�Yk��^��p[�Ǿ��5>��O�� >2��L˝��qK�á}t{'���Q��W�#�8<��)1K�F��N�[�w�Yk�����˄9�X2�w7;UC�V�����ͣ��ՙqP���f���U�(��r���{�8>#:��'��h��vqh'��u��G5T'X)C�./C�I�}�y,�,�w�M���}�㫭��,����Ƕ^x�ӧ�����o ��y�q@�\:��{4��v��WVeQq&ݼ��N�S��h�F9�|f�qϴ������W����)�/$�j�������%(�A0��َ ��p�~:8�7Yo+c�d�ɭ�X�ۅ�? ��f�'�T�g���gI�叢�^T�7�ԗ>aLX,~H?oyZ��_�����C~��>JV�b����p wA��D���>���i�Z�^���5�Jo�뭌��������X���ju�g�W��u���q�M�͢���z"l4 ��4d@sc�pT�I�~WL���A��H���0� pS�љ{+���tu��خ�?�~�զp��n#蘘Ҧ�L�G��f����=�#Opbh��q����ĭX���uX������$�F��dS�-���)�9�p���./.:�x�!�&�Mw��1��p����7(&%����ڗ��og���աx��N��4.�?��� ?y�Nq�v�fBh� ���T�_d����9�2����� ��#��3�-���MS�UxYs�zYx�ܴ ů|043�(�iT��PG���㕠TVA�!��n�Z�- � WU���G��Q�H�xé}ʯ,V��b�X�gL:l#��t�Խp2C�S�0�U�R���m2\~�g��B���˚����o��7�8��r�����§{�3��:��U���.�$J�!�8��9��8���(#ܟ�'6"�K�t��T�/"���nx������Zߒ$� �1����6�e�gU��/���x~ ��H b&-6vv��ڏ�����@������T����J�삪�D�}m�����ay�����.5""���[����;}��7��*�#'*���n|�i���6�:t��ٟ�G{���C��ِp�������t_d��pS�j�Q���˘���f���w�k���JK�iH���e)�:F���~�\ff��uv��B��6���}��lmI�X�,]�o��rA~��f�_&�=Y������Mu�������M�g��,��ڢ��/���j(��[t`��vS�v��f�����7Oi�����(?��C�Ңi&R>f�®��(�m'�v��?Cјj�2<]�c;�w�"N��_1��o�8�BBƚ��2S�8��7�h�X[��&z �S�r� �����W�7 H���������MJ.Εu�����G�����zCk����~�9�[�ɰ��(h�l��sx�\./�x����۫�/�X�y)�ڒ�E`��q�͠��9Չc��L�����D�a�)9�P�s�@�ƙ<���Ӡ����!�+Q�����VBP�EGī4�0U9�w=��H�r�y�>n}ǵŃ��ܱ�v�j����$ۍ�N��줨-�����'E�Gl���0���XL<�- �l��CU�e�}�SZM�A�q0������ǯ.طs�v=JwtGj$���n /X5�W/�������w�"Eج��L���� �{)2O,m �UI��m��:#����&6sQ��u�� �*�v�� =D����d�^[�E�u�l�=�;q�9U�m1����`+A�����Ug>��gKE��2H��2������o���l �������;$u�O�;�� ����R���FH"��ׁ�q7ø�h�L��^�K�@�JPL��^��F'28JG>]�Q^�+�@^ ����.b�wM��^L�cgy�l�A���(WY5v*o�D�ҙX��4�=R(�>�v��)Z� 1����\Ws�L��eW�i�j�{8�5����/�>̀_k���"9i��ݿZ�q�ɅŞ'e�U��BF����،\��X���m�a��-�Ќ机E�����6�jA�����T��8�Q]�,�Y�9�/�9Q��f�������MaS��a��/�â(v�� l�J!&��G��<�S�wC��WG�U�̙՛�bZU�����,�(Q��/���Z֬V��c�����ZON���Z���>����o�i<e� <�N���u_��T&sk8qIf�*T��d�Ҍ���J��Y7�V��) �jm�����S��Ƭ�d��x����-1�ⳖeAc�(<$O�����#�|�,����Ff��V�;V��>×���7��T�������-ϙL���:y0�!$y�4��5��]�Ԡ���Q��&�ʅ��#�e��G���g�}������Xנ��U�#�u8��l��N����'c )ړѧ �R (hZ����˩���c4 ]�<|�FB���BH���8~�C�?��K�4Q����&0�-�0�}�9K�ʰ��)�Y�ŏ����ٶ7�(��%*�F�3��}*�}��2=���d��`��F�P�m�P>*3א�p�L�0څ�'�(����c>��9������f����@\�G�����B��X�M�����uc���~�gY��S4�DK !R�%tpN̂mi�w��//(��9@�պ��* Y�g�1�d�Kk�o<�������%6Q��2����������U39������i�#`1ɗ2�'�M:�&����^e^=��7�o����p�k�w:e�E7�4NC�����yKJYX���GEۿb�qs��-b�e��4�j㿟�t�I5�Dƌ��op����ء�JRg(xQ�?�4�8�ң��_ވ�[�fJf�!�;f�� -RiT����X`��7>2���R4Ӵ��T��n��b�s!e�l��(Hϰٶ��a�IhOq��wÒWs��mS.ܾ�lZ�A{�O0Iª��r�_驏��Q�ܻl��X��SK�cQ�3�ZՌ&r!4� �`$�)�e��;�༱ib�f����Iz� FMa%?ޒ�����;!�t���� =0��*K'V��X.s���Ƅ< �V��ȼ$���EW_1iY�AwA�hf�C"����*"U6�����X�u��=��k�}ц�4�F/e[�������D�S��e�i��K(x�Z���w��O�M$�{��6;�,hS�Z}!#�0�qW�l�NY���@M�˘��pR�I�m'���I!ㅟg�n���?�yI�o���G4��W٨f�6�`<�tC�h\ĎM��+'��D���I���)i�
Static task
static1
Behavioral task
behavioral1
Sample
d983682c8cc8801e96cdb6b3c843a49f46525ecb56159f2e038cef7ebcaf0add.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
d983682c8cc8801e96cdb6b3c843a49f46525ecb56159f2e038cef7ebcaf0add.exe
Resource
win10-20240404-en
General
-
Target
d983682c8cc8801e96cdb6b3c843a49f46525ecb56159f2e038cef7ebcaf0add
-
Size
3.1MB
-
MD5
88ffca56b3bb2aebc16cc8a6b7ebf115
-
SHA1
9feefea503eee73af714a91faeb5e96dd5a75d58
-
SHA256
d983682c8cc8801e96cdb6b3c843a49f46525ecb56159f2e038cef7ebcaf0add
-
SHA512
fa725117ff5bc3d5a7208a568b0619048012f028c377a66f9a0aec1e01b2d837e8e4bd7047586dc4813371f23916030a43483592c954d6ed90a482c1ebcbfaee
-
SSDEEP
49152:2tOvvC15Kg37sTJSQSqrP+YQinW03heYikzJNQZQ8a2avGKbPaoK3ZvFvI2Xs:2tqaWdJS8P+0WG8aRAvFA28
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d983682c8cc8801e96cdb6b3c843a49f46525ecb56159f2e038cef7ebcaf0add
Files
-
d983682c8cc8801e96cdb6b3c843a49f46525ecb56159f2e038cef7ebcaf0add.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE