ĸM���ې)S~�>�C������=�������4��C������B�z�h�δ�?��p��0T����o]�gqL n_Q](�HS��"���Y��I������ ��a6��8���r����lQ�ճXT��k����%�g�%1�آ˿���3f���{0�xv��a��|���Kǐ}(/��)q�C_g�}�f>�����s"w ���t�������g�k�n Y U���]Ȅa.t�b�M 1|�V�f��_O��ݶ̿��Eh�g�.?�[��vm�+��y��� cZ���Q1�Ms��8�)�\�<��b�o��T!�gY����L�� ١�D��KP�c�Yh2��X������]ɑ֬\!(�u�q4�X����+X,a3�͝�����*S*ڶ�_����Ao�8"'�s8��A����~^W�)~u���Nn��M��_>+4�G���u'�JwS>�>�t=>**�CK���Y�/wM��M� A�D���H�u�=��7�N�v�ywޛ�0�%$�K�7(��QIp���9�0a �J��{]�����U��{c�(��$@b�e3�6������i)$�"T��C[�ϝf�8��D!�)���ɯ*R��~�Z���^�G��>��D�:~������Tؓ#���jߗ��5eDʽ�_�*:��T������^�L&CYC�Ҋ��I)b.�~�?r6���i�?�Tw�'���Iy�8-O��J�ʩ�cO0�Ԩ�����ooئf堉��}���h�J��t���ߙ�Y5.o���YV��oe'������2}�R���v�.�Kx�Z?d~��{���N�O;�U�L���.�#-�sp!���Ͳ��SRJ�r.怇/Y!�B� �y`�{�pg��ޖ6_p�D��#;�5�p����7�g��i0��$��M�E��K;ܶ�����C� p�e�� /�;ڭ�͊����-��Q�>��|C��n�!���b���*�U!E!����u��\���CY0.�A���kͫ�~�)峕��ɛ��!�]��~_���}�e�����r*HET�D�{G�\��a��)��T����ƚ� �8s%"�� \W%�B���S��d��:����D��v{;��|���4����Kē�ƭԮn�ɒ� ' v��2=i�A����/\_1�l�"6.���:4qB��6��r-3��-W*�W�l1�t �|վ���_\�!��"[��7�}���!��aXv22-�S�Lں��W���Dҹ�"�t��7�����oq�t�����w�������]H�4��m������|zC�U!xK�����U?���'܌Ja����o������cٟ���`\Ey`{l�o:��"�͆��^$�9;���BRݫ�Q�����|L�1qݕ?��O�5A�P�p�D�+�o�X]'�h.�� e+T����F���>1����+���1�NŖ��_sTW�Z�-��'ѵL=�*8 �sa�d��)<)e9�P��T,$j�?W%���!�#A!f���sM(�:�I"6�2wr���ǃ��y��}@�d���J�`��C���Y_Ч� ĝ>'ÿފ�����@9���۲��.�M��;�$��,8��+>��_7K�Bj�/�U7G2�#3��RR��-�+2��m�0�aL����o�S6.�ʍThP5�&����:��&39r�ʯ1�>StP�@�%��iI�/�l� �jD*?�myd�`��:\cT_S��~H"�t���u�'��Q ��:�ɹw`�����FW���a�LTW<��;0L_�In9Bv['I!��d�'&���u1����xEkn����k!��)R��3�劫�kO��=�|�u�ӛ����۠³Ι����ۊ��}u�Zmi��UB�쏉�I��6�k�����i}n�0IJ�C�C�}D��:sDl�MU�/�F�Ԧ�'G���u�_օQf�|�v;�����Im�Q[ӟ7�(����H_�����eV�]�J߬�Qu�3�V��b���k�U�Z�#H�M�3*���~������@Lgbq�+����%b\;�N�$�ixN%l�a`2M��^T�2/�x)�g�O��������������p`�!Y6(%[0�)X��r˸=o��Tr��{��FBr�yI�"�FW�c8���t�!�e�!y�����������B:].�f����k.��66�;�ѤĽ���Z�GgT�O�����.��`,��D}\9b�m1c�v�(@�i�y ��oq����N�Ĕ`@~�Ь�,�Zr�6Lt)��¡�̯R�/�D,����/?��Ң���Y\�l4j8�`f(����u�D�*��L����<Хg� �u����&m���\��(��Cʱ��ߚ�4��xT�Z�V������� �G�'�tM���]�)9+�ә��C�4Dc����F�^�i引��a6K�?�����Nm�Ck����&Q���"i�kܱ�sp���4c]8�f�,KP��� VJV�<-�y�}��dZ�c��L������:� E�� w���sO�c�i60� 8E�� M��?���쫬-�w�H"4��}b�&�59�(�`����ԻZ�V�8G/�I��x��Fr���Yp,����j���-7H��@� �~�T��Т�G������qiBK�* T�.���͟�B�����.|l\��K�<��ˣ���y��������@���,I?h�GH���B�ho2�B�P�3}��;����F�7������7ۨI@�����(���eE�|���T��?�z� HD���g����4��.�{��5/I2��X���놪W+����0���TT��!D���B�[�����5Nd�ƈ]ЪK��폙����2��� ��2H�*��ޡu(�"I*�pﻨ*} q�W'�2�s?L`�4�rTZ�Ǫ�����=4���5ڰ�3���<��c���9���a�>�������g�������Y�e�۸�N����|�)� "��Y�k�W���{�"����,���S��6 �֥T��S�W���R|�*
Static task
static1
Behavioral task
behavioral1
Sample
685d4794cf7302b28df6d5fad76bd831152883d20070d7a10d56609199decdf6.exe
Resource
win7-20231129-en
General
-
Target
685d4794cf7302b28df6d5fad76bd831152883d20070d7a10d56609199decdf6
-
Size
5.9MB
-
MD5
34df98156cf810bd2c1de1590a272115
-
SHA1
fc7958ad173566e604dc14825bba3bae4e27185d
-
SHA256
685d4794cf7302b28df6d5fad76bd831152883d20070d7a10d56609199decdf6
-
SHA512
fdd61d2210358c2750d526d0e20c4521d0c25f01c9a78914bb1c007dce201a031e6f5daf3a2d18cf1accefeba5d15dd910b0e6758c38985d2f5eb488e97bf28e
-
SSDEEP
98304:maIFsZZ0Fn026gtq5MKjUA2Vc4aYDRG9H2FTtfR92vtdSK2Y5GwluexO5Wc9:GFsj0Z0fvBUpcMD4lKRR921wKP5luexg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 685d4794cf7302b28df6d5fad76bd831152883d20070d7a10d56609199decdf6
Files
-
685d4794cf7302b28df6d5fad76bd831152883d20070d7a10d56609199decdf6.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
.text Size: - Virtual size: 840KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 20KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 60B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp3.50 Size: - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp3.51 Size: - Virtual size: 502KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detour Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp3.52 Size: - Virtual size: 536KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp3.53 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.enigma1 Size: 2.0MB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma2 Size: 284KB - Virtual size: 284KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE