�#(2\Z7~,���UL`Gԧ%�-�����_��F8R;DzT5|�t�F���³������� �<���0�\u��7��9���ݜ�^^T�}Y�����QO�;I�Z��hPJkl4.�������쵬p�8�ڼ����hSBj�e2K��m�r���3��xK"��@��w?'/�WuY�H�+���eEf0�����a�2EV�7eJ�)gd�넊�-q��0�S���>4r.�3��m���:+�58H<UA'�7�p��}��]��B�=+�!�O���G��c���w�h!e��j�H6��K���� �VjJE�k�5�t�W��ho|$W��C1��@3T�ܳ�H\ƪ�3(�C�@�t�l���v�"�H��Y��-��Գ����{��%<��@�N����S.rǴo/�kغ}?C��a[�Ǟl���sH�3��d�5Rr1ɭ�}��#�G��bZﳕ�{8'̐���^=AL�Q�Q��R���*������r罔Ud���G�C�4�+��K` ����E�I�̚KwL��V[���k�8,:^��������g>��������eF���ӉQ�;v�Wd��4�f=ź{�"�<��/�dJ�9�TCR+ve��0&�EnW��U��������[�اcz�{�ɔ���w��+������U���d�YN�]C}X���i��<?�K=�`Y�JX� ��3 u: eP����L�]���zeU�Te-My?�x���H�sOМኟ�X�2GF;Fm:��¼9F�'� �у��cz-��tڇ��T��p.�Z>Uj���q�K�7Y�Oy ���Ln��+����V[���P l9�Ě��M��H�Co�ld�%*��>��<�ZO��@���1�>���E�;�7��Fq��e��KY(\l?��b�'�DS@����& m��`���<�sU�N�'o���r߹æ�j�X�C��zy����5��kS��Of�ad�)�uC@�� 2��K��{�A<MMFl�"�����}{���6n$�u�T�ޤE��7�tʋ8s�=B)\g��$��R��뤫��i'h�0pUļg:l:1�(B��:��U�`m5�+%4�g��淍i$�h��*h�p曃v����z�������dm����c�_��|$z��}�;��vEm��0Ht��1��1?+����[���um�3bfk����yQ�R��_{�柅O��E'z��H%��C�����z���U(]�����|o�u���G,�s�]�*�Z^�S"��4�J#~���Z�F�l��+c�JJ5?���R���k�+��}��&���!���w�� ���n/rc:��R���w�+Lo��aQ��p f���|�}��V=G��i�y3�qf�������ĵ�r��ѡ=���OUQ49PVt��I/��f1�S�E��Im�����i�;[���yD$�!#k���2Y�U�hؚb�/�^?& ��L1���}�����A���k)IGGS�����H��ڨLk�'~h2l�HX�#�C���?�0�]����5���,�ֱJ�r��8�W2 ���Rì�S��"jmZM�B��ed��U���̸��m�o��B�[��O�/i@�]�b�v�e/�ʉ�?�~!�J�%5�.=)����ɩ��/�:�{,�� �A��hW��;n�|_�� ��ۨC#����H#��+�H�8���*ڂ�ɸ�����nߪS;������E�^%ކ�d��W#��-������ �u��,�2R�f7��/�^+>��h/y�$\���Z;s����òa0�A�����bn���y��fwQ��jS-�f�@�������Pz����Y-by'�������=����X�䙴S���a��癪��cG���Pt�ϹMw 1�""���2"�;��H���|>j��ͼ+�bC�f���/�X����O#7i�A��k�?S��̆�_����Y��&M�&x��k�~Gn� �� WN�##l���"�a�&����]KI�C�E�۞<��1�8����u2v.[�Ư�-M9��X�i��r��Fb���|Z�/�I�펽����U&�M�ea\5��?m_E�8Ϣ�1��b1���ة�3͐fL��lh��*Q�=�1���Fǡ�%r��P�XX���0��������m�/���mu2�����g���V��?=����+�v���N����J�.\�H��(H��h��],_F 5t�ғ�Q��DF���D?�&-d&�b��R���I�S����� �� w�^��~�q{�,G ��8O(����SP۰��\T�Z�e ^�"bcC�/�*����R�*PmqpȖ_���Y���Ł��{�Y ���(�d(�HD�O��t}K �cq�����!����{J<J�u^o>R��,A����@RDb0�0�=Fl�g�Ԭ��e�q/ ����I���d���C�TM�e��%�-{ˮ��0�&�*���ꊷgWn}v�"��H��D��d fܴdU�q����l�9��N�e�g�g31a: �E�/>�g#��%,S�bhӣ2��v�F���}�Mk-�,Y֠��FfYf����B��@�����69�I-zB�4�����X���&J:��VkDk/�9���d�:|��;$��tf9ʖB�����B����T���%��z�k'���.�R��ɤ?����,�p�[߱�������YQ���C��ȼ 9J�L��E�TT��lJ@�����4D��������藅))��"��$�XLn�A ���:�q�=�`�i��v�C_F%@��{���Ů���R�����1��ύ~�Y��g@"���YU +ew�d ���sg�gSv�=�� *$�j#�K�j����P$n\G��Y�2<�����h3�+��ݦ�i y��:=q��{��2���~�z���P?��X��"UY=����8�@��8]FTL�P��Sa9m�#O]zOpqE��.<���?lL 1obk�3]�G�����+�s�N�ٔ�T�3+�p�t�*��vӖ�8ؓJ$��pG��Q��l�.(��L��
Static task
static1
Behavioral task
behavioral1
Sample
d21a6c1cc1409031a055b6ee4fc180ab59fb7762f41bb473e0981d0a81f7382c.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
d21a6c1cc1409031a055b6ee4fc180ab59fb7762f41bb473e0981d0a81f7382c.exe
Resource
win10v2004-20240508-en
General
-
Target
d21a6c1cc1409031a055b6ee4fc180ab59fb7762f41bb473e0981d0a81f7382c
-
Size
7.1MB
-
MD5
3d5c527d19da4a3aa8ca0cbf2643d9ed
-
SHA1
746afa35ac62428edd42a8b70dc81171d4e0a88d
-
SHA256
d21a6c1cc1409031a055b6ee4fc180ab59fb7762f41bb473e0981d0a81f7382c
-
SHA512
bfc4bfc8de9d7ae4173fcd325ccfeabec1a7678735998c312ea0e7b99e49439981c6029bc9c34cc44a51e618b530ee641869ea4b5fe9abd651d1ee0a491932ae
-
SSDEEP
196608:Xk0w7oXp3nq4Qx0ofsXBrPOeQsGyr6aL/VH3tT0U:Xi83kf4rfQjyGaTbQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d21a6c1cc1409031a055b6ee4fc180ab59fb7762f41bb473e0981d0a81f7382c
Files
-
d21a6c1cc1409031a055b6ee4fc180ab59fb7762f41bb473e0981d0a81f7382c.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 828KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 334KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.???0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.???1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 92KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.enigma1 Size: 1.4MB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma2 Size: 264KB - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE