�m����J�$pp�V���r�\���@��Dǁlybg��������ePrS@.�2�PD�"L�~��P2�N{Nz�M�C{:�@/p]�o��y�ph�0yA��LBE�#���d}g;u*�p`;�벤�Ջ'-��ϥ{Im�W�P���m��M�^opCƉ�i����g,8ڛ�����Tk�.�=� }u�_Gڕ�ĸ�a���H@�;��j�Q�yt�B/�vN���^z�o��,��7#'��H�<����\��|�J N�PyE���=���Su��G9� ����-��F*���h�s��n�C�yJ��at��jJRR&A�0�m�D���؏Z��S=�lN����~�-̪� �IH= f�nI�!������h�xj-�:�ٚJz)�J"QoDףY+�!7S�"�"�Ql���Bw�{��+�J��4�U�9�G0��^���%� r5���r�GCV���yR�����V7PJ ���x{��Y�>'0�|�~��LtHE�]��A[�"��� u����J����O`�i?�����x\M�\�i9�C�:�E���[o;�j����������|�H�x�R�)�{�4���������o#��dn�\V�34g��oi=�������Pmx�EW}��9�܃��p��w��;&sL�������HS�UV��T5R�Ɲݔ�$��n.��B�����j���fLҍ�w�,h��t���i����!��s�S0�|�Bg���u�f/�������9�ܙ���F����FÚ-LpM�ro�^�M淢�m�|�GjH�D$�QdO4ҳa��p��im���f;~�_����� nX���y����_�����W\blg*�4�k�.����$�2����x���f�u$��8l��h�A���1}٭�h39��z{� �hC���_��R�LeQ��ˈ��U����J�� g�?I6<������N:�@�O�b�?�7t.p�d=��_�n���#�<PR��]Z��v!� E�&�c0/{�索N��2�e̹)nXJیy���Ŏ��Y$(�y_��D<<Y`��a͑��ϑ�> ���>O� E�s�נ�&��lS�-�x���~@���c��&��Պʶ�K���0:��aaJT%[�Ƈ�� ��O���y�QF��e-����[�-��|Dt��V����6��S TD��B�����Ɔ@㠳�����"�+���PY{�=�>�c�d�5���ξ���穀���pzx��*+���N���r� ac��.�q�ۯ;�%�w#�����{�ls��7�� �8�����LQyi���t��]�D�¼,&� ��^�JVI����o��7�a�h�+7�6!*Z��s��wQ�����������$���#*k��XBy�j���>�(O,"�Q6�Y-8�vw�h�x3��/��kV�\�%�"�P���'Nxu�膡 OC�j� <��˼|h�c$-iI�G<hE�^�s�JBz0�?�0�u� g?ʌ���i�b�`�,��zʑ^[�=�Q���ܼ��>�!hs����G*���?>0z�VH���{���:?��:��f�F���~�p����L�oQ8ic&)K�f=�S��}���X�����J�y4�������!�cڣ��<$�E���S��u(qj���n���U��@���\^�$�J%N���S�W�Շ^$~E- !i����������%v�����Oy}�Y��]��6�#z��bF�P�)I`�$��� �'!�=���mR�Ȓ������Q�w�%ْ����k?���WmN�J�j�F��֣z9)�<�Ǭ��/Iem�HuV�v8 ?��U�rf�$O9E����|��"���r�w�E�;�\��J38Z� t�vH��SЪ��L���y�u����)&�����r �H���j7ԔP�f��[8�n����<\��_�<��/@x��t�Dqwr��d7�c�kjb(�)�g��y ]�KZd��ڜ��K� VN����J��n��A1�v�ۘM��d� {�Lq�'�ij�#ݤd�������U�z����K������F�,)���W�����&�{�r|P)(�1$<>��*�t��P)T@K#��K��k_�y������� �Uc���3&�-j�9���+c&0(rX.3Ry'�I�RH�YTe���7�a���Rb��>n��sIB?c�Z�CmfL���u���рw���<f��M`���MFQ�y�ꕜ����b��i �Fv�_� �Q�����#׳l��Z,n�T=��1F>�q��s<��آs�/���rVȻ��n=���鈨O���bS�6+�qGJN�>��H���V� n�� ���r���mK"^1d��� /�4�a+0�q����4yw�!)Kט���l����~T���,/ڀ�D���(�� ��%�H [�"r�gg���,7�{C���:K1��Yd��"6������S�G ��YfJ{�Ӟj rD�Чǎ�������5D�,��q�%O+7&��: [�'�x(\�iך ��q��=�f���I��_/,�?��]n^k�(����cY��bZ7�?c�9{�Jo����w�ZBH5Vq.�!�U�#_�\�<���7��ǹ�(Q����XSW���_;���<y"�JO�O�ޟ�L��ar ��˨��?(���N2���?:}M\�]J]���T{7��_,��҄oV$�4�x%vH�� �3���+%�d�6�O���N�d�A;���C"���)��f���w� �c9����:H%�șjviJ�����t}������,�� �����,<<�jM'8���T �V�L��̒:W�iu��fz�9���|�\Wq��<dG4��G�(���=��2��eXv�Ts�Q>���;�ײַ�m,q��U]jL[�x)-����[j����5�>�Ĺ7��ތ��Gp��> �po��N���UY�U<)�����-3�g嬇�8���xy��� L~��H������XN�F��xlO�u��g�-Ly��s�-kPa�`���r������J�4;��cwP�%m�@)�<���-;�h�"�Im�n� e��6�����r�X�ׯ�I �?�X��L7��q����� ��*Qd�`�(�>����q�0�/x�q�6�Ԛ;vxR �H��o�X�\��4�9�<�g >��͡SL~9��Z����"���Ej�.�"�7�f:<�C��'9�0�M�&u�T��`��x^�F �|��XDR�r��v������$�r� 3E����!U��5��'_�ۊ���9��>B��t����!��~�=\��ss���q�}C�T}�v��Wm#�3cL�k�z��m���_����l�c1m��s�\�������M�L�I��.vˢ��/P�G��yJ��bN]�Fԣ��������� ��$��0�9$�`��'�7��uF8����J�@�Ppxf RJ�a�Cb�5�഼���J��q��R���$vr��B�KVrؗmXJ���JW��ۜY�f�<�gr���t�s"[�H'��-��8� ���I���'����XB��o >�'N���||�O�l�5y]E���z�귽C j�|��){���u��ISo�
Static task
static1
Behavioral task
behavioral1
Sample
70ac9cbff374982fd4dc7ae6a4ce88ba5403ccc6e2faa01e3547dfb7823a20f3.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
70ac9cbff374982fd4dc7ae6a4ce88ba5403ccc6e2faa01e3547dfb7823a20f3.exe
Resource
win10v2004-20240426-en
General
-
Target
70ac9cbff374982fd4dc7ae6a4ce88ba5403ccc6e2faa01e3547dfb7823a20f3
-
Size
5.3MB
-
MD5
bf997982c5072f4380317a24ac346480
-
SHA1
c256805282b34e4d2928d657d134ebd882a92be6
-
SHA256
70ac9cbff374982fd4dc7ae6a4ce88ba5403ccc6e2faa01e3547dfb7823a20f3
-
SHA512
7b0bab092ca2b56a579b946f519fd5cc708c676187dfdd103306c2b1a39b85d05f366842a225254a85d2083138b6c9fad4d7702cf54fe3505fe2c73c7a2881a5
-
SSDEEP
98304:3utPus/fm6VWFPKsN0TvDbNUHuD3tAmB1xqJJG:+tPFI0TvdUo9A6TP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 70ac9cbff374982fd4dc7ae6a4ce88ba5403ccc6e2faa01e3547dfb7823a20f3
Files
-
70ac9cbff374982fd4dc7ae6a4ce88ba5403ccc6e2faa01e3547dfb7823a20f3.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 792KB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.9MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 44KB - Virtual size: 712KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 12KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 204KB - Virtual size: 8.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE