�]���Q��sf�; (��Y��7�?!���9��nX@I����x��̀j��}M�lS`7{��-,G CZ�BCu?J"����t��!U�H�u�^�#��l#�*3�9��P�����O(=g�u�ù���)3�o "���}�O�MjԾ(:zՇݼ�ei�������!��\g(����~��&�a�����Ey�i꒘E�b��/@D���NJ�Ӆ(w��o]!YBN}������pT�s7f75ȧ���Ȓ,WhL�$#���!c���;��po�+����8���w���B�,˂P��s�-<z(1 :r6j�Uh�������cr����겂:�� ��ާ�D�у���H ������"h'\h�"n֨-@XP*^(��<���m��!<n����g�1�XFS\s���"�9�����&�D:J�U��WTz�:'V�g�;�4��y�1��p��֘��8;.�ͭJ��9�뻇��|�p���fj!q���}b�>���#S�lT��������SjdXQ����>�Վp�nA�@\���+mn۪����0[3��u���0@�¨�?9��� ��eOV�B��E�nǿ�4��"y�'v`��>� Ï�?ܦ�Ww���vL#I?3���_ؖ��Kh(��?&�d��ˍ�x���]����=!��U���F �${U0C���Ww��E��b��M{E�f(���=�5���T�Dl�u4\'d�ޞ������p�f�Z��?��I����dY�ĩ ��¸\�N�%�w:8��n�V�E�e��AJ�n�J��&���eY,ɽ`(�͏-���3��`�Ke$9#\nvwm�*��>kQ3G��"��Q�*Z_�SN��%-��cS�_: �-bl��9�����]��7k�\�.�s%�n��C �15Ӈ���Y��� ߏ�ѣ�ܶ�S���:l���V}1&�^a~0"�5�\�c��m�����k�x^������}<����R��Z�h����0뽧�j{ڟC���j�&�j��|P��{Fv�[��щC�g5�$o2��.��q���>O0���c�L������P��A�Ҭ�}���6�y^oTgl�8N�,~i��tz�H��[�4��y�2����kj~��{���<���}{6�!5n����կKmъ|xU��a��J���Nj���pГAb ��|ʶ���\����<��� {U����Ԗ��P�H��˦y�깫��/�y�M���N�h�2��h�A�w%�U�z���5�C� O���賄���DZ���^��)���c�r���z����s5�� Edp�R�^�� �����'#d呮�D�B&ءzώ:"�&�]��t� %��Yh������]�QA�L8a�?f�Q�af��h�ڲi,ܭ=nk3�V�lE���9&�y��s�/˗�4%��������^s^��g�����/�{1-�h6|�u�8�V��~3?N��,����µ�s7sS��D�\>����S~�G\�d�|�u�יɘL�p)��9��Y� �N���#�BQ"}�Q� K�'R�i5��2w� xy�;S�3dKB���t�Gm̄�q8�[b|����Hr�w��!�ʢ����čYm?^�����=���&� �~DSs�+����O3)�������(o�㉙`�{X'�AĐ��l����-����h�*� �h ��qya �"������J%���՟é���V�S��q�T��]�t��s�J��y� L+`?�y��\�rU�S� .G57!���dl,_�O"a��em��1��c�ZdV���(��h��H�P��ӌ2d&䈸5X ��?瀅�F������r��4X�4����u\�ѣ��C��~�M�!�����({쑑�9 �W���[z��])mK � F瓃'{j%Φ&aAlT����+�55���;j,�����"���&ÕD��b�|�����kY�,��gظ�|����TƐ26p�c�jx=�<Wa�H���"z��E�A�[��6�/�1��Eg��Ъ����(�J��n�<"7��\X�����������'�U��7�%97k��mz��8�(ԑ�!�Yj��\0�_t����g7�S�)[�k.���r:��[ŵ�K�|�?�a� Lw��x�=��a��~�:`��� 2PAV��%��+�HB7���g \�h���ʭJ�&�ni'd��<�7I���g�Bg`A\(-Z�vr��x������=Ͼ2b�����>Y���M��� vU0��6�%z�=�K�4�Z���a�2��8�x�4��b�h�t�>扺�����p�v,J�OL݉��cJ>-Cg�����~�8|��h�E#�S��M<�!F��N�jn�#!�� 4�YLj��W!�6�[vww&ob&}���\�;˫�}T���8,@��[�j'9輀��C>�r�{[�;E�/����21��U�/�� p5��0�����N��+�^TCQ�vi�9l4_���&e����H�f��N�����=�<\���Z�/Z/��h{e//qf�������&lY�ZƵt��'d�Z�H� �l:Y�x��J���R��,���kc���������M�ނp���7��S��z�ؖ�.���$0F�9���om����);�(B�vN�q�Si띡~���v� ������i���]�s�eQp#e�M��jx%�ܢ*a�z:��q2זɗ�J�FM�gKVov�vG��-��sKt=��<�=���s����8�?z���X3fb�>��:Q���g̹|��5���昣5 M8��w��3~ c������ �XqȚ��*~��n�g��� ~�@Y]��[�s��}p�S�1F�4=�TOO�:-%Zb���;g�Qh�*U8bC�[VJ�ah���Z�����J�X��%��[c�e*���� �����.H܁ �[Hφ��4|U��aa@��2�����Xc&���&HU3F��E(����̶�y�Ҥ՟k�{����gO����;�6}( ��{S!�EE�D�w��.@Cf�͙cDL�=�Rp�]�����v�����/�%-noS� w���V;>������ �L7���F��Vq�T�ǖ��!M<�s����!��BGIl�GM}*���"�<O8�O��ݗ�f"�-�p�U��z���4�9ǝbQ:$Ғ�n{b���%�[e� �=��6������:D��B��/W�����#� �NN�/J5#d�M��@��v�����|o���� �$3/�O��Z_U�d ���S{�{���ڇ�R}��a��d�/"�l\{��/�r�,�*�%�aŞ�>��,G6���ԅ,[6��;W�.- -`C����(� WR�g�ځzz�n����3:8v��6^\MI!1ִ*^h �Do�����e����7�/4�EQW�[�펔�{g���ǂ��(�Ȍ�㈙lmW����;�a8� ]aO����=���[0�
Static task
static1
Behavioral task
behavioral1
Sample
57503b4b6de731a9aa1b1fda9278af0c6842b661526bd94e60349e707e357b6e.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
57503b4b6de731a9aa1b1fda9278af0c6842b661526bd94e60349e707e357b6e.exe
Resource
win10v2004-20240508-en
General
-
Target
57503b4b6de731a9aa1b1fda9278af0c6842b661526bd94e60349e707e357b6e
-
Size
5.0MB
-
MD5
a96a0520f63c386fe9b672191425e6e5
-
SHA1
28448cba7b223fb101f31221b581c41c6285a828
-
SHA256
57503b4b6de731a9aa1b1fda9278af0c6842b661526bd94e60349e707e357b6e
-
SHA512
3e4b0b4d4ba968623213ad423d8f1d158d30cb619e98e062ddd9d00f38d1fdc70555f4ba2bdc2a93fce0d176823b049e9bd3d7bfdb89828165f0ced33bc68682
-
SSDEEP
98304:Rj4BfGAgTZmZ3fvqiog8uMTteJAVtT3DqJREoSM7pEH28URUO+B:RjSccH0peQ3DIRJEHO+B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 57503b4b6de731a9aa1b1fda9278af0c6842b661526bd94e60349e707e357b6e
Files
-
57503b4b6de731a9aa1b1fda9278af0c6842b661526bd94e60349e707e357b6e.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 724KB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.1MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 84KB - Virtual size: 820KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 12KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 7.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE