9�=��p��V����^���5�4n��o���m^ȫ����$-��GZ�/���P\*(bQ���&��db�|D1�XXdV� ��Ҡm��p�9"p=� �-K?7�<:��œ�?/8�8��Q�츫_y�9�0=.ds=�SKy�>�E@2��gf��q,z����!j�\:��/ x;JHZ�F�0�]}�\z��>�vrd�Oi���B������l5E��� k4FTY�P���PDۊJiNߊ�]�O\�%=��M� �D��� K`���D�3�i�`0'q�H�/ ��BpOP!��j���)s ��0����z���Ft�ݣ\��},MT�U-K�a�K��~~:M�A�ɡ�������2�Ď �+�.D���7ћ|e�}�-��s*�\F�=whbdFԊ�9���w�E�2����������@�.���;LԵ�V���cb㹹����� �1��3��x�{��U�m;}�� n�\9�B���� �S���>e#�":��6����d�� �����gueԵ,���Sk|��r(��|�Ce�� L_�`���F�n����7GIf�,��T8y?�)���:]�Y���aW��dN�Ǫm4v�eR�ξ���}�e��ݿo��2����c����o����� �t��m��]I�1��ȦA|����LG��'`&��o�hB�����@&���/������ԗw����S�&�)!`]�� �����q M<50+�K�����Q@�-^w�!���6W������](�;&��f��8� �)?mW�j.�]��>��^�6W���(�`�ڮ�,m������;%��X4r�[�w<;&��d5eX��7�h�� ��4� R��!��Z��W|<J'��8W3�ok���,�`�䯿�)�*\�p����]KZ�����'�֥d��{.����߇���3���;�]�����(8���K�8�S}��T� ŭ���;�k��O������`.�Ż�&5� �r�er3�A4I@��k��&켿�o2�T�\1/F�V(��x[�;�����I���Rىk�VG��0Vm�������'_�C�v�<1|ԛ�J�X�OpF�U�*(���?�F�"rr�L��1o�2JԓT'��,�w������������[�����C�Av��� ��` �v�T�nqO��8���e����|wC�G�b� B�~yE�M���&4�� ����1*��t8˺�"�e�6oJ��;SZ�� �Q�&}w��ZHa� J(F����ʽ�ֈpVN��g���(X����koX��J\+璝�{�")n�ښ�����]�����^�X�������8<{|��Ah- +�f��M�3��U���B T�(5��T��^d5�\`�����w(�s�� RE�^�>��)�6�\�IF?bӅB�%KA�?�žӧ��?�H������B��Z���"���@ĒC*��a��}��F��!��4�W+i�AѼ�}|�]�l�K����-j`h���kC���pe~<�K�����3?�E>��������Snc���p�L\!���'i�������oj��v�(=�ߤ��{bu��qO<i�����8UG��xR���J�U��DG�@���5Ԁa��� �zw~�t�$�6?1��އfJ ��ZZ�V�@\䍘dL��2��XGC,7d��Ԁ�^6�Cr��`�p�$NVȣY�p�{w�d�?�R�m��xW�krL��N�.%��#�+��y���>$߾o;~�wzǙt�Cx4��Ap����"�=����<���(�Ov�_1�{%*Az��^��)���G���/Q����!�f���吊���+��7��3^v�aD��~^'?��a�̕����z��;� iA�\�2��+C:f�O[�̽<������e���������tߖmi�6�=����U�]M O�oز��I�n��1��HZ�v�"�;�tEA�l6�v[N����7C��&���*������ր��Z�3�d1���R�-D���2?��H��b��c� 7���YPdF�ʭ~${\?H�4�NB1�ݑ��*�]/��7�T���/ ���[�D%)��i��p~f����SaI�#���_�H1��{�8�>a�*��[ �If�Vg���X>�处a�FH&rŎ+���eJ��IJ�&k��h��ӛ�;�5F��'nd �g�a�RdEm�q ��N��N�Dbr��$��YK�FB�h������5���_g�)�_��h��qd�������� ej�b�?����@��E �t.Z%��OY{����#����o��@���B��{��H�I�l�IQ9�c��:�A, s�j����ܰ2�T1������,,Cg��p�#��CffQ�s��l��� ��6�N�p����K�0�4���VNL{I��/��< ��ze�LL��Fb�*/�aJ��t��� w�Ig4G�H״�.��v�j� ��!������B �-,Q��YU�%� �=����,�A�]�"CL�nu�Ik�G7���T�ۏ�??��8=گ��~���@ʚ-l��q.�F��\��]Pd�L�*Fq�jAy[i���|T)�(��� �8�����oo���k/[,i0"����螰V'��q��=���E��,��X9���m�4;l�u�0UY�G��7���sqt ;XV-8��$�"�x�o(x��0��C�NB��������G�j������V����5�(��D�#U����4�Ʃ�|~��rQ�!]|o��,�DZ�� �c���˱V�L���\2��E�"'FB����(��OwX�M� ]9� �� W��ƾ��e���s}|�D�'c m�F�hN瑬!�u��~+�|kϟ"�D�����z0w�pA��L�Ο[R��\�,j�*�������ѱ����.��S$�6��-z�eD�{�*Y�Ra���K1U� r��C$J;���I�G�B�f��Jʃ��:T�Iv�Ti���Ԏg��ԇ���ޭ���l�"�1���b�����!��p�۩n��s+9�A��iT�pg���Q, s�����36�zvs�H�y���Irr�KUhG>N����^S2B���1W�i��F*n���;Mv^_|PR���kbqj�M���^�={��%x���LS�L��h,���=L�Bd �^�/���,q��O���t�9�5NF,�B���D}XK�$,~�Q���g0#c��gX9��.?sS��_�(p(����?���'ո��B�hl��P�seNA��M�EK�^�:��="�� =-@��.��4��%�����̹�~�[\}��6t0\$�;xW�>I���.���A
Static task
static1
Behavioral task
behavioral1
Sample
112ab3eea1e4f0df4c77c681df54a3b21fbc931170a77d01808d3aa8293a47b6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
112ab3eea1e4f0df4c77c681df54a3b21fbc931170a77d01808d3aa8293a47b6.exe
Resource
win10v2004-20240508-en
General
-
Target
112ab3eea1e4f0df4c77c681df54a3b21fbc931170a77d01808d3aa8293a47b6
-
Size
3.5MB
-
MD5
3ea8739a08d45dcf1e78959370fc1944
-
SHA1
200f960cf894bbfb988850f722cdc302267e71e4
-
SHA256
112ab3eea1e4f0df4c77c681df54a3b21fbc931170a77d01808d3aa8293a47b6
-
SHA512
92e8177d3058a0db3e8b6eaa0da9cc74c9cd3751bd02a2580979e1b546894d3ac4b124ab15e04c3ce9801d623e79bfd2ac4342abc6a157dbc33e57a102e4e79f
-
SSDEEP
98304:BsdesF7Hs57Z0Ph9ZECpEPdkbxDNn79Gl76C6luou:Bst7Hs57Z0PbZECMa79Gd96Lu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 112ab3eea1e4f0df4c77c681df54a3b21fbc931170a77d01808d3aa8293a47b6
Files
-
112ab3eea1e4f0df4c77c681df54a3b21fbc931170a77d01808d3aa8293a47b6.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 424KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 804KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 28KB - Virtual size: 348KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE