0\8Ȳ\�,����v�Wz���>�Ѣ^�癏��J�I��[�B%A*�o�.�f�����P�W���%��� E��M��,��j�b����g`���8�s�8W@@x���º�s7p��;H�:���f�R����7�a��q�,��b�hMׯ��n�;N ߠS�L��.��}:"�'��� M�I��rD�1�Qm�^H律��BUv�0^�����R��Z���"f�w~Hi�%��,�ٮ�u������� ��j&u8����9���q�w{O�C\���+�O��i����U�Y*[Ɣ��M�RV��#�d�� D��i�@: ����qw�kk��L��� AD�g�ǀBy���w�Q;n?4d���H:y}�s���#y��7�0=̡-�iA�fH�|K��1���`��8�ߨ[��C ���%Ysq���,�J� �E<����� ����v�҃g��p��i��X�o2��dN�{� ��QS؟/('��Eys�"��P�f���)pY�!�6���c�k��,��3�Q�q��˗%��z��'����{q���ج*Y_%2+��3te��e����r�)�����~�ݣ����)�r��-�q}'_R����C:�|�\���_�B��z4�c����|�l����<w����鼊�Y3�=W�!��^���M�!q@���H�53m�s(�4�!j�L��a���pN�$~W�$ƨ5��TY����e���^����@�Յzd)��D�"�h>���p�.F� �˫b�EZ��� ��<�p���Ns/�R�='���F4�NBM��p����������9�Þ��� ���kc���g1S������B��c3�)��m� ��!�m���"�=��]I҃����D��#�2��y3�Ȗ�N�x)%�1h�¦J�24��2�TN�0�p2�|���l��-����ti�s�Ij�����/2x�4��$F�ʼnF�3�q�����ܘ�uW98{z�0.rм`�(5M��������8���@N��gb��^�x�$,���1��������ۡ ��|�(c#��J�CQ�oy������7������݁�\?�.�m}x�y�Kd�À8��{ϭV�k,&��SuV��Q~���jPK�N՝���C�`�LeUf����8��*�`���`9�%������e�֒r�h1t���~ ��{��;4|6�w�IۇM�z�<�� ���"�x��S ���5Vi�}��6kE��|E�}���s+��~\��k�ս)T�t���$/��椞[���Q ~����<Z]��R�vC��!� W�B�_~�ݽ��F'�?i� ��QJ���Ô������3�bյ��:$��G*�'�����K�Y4�������jP_VӶ���R��/ j�uq~+����|��L����qTT[$��,(�bk+MU��G����9m�K�c�K"A�c�����v\��WV�W��*�p�: )X�}Bá;��T�z���J2�c+�3Rӻ8*/�9�C���z��98`~IB����?��?���צO�W���=�_ſ��R ���=i�8+}B\��oy5O�������G}�gFE��$����~�'hp'FR�����/e�Q���f�1�O�h��aQ�b��� 5��/�O�4�B��n�?!�����8G�Bmc�s��QH�+D�&�V!�J���bDe?�w/`l��� LiN����Ţ��ø�f�o��b�Fv��I9v]I! )�N���_�L�&�Ƈڈ�׆:ݳJ�;��u�ꃘ�A$�aHnM\��k��Vk�/�*k�[��{��k}�%�����7�����p�"��U�JF~��'�N���n ��b:Y�\�@*w/;�C�d����μe}n_���H�G��T�0i>]������MOD�� <�i��HTye�"vN� !ڟ�#�j�iH�r�I�:i�\�=%D�;�}ߕטҹ'.�X6�l��?��T�%-�!i8<Qt�^���EM�}���Iv�������s9.V���$����Ø~���J'���%��'�Q�1S@���3`Z;0`������&1� 6��i�����o� *%dY_ 4�O9����jQ���jz/ɓ W�7-��Vu~gť���\�j�/g�\��u"��u���0�&�8��? ��V2(��Y䜸x�h�#s$~�2�.)^�"˂[��R�`��c��B�4�\��\M1���l���߸G�Z�L���O���� V�E�rv��Wi�F]�-��R�վ�p�b9�t�K�ć�����֦l� �S�~�B���Ai�>+C��6[8� ���z��(�-�ld)���.a���,XS�} Cɑ ������H$��Zp{�l�%�Gk��O�#��W�7R [�IOn��9�^�����e�`B��;)!#�)���� ��6"'e_�'k��D����X��i�X�Q�����]�Yw�9�N@0��Au�.�����6j��.Z +������5���6�T0�"b�a��j(��c1ؗ����6�$����,��u8�4�)��1N��?�����\��΄����D,��,�<��f(�������k�9[֨�>��ѵ�l8�F���y9�!)84`��m��덛�얹�;���v���i��3�&����a��4��;�"��<�v=Jjd�����^��@�K���( �N(�Oe�d�Q]&{��h BS�=�{���.Pe�����GzYX'�2m���V|d7����.�#��d�E�J���D4��e����W��m���m[�֠� ہ}@4�mM28��� v�(c��d`����7 ���ɋ���w��\����R�F���B�����Q��A�@0ا]�4��,�������?/�>'�"a;��]kŁ ��g���V0�o��"� M���c�L�]�����I}����QK�ȷ��{ڱ�Z(/&���UV��̖trJ���Y���X=�?����[d�H�� B�2ydc�;�o �}g�+��.�Eeac8`�O�<� D��ݎ��"b[0|g$\�y�2�.ݭe0D#p�v��orMZ�Y���$�є�`ET����[0��E���t�U�(��j�Sb��A�;���<J1�Ϩ �6��ݔ!�ʘgg�:q�@�a}Ck�BK�GXTk U� ��'A��P��4z���h�i���9�V杷Fr/A� ��1iDN�<^�i TG�2M���\~�#�HP Hyn'R�;�v���/����k�����b�S��6��vZ$��<�;���hͰs�0�s� ����%� R�R��#����1և��z���Q��1� �1*t�׳2ҬGV_?Vن��Ǎ�C$�q�ƴ�>�?�J��-Z��~nHf4�<#��M�sB\�>h��� �@i�,��(�(G��̖sl-8��Z�P��y-(�OF1)�y>K����U2���-��(�o�B�b,{ET�mJ�c?-��j����"<Ge�Cm;j���F7���9:��(8�1;��h�����|n�����s��$v��ių�C_X��KRy�J�O^С��Z��@�
Static task
static1
Behavioral task
behavioral1
Sample
50cea3aadd08f93b5f60921083c163c2577f575f4104ac693ea28552207ee99d.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
50cea3aadd08f93b5f60921083c163c2577f575f4104ac693ea28552207ee99d.exe
Resource
win10v2004-20240426-en
General
-
Target
50cea3aadd08f93b5f60921083c163c2577f575f4104ac693ea28552207ee99d
-
Size
2.5MB
-
MD5
552e06b3b695cf6e17cce8302e9cd07f
-
SHA1
de4d27a426fc10ceefa54f1b119bd1d371daa77c
-
SHA256
50cea3aadd08f93b5f60921083c163c2577f575f4104ac693ea28552207ee99d
-
SHA512
23a6f378f176b6dd8374c714753be645fcb86d1b57250dd99ecad8b4c60b3474fdf933d38d633aa7d478ac306661d0118e859cada8fa200dedd5793fce16516d
-
SSDEEP
49152:vI81uKZZ3GF1VwKVZ60NiCxD6jcukl5Nc6McuyDFhwaYRZuMesV3+sMmusC7:gEuqZ3G7Vwq/NiQ6yJuOwaYRZuvsVu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 50cea3aadd08f93b5f60921083c163c2577f575f4104ac693ea28552207ee99d
Files
-
50cea3aadd08f93b5f60921083c163c2577f575f4104ac693ea28552207ee99d.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 223KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE