�u��*7�oș�BSй$���"��V�z���\���X��tW�S;p[4#�*��j{F 4HY��*蘫�bߦ��2�Uƪچo��F a�E�,�r�B,�ӥ�J�>ɔ#����6'hJ�"��XfU���!7ޝ�����` �i���'S��f���j��f�T*�����#%���M�8|�eK����u^��ݟ���1D.��g�ݪ�Ǝm`�� �|z��ާ�X�ƚ�A �B$&Q�����#�,Ώ`Ae���2$����z�PPs,ai�DsA��l���\���l/�ƝD���s��1�Ҫ�I�!�M{G\x�7 A+{���ۏ]��F.G-��X���-���l@յ>h��j�Nڽ氪���a�(M�g�:��{�W�.8D3>�I��b���H$�����<v��n0s�h*�\��e�TG @C.E���\n(��'d.���h^Din��[����{E �-Zy�Uх5)��0寙�%�_V��z���T�/�Xoݓ�su�{��*�k|�p�ɞ�!0`>U�~�`z����E�7 ���y�/�wH���0!�����)�pj�2��vPh����Fh�p�K�[�G�Q'P)0QT�T�(��QRJ�:�mT�g2���������S�_���[q���J�d��ɹ����R�|��/~��������,T%�1pmb{WaLd����U�%(c�DŽs�^c��J<w��G*�fk�j1�F}�����V���iM�( �v�<k~�Gl�?o}��y|������ǥR'����1�TR�q*���C�U���8)v�<�Lyc$�f���I�gG��E��%P���`�|�lq� )ȥ���;0�?�O�Pkv�u���/��lλ�}V3��gD��2����ӏ���#�`~v�d���#A�%���k�NȁUօ��q��adf �e8�]_�&�D�Z�X�0����dC3�L��ˑ���SA ��Z�T���s���AaܶB*v�*^V�g薓��'�����QW-���l�&�߷�حӭm�7�ػ�O�+m�������sMz/�����[�QN���ݸ�n H�@z����~H`A�gY�7����h��<7=S�0�3ݐ�RI��x�LD}}!��R��lh�7��R��O��\���Գyĉ���P��y4s��W���}�@��۱�!%�]�ޒN�������/�/2�����cA/�?��W4�t�� �ؽ�V��=��-�����m��=�4qm>�r��%G�%C�.��%�N��D�I}�vH�(�LK�t����I . A~ ����c�g�U��z,r~�W۳: @2��$���D| .�+�����.uz�!��X� �fκL����C�����=w���l\γ�G�;�04�l�A"X���KPD��{hӎ/���iF����,���]Rt��{,?T0�����X�c�D5����_�e�poW�(��+�%�v�i�)ʗ�k����Ra�g8gQ>:��I���h/R����*��XԢd�[���+��H=�A(R�#ػ���h��byıǟ�cubK`d���j�.hj9n<h1䥃T͒>��A!�{�E^�y����$�{p�Eׯ�����>p���y�~˶!�h�2�kH��/�{X*��8h�0N�� �~.Į�ߋ�mJ�����f(u �+��خ7�%ٜEaF 0�q*��To`KRi�������g�SE���.8X�;o�,�V�_|�r�'�Lq}� z��� ��.�� �Ք�PϬ�3�Ґh�?J��I����O4d-58��Iݫo��3���y�t�O��vT�G��5S��@{pmt1�Oo�C���K�w�'�0V뿑�4�d=��R.*c��Xz�/�z~��_�dp,KR���p -w���J����;����(�◠��4-N� bm�m� ����ۇ�Z��rb6��ى�.�Q���<�ħ����¾dQe\�z+0�oL�OS�0�k�8�n��˯��\ Om�wU����Qz�9 �� ���;��X͚z~[_S� (�Q�`O����hrO����V?���7����-Pu���$�݊�#�]�4)�4��cKE:��@_Z��2<k��4|d�o����Ή����切z�T�?s� �Oy��{�%1S������:`|&�Geb����㳔�����E{w����NL%����J|�@H.��;�.H�������Q\Jӈ���^C��Eh;���svd�R���[Q�L�Fwu��@�d!����N��k J �y*�x7{,�}}ֻ�e�����b����\j��uK�a3�xb ��'��Ԇ��r�̓�F}����)����N)�G��Gْ��t���wF��^��2��[���[��>�6�aH$�R\���Ob<�����f('�9� 3@�1O2��CF�ߋ�mG0��eS�/w+���B9�*H�e2�(��.>��؝r�-0�u�~9OF6ߥ��$�Re L�Bcĉw��Q��+��ur<��"��}MLn����q��X�5��/��g�z����Ō*�R��Hr���b��E���Z� a��K�}}+Z��-��&sl�/}�0�̫�:� �@ծ�����������8?DO�&�l%��a��DR�N��*3�+�����j,H� ��D~RK7�f����) ����9dS�����lEJ���T�+��ws�=\�̡ ĥ���A�H׆�.�t����=�����IV5�w��+I�k��h(�c��2!W���!Pu�����H�����[�D|�̏�\��<��������Q���.�h�k��]lj] �����m���M����R����t�R%I�f(����eD����#{�.2��U�>�Q��٠$O�>�Ί������/xX�2>4��o&mN�H!�`5����T�͎`�V������tQ|3�����Z*��m��vF'�kA\�GQ �ܐ��X�����b�ࡺ'PR�? Fe����r�����F��Ɨ��1g����o$^�Cݏ�H�h�v� �(x�C������u�t栛6|L( ��8��Pz?���bu�� ����}Rzx�Rx�������'�q�I�tY���}Vhx�c%:i��)���9'���+7�ۭÒ��vQtO�yV��µ-"��� ��X��� V_��P\���¼o�>�}�np�b�^Q ������K� ���u�~a��}����|���Zá��j�6c�5.�W;ey� Aa��=�.� ����p���X�CcL>�k����7f�E 1�����ypK�������J�?d�:/׆�]JB� ����`a��s �=�c����h��ˣ�h6�y������-�N��҈Z�B~��zR��6�<�a��F 0���h�OA<���s�q�M*]� �3?ɐ����L/Q�K�(�݇�_Pl���ȹ��$����
Static task
static1
Behavioral task
behavioral1
Sample
a2d29e3ca2790d57f26acd4799862276c4cc5166711ce647bf7ffe85ff96bbdc.exe
Resource
win7-20231129-en
General
-
Target
a2d29e3ca2790d57f26acd4799862276c4cc5166711ce647bf7ffe85ff96bbdc
-
Size
3.1MB
-
MD5
49ed6a267d0bae6385bd9270600b7e1c
-
SHA1
784522d9a232e40d5ffe5864539013fb935ff1cc
-
SHA256
a2d29e3ca2790d57f26acd4799862276c4cc5166711ce647bf7ffe85ff96bbdc
-
SHA512
e7d80b6d92cccf08fd6b7681441f94195708dcfa74256d67a28eb5e5a22e3888429e4ac141f242ba070a6aa920c9376595cf53b794e0e306ce5f19d1f4d2ca77
-
SSDEEP
98304:7X0iej2jxD/8jt/RV/Yrjv5odbxZ2edGiCKf8:giej2jxD0jLVgfxod1JciCK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource a2d29e3ca2790d57f26acd4799862276c4cc5166711ce647bf7ffe85ff96bbdc
Files
-
a2d29e3ca2790d57f26acd4799862276c4cc5166711ce647bf7ffe85ff96bbdc.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE