��,F��o&� ��ZSϚ�BzW����'�ÞK��D���coyd�q�|f�;�y�=$(�M�0�`y��\df��rqr������5g����N�IP���V]8s���w���t�:�|p�l�B_-���h�*x��ݒV�iu�~\�̯��1��gEX�U_��41���(�K���Éqb.�k�j3����E��C���=8nZ��4�{����0!wq�2`�>������6Y :Rc����䝞�VU�G��f^Qⴲ.|{���_�����C#Ë}/���̏����I�^�H�G.������ߵ*m��������b�8���>��I+�p�X��,Ӳn9 �f߆R�� �����1����U�ʦsJ�R[Z;�&�;�G�X���꙱lܶ����(�sS�#��䓙���gO������P0��w�;�QYQ���?�^Rb(��&�a�'�3�9��a� �o<P�7��>�͏�f�Eo��s��]p��T咚��a���� �/X#S)�Ί�����i��ၫʉT�rZ��ѮM�8 #��D# A�[��=�k����� �L��"8�v��-0�~�GǬ�:�NX�I�o�qI�Pn�2��D�&σ㺬ԙ�����#��SL&��ᴪ J���o��A��64#6W����a}o��j?=�,���i�� �n8�͡R��i0��{j���A�V�^��7{���D�;���;T��;�}��������&sڮ��FE ���<g� ����������+�.��ɰ_���#�.�J��"�*��Ե�lU���c��OMO-�=d�)#`z��#rPǪ5�:�f;��I�r�mr����ʪ��2`W��ºW��`����<5_p�9HĤ�������S��2D��17�'@���PE�ɂ���'���sS�?�zE����R{<&��Ȟ�w��D�Gє�v�����}��D���^Մ�)���]?��L{�Ղ~zN��eJI��9����H�F�s�Czt��&�L�����`�Ypf���Yu&�?���.ń�502����}�59��v�|����+��F�M�l~T���y}J"X\��,��T�+�nt�%�_}�H��0U#≰*l��`�=B���~�Ϲ�E�,Γ��Hȹ=�[��K�h����8�h�m�Y�ٗ���B� � K�QZ�龂,��~jFg�������s�CùH��7�#r�nE�`��@q�1��1���U��5:��s���w�.�G:�:\���dmޙ�m��F��mq�1��|'T���ݿ�����~����ȡ8d��O��8��&A �]��O�S�<���L���b?��z�P���9[�8���!�w���H�}�/��Sĩ4{5訍���,����\ߑ��?<h���}@?"2`Z���%=���ܸ��Xέ��M�{��m���c�A�ڼ���r�ԯ�A��Cڢ��&���-��>�G�{�h��Ek�Ȝ^\�?i@:�ۮ�Q�.8�Q���42�&�?�*قٍ��<���<E7h�.�����(~����[-+C��;7J�>��R���X�������(h��xg�r���(;ɴ�f�VYu�Zp~0�� R�D�|o"�W����w�J�p�Z�%����v�a������@&M Ql2H�5�Zy�~�j���:n��쀧��>�Q��߈����I�=P[Ȣ�.�!� �Y���X�خIK3oW9ßJ��q�V�<3��IR 0��-BbM�'0 ����feF]*���Y��S�O��D������ ���ZX#nw���w���6X����U����1$�7Fŷ��?�D�n�Az�b�� Φ[�#�Dv4TC��i��*ڐ����ǒ�88f��ɒ��^�U�7��5���Sz��*��e"�5mꃡm� o)�λ��͞@�-����_�q/�2L�9u���]Z� @=�"�m=��\ii�ki(�V.z�����&+n>���T��-&΅�H���-�?����mnU��5?�w�3*_,��g�r\I����q�q� c�5�(D��8���Ь�fڏ�y��Q<w�E�:����9�)ů�c�������J,,��p�sh�Sr���a�(���9Y��Xn9E��]z�[Esz�h���e�}�`\��7l��u�Wd�������T9�2��P�̪���=�JAB�^7�>����0�!ɛ|�6����<s�v��۫â���)���pS��:�>q�B�;:�cw8��f�i�}�{��{.,ē)iD�PM��>4�h�D;F"�+��P�1�!����Z����o�Wt-y�������A�'a-*-� $;{8��>f�4'�r ���a��2�0̈́m�og��4�@1&��n��~�V��~|�^��?�N��� �����7.�Ŵ�u�(�9�N���I�������{�6 q$"��>���F��`�v��p�Hb�1��uљ�*n��wϿ�� <q��Ib"�t��V�H�d� �F�%���t������,^����������Ϻ2ֵ�e�Nu�YK�*O�.%��a)ؽ���*�٩��`5�Y)n2 D���Hq�O�}{[�< �Taw�Ǭ�~n��h�G�%$w�(�a��-AX'�2�!��� �b%��B��2������bSc����j������v�g�}��ܸZz��svɮ��l�,����H ��R��d�*�4*pն`����\�ӑ\���]��>���̽e.�b_㡙V�x����79���LL����>�(3� V���Ixy͈��Jީ�XJ����O'��uQ/��۟�N����[8���9�e��/n�8B�^��A�Fva�k�� G?+���5 ���a2�w�"z�f�����V�sNԅ�n���u+��z춂8p��,��6K��tPHu�;+�8�I�����<�qI��9���a.+9�֑�Z�(vR�0��y[���g�ap�vP�TN���W�-����}I�;�*��X˳���?�������S�6� �4`)��E���m+��G��_ՠ+V��oTo���F3��FH;���=��w{]����'F�0B�4$��
Static task
static1
Behavioral task
behavioral1
Sample
b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
Resource
win7-20240221-en
General
-
Target
b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76
-
Size
3.0MB
-
MD5
7116a0cf1d8842e14512aad44041b265
-
SHA1
617fac256e018a4dd7869a708194cf13c2fc09b5
-
SHA256
b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76
-
SHA512
dc3aea207710a1ec664d58f57ed9ea2172f66a6a40a9f110e1c259fda6c4587a0bcde4e074ed928dda6ae39983c8b50bcd9246107f0674c29883847ad53aa343
-
SSDEEP
49152:JIsKpuaI47HpE5HQSWjtcCwA9pGCA3KT5v/dfNYj0krdEI88NGOknqKsyE:ypH/HaJHIpwE9LvVfNYIkrbGt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76
Files
-
b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE