��;��-��mЕ��{M�&����H6"�Pư|��Q {�����Y�T����I�����������*ɻG<Pc$���r��� �m�}M��]� <�]x�1��T�ʭM�ī���o�՝�}3��w����[� ,½�1�p�9�;-�ƥx_��?;���5O�X)F������a(`��n��C$uo���f�!V�V찿��z���d�~钶�)������l+A��ιV����U�6��h8�0pʰ.w^��Ki-d8]]՛��'����t�U��U͙�����$�ҋzߎ�%�m~�s���A�k�K�>���U�iQ�ț �jX��Fڢ���1������#�G�78�ȁ���f�k�D�͇��}���Z �^DM+��r�0&�+|'H�X�Li���.�i�t�� D��כ������i�5r�5E)��8�+[�*�t��Z8\!U�����P�x�`��>8"�Y��=aR��W���n��"f���9�����������_�%[C���� ����gy�8�N���R@зϙ^��K�X�A�-B�T�������5��-�+��*��5��r��m��B�V���lp|s��08�d��������T 6e:A�z�=D?�#���T��&!L���B�7=�u<��7��Y����aVo�{�:��A�K����E��n� tB�;ھI����$��M��[!D��KƔ_Y��G������,�B���)n��*Υ�&uܷ�� Y��,�qNm��̻6Bo ��6#���Y<T_p69N&xo��6��7���)�.Y�����[����1����h:�_cL D:����Ky��%I:�#Qm�������x7P�i����'�\��EϦہ�qB���/)^�o�Lx���+@�xz;��tߛ�G-��7j��"��ɮ��^S�M����_hz����e��<�s&rK?��\u�� �ײp���@i���H)����/�O�$nk8�,#r�y5afL���Y2� !n _g�d�xm�uF��e,W��W�%ť�OD̤ \��q{yp$Nh��W1����/�yI� <#]ֶs��;��:�J�L�':��K��o�:��C者JR ��'�h-��c0Mmqr�!��^�zv�`�vG�i�={�#A|��6P�,E����ED���%#��w;�hL͑��['�kd��Z�G�D��1�&��8�"E���M}�����1N��p�,���5�=��9�I<Q?"p7�߉��А��a S7+���q�AZn}e;�6��]x�������VKp?;�o�dxi��-�u[������r�F�H q���$�8@�6Cr����cyh����!8�A���˲X,f��[��(1�Vt�s�)��T;ֶ���}5��p����LyF��JS�(�͎�R7���B��N���c�au ���%i�*4�՜%#u�����H�C�g�N�&�� �A7_%��r%�?�5us�mx-��(b._UP�՞�� �Z��CX�@�P��01�9u^�����j��?R^�g����v���,�B��*yZ�l���`��c|Ɩ5�f���Rဒ����-�N@>�����{n��kT��;~ �D;�sF��z��8�K��H�M�R�n:X<Dr��,��+���8Q�մ�w�f�5餷��uR��q��g�͍[���t�sbr�숡��7�L��v�F����@��@�K��L:"�����FO#b`c�����K�+^DŽ�O�^�u��n�sҶ�̩����7�U[bxK�_�}|]`��H�� (n�d � <���7WQc� �e|}Q���VE�9���[%5�U�����s�i�J^}��ER?}�K��რ�ӿd�:5^� ��IL6�>��� ptH/�_�C|;����q �J�*����[�g劮a�dƭ��^���7Tp|s2�1�j��Y&K��l@�4���ot��F�$���f�����$���jl��J��ٵhZ�^�Nݨ������1+��C-�(��]f��������(l�no�����~G���`�n0��il�g�ł���]�Г��n�Ϛ_R�1a��gK�.Qs�1o�J��>�P`A���}���H�d0�����}�|*�!�0}�Nݿ���,���d�� Jz��^9P����i5�b:BXuV�U-����������������ƓM=*|-�l��z������� rMa�Ւ�C���suv.�9`㘼&�`�r�`ю ��z�� ���lGр|���reφ��-ɹ�Z\�dMw -93��&h%����}����� �J��?s�v��L$'��t4��������f~kgը�P��O��/�Ic�I#�R|j�� ��t+??��BN����S�_�/���S)dj������:.��_��%_�4�cv�Bt��#W=;���(��&�{�yj}y��t�����ޞ�OR bz����}���]���չZr&�[w\�值���]���^*y�6DB���Y�4tg�^��wbwUh7]�hh�oST/��SI`�\τnѝ�$K��9 o�1y �������;���.w2��45� �ܢT��ktE�����@(�ގN��7&� ����S��e��Ǻ1��������_o��N�E%��̀����ޛSi- �1-�ž�̸���%ͅ��o�4����y����QE7�U�hq�TO [4`��7W�����,�-ޗ�M���]�ì�I�� ݈���u����ps�����n���)���P �a�7w�V(�������qhܺk C?I��\\ݛ�j\:���%л�}���Hć^�Տ��lK�vV�$���k�q���=�N��Q.>,|}[��/�tzx�D~�E1���V�a�E�C[�h&2�>t���8Q��͖ū 5��] ����{��{-ֵP% Ĝ��0ɾչIR?��vh��-���$�z6��e�ߍ ��x �;�Ư����uF��V�� ~��u�[W�6���-P�-�U����ʑ]'��\�ګʊ�֛mJJ��ޥ���L`�N��Ӑ�R�\� I��?ld#�¤�i�V�_���C�P|AD�*3�3�ᦋ��Q�� �n���يD���������Ýq�@�y��ʂҫܦxr���GGko�J��Vv_��hO9�Y�bİɽ!���Xߠ�g���v��xkw�Ӎ����d�rQ/Ŷ� i����X��3=٨�D'4I� '��]�����9����9�u�� ,���)"Nr�S3ԣUo�V�����~�ͻS��,���-��r,]YX�����n�r�Z����{ �i�^ü���e�X��F�ۢ�%��=ԍc��j>���hL���a� �-�����H�?�eT���7��N�U̵s��+3 �d�}ue"A��m/]��wr|�@W�Z"�"t|�O����,�kOM��}
Static task
static1
Behavioral task
behavioral1
Sample
7d782c1847abc9618e1fb18f834394a5db379667c5a77ac32b47c553d7243038.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7d782c1847abc9618e1fb18f834394a5db379667c5a77ac32b47c553d7243038.exe
Resource
win10v2004-20240226-en
General
-
Target
7d782c1847abc9618e1fb18f834394a5db379667c5a77ac32b47c553d7243038
-
Size
2.7MB
-
MD5
d8baebd78eb5abd2d6847e5ef100441b
-
SHA1
307865de829a282e806131aec521fcb89ef2c339
-
SHA256
7d782c1847abc9618e1fb18f834394a5db379667c5a77ac32b47c553d7243038
-
SHA512
34f859338d8fb5609f5cd4e88864f7945e538d8f592c32af30b598ae587e223369bdd8cd964d00d77611c245b28463a59f856910f166441b98ac4bdb24f8e5ba
-
SSDEEP
49152:gIBZ+5lU/VMDWF7TJANOIquGSvO9fEKcrJrCAibc3Wc2SMKdvWv7/:9e5l8IWF7dSFquxvO9CtCdcGRXKdU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7d782c1847abc9618e1fb18f834394a5db379667c5a77ac32b47c553d7243038
Files
-
7d782c1847abc9618e1fb18f834394a5db379667c5a77ac32b47c553d7243038.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 356KB - Virtual size: 772KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 28KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 36KB - Virtual size: 328KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 196KB - Virtual size: 7.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE