aE74j�Sm�E���HQ u�aD��{;��HsU)R�j�c�AL{+�� �J29�mF/L!������a��LQϵ�LC�mAA���iNe�]�/A ���{�W"@Si� J�<�u�G�i�%�u`���a��(�K�Ӈ�>.U��2E�� Z�Ɠ`�Cg �\?�'ο��:�,I�&kQ_�ϵ�.od�ʀh2�es��k&(��uM�� U�Z-�HϹ��p�� S�J����=�xj4h�H�l�,�2{�����r�{o�5ȁW>$Ѫ�b�YI1�^���ʮ:��j����OV� ��+�"��1t�օ4��k}�+8j(�T����G�Nɱ$ӎ���\]������N��v�mC��n\DK������h�yo�v� pl ���s0�SI�6�\��h�.�i�顽���(K���)8%���h�ST��hf�欱�GOg� �q���BA�.�� S`�qF��,����d����K.S����N�C��b��WP\��qbn����\6�P�4�0��� ��-�`:L�t��0�����B�YO?� ��͇,c�?���k�_!'=�S��!�*�}y��[��!.E��諈�B�NѮ�s�Nnu��K�y�9�%Y�I=c$��Q�y4a��g�gsk%���z�0�Z�!t4`�:_��]�CP��!�f���@��ٙ��5�>�RnҺ|�i2G�#$4�������bH�T7�O����~a݃�zOd�zogD��fb���&��_Z[�<���K�y=��(*U��\�̐�J$�t�J���ӫ7��\n϶�.�dݘ�ɜ�w�;ֈ���s��|�j��2$8�Eb����OͿ_�� "z�m�Oj�@�M:�YX_P(oKiҎ�s��QX��|���/}j��}j�c�������^��,"N��3�������9-Q!+��(����!�v�N���D���A��p���=�)��8����TUۜZػh���eݳ?��3��x�����b�]�T^M� w�N&��9I�K�i�}�4uSk1Jh�R��TY���{�lƯ#m�W?�u �8���r�t1����Fr10 ���|3P$pĢ9���l�u���'��x�tV�2��U�ˈ��ޤ�9�D-�ֲ���o=V"�2���o�dc���O>���mOl����L(�_�C�%��o�݀�o�T��`�.<K�+`���c�)��-�>�2�b\쟴���f���%�q��g?'Z���W;� �[��2kؾ%��K��d�Y9G�ܦQ���w�r�g�6~/���{6�¼�WJ(���w[�#>��s4���=�Q����S1�tI��kp)h�Ͻ�����Q�W��-R'��V"_����[�욫��o֚��� Z�H3�'�YF���p�{�O;i��{�s��#_�,%����@��S|��B�6yƺ= #_*Y*��<���8��g@�~�ȓ�G�X��a[ wk��I'��μTrq���+��J͚���(�kz�Q�"�tt�[�^_�Թh��V"�'91Gj��9y,��3������23D�o�f�k���+�[��vw�䠟%����c|����$�gڞ �����Y�F�F�PMm�l�R<cl��u�_Y�\gl�R@B8�;r�[}�4�H�u�z^)��_�r��{!�-�J�����h�v�H8:j�XŒx���#f�℉6�˭^�
Static task
static1
Behavioral task
behavioral1
Sample
c2a6e2b5ba1061555c5f4084beb7862b8e8962d6c6bb4905dbba378039300762.exe
Resource
win7-20240419-en
General
-
Target
c2a6e2b5ba1061555c5f4084beb7862b8e8962d6c6bb4905dbba378039300762.exe
-
Size
3.0MB
-
MD5
43669086549eb631506889e6f7ce837d
-
SHA1
4ae55e2d4b2c0135023d094cd0326ae94fcfa41f
-
SHA256
c2a6e2b5ba1061555c5f4084beb7862b8e8962d6c6bb4905dbba378039300762
-
SHA512
c0f83da8743b7f76cb6523d21f98dc7240780978dc2bb7ddd1aa799795a495be365ffef7fac3413aeceb68060cec868f848d15a6bcc119b3405989990e34808f
-
SSDEEP
49152:Rork9QwgE6LefX2cPJkvnMQRDPEWfI0JxsiQz9ky9GN5C5J5yS1a0I:RpELe//JLQ6sNxsi8yy9Ui5yD0I
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource c2a6e2b5ba1061555c5f4084beb7862b8e8962d6c6bb4905dbba378039300762.exe
Files
-
c2a6e2b5ba1061555c5f4084beb7862b8e8962d6c6bb4905dbba378039300762.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE