���������#Y�<\P����iF�p��|}%�����>�j6�06�b'ço��[�>�&�]����y QjR�������a�Y�(��S|5��!L|x�� ��*Xϫ���J:A �] 7�Z}#y i��C"����'��`T>�sw�;][O*Ь1�:�0�$0+"�����X)Hb�?I��$�ź�ƃvc�U�b�� ��~F�SR�T�H��ҠDU�P����ρwx�"�i_��)�/���IU�r����/�T��Z�\�֗�f���˄��O��cd���ŵM[C,�ils���P�/e������)Rc6�K�=(1+o{�&�+�o�ҙ�3Ib��M����?����`/(�97�qԝ�8�^&��mY��%��G"�3��豖)(?e��"�l^U�q�^��Xq�;N��^��?]�i"w{��nL@_ʻ��(D����qL�8ޛ\�f���rv"�H������U�jc"(��}�^�g��ˎ���2���?vO���=s���}��C�|���Nv`�,����o�ȉ�צܠ��ԓ�^�$�<������������c~��Ɵ^ʟ��M�;f/�d���c.YpG�����%:)��6:��LďTM�������EӁsҸVJ'�����y�n>���ۄ�5��2�maя��=t1�|d�`\x�$r���+�ID�i;X��|@ִ��O��@��%� j����Яo ���d�b�릕e�3�E��<���8�j?�M���������!�5!G�' �������Q�����/0�oݼ�����@����d �l�/�~�W`��3NGG�/K��-��l�`�B"͜�����q�&�;(��gܑ�@�֞�K u��2"��0���8���0��4Hو�t&f �x�So�Y��}�$��g�e9���Y��v2���?��r���r���g4{�&0��v|"�h)xhG�It���q�#>����j���^�N-/���+��{wF�dJJN+Na���Ʈ@SCFK�{��<���~X�;���4�,��>p����3<b�h%ɮ�Ŝ�7zu�͚�R��~t�EX`�7xEQ}T�8H�L�1->$~KdTK�,���t3�!�����'�i�8�H�5;^�2�s�u�ʋy��h��f������ ��y���P�K��'����������;�M�����8;n���թ����Y�R�����N���N���٤��c�K�+�Mɘ���1�I"jI����p��n������u��4�4���� )���f�������M�������\v�8�f�P�<�(2x ���r�Ld��E�FЅxiP�0�r�ؑ����W¢���Ȝ:��4k�*v�,���Pkʊ�un�-|� H�Z��X����5��%��2�}ڳ�����Y��T�|�U���HJi��m�����W�ڀH���>�4�d���5��ׂn���&�f�b׀{';����/a]�� ՞G�yv�8�D���$Tz��~�v�fyq)���,��; �:�wҞ���7v-\j#1=#^a�M/ "�H�B1��A��"-�[�]y�$TJ���_���DC�y�(/z�����s�"�]#���.�/�M8m���!�q�� ����p������6�s��2Dg����Y�y��jq�%RF�YvgG��´�7��c\D���d i�N��S�}�|\��Cz���P�u��ָ�wj����� O܋z�>;H��uӘ�5�r�� D�QL�;b��[�����-�h��_?9^j1�s8B>���)���{e�pKa��� ,����MԔ*Tx��@��X����4¬��o�l@:����)~^�&�Q��\4m4 mn�z�ÔU��'��c�����$������쥯sr@ij:h�8.�����[I�n̜D��!-�Y��r�.��!����陵�,W:H������[���u���4g�-�Ce)<��������d��V~$jя�t#�:9�-=n㶱W�!�N�d�Ȍ���\��3��l�F��|vۡ�w�{.]��l���M�u:IH�N�,��i�Ts���F�ϕZ��!�ż:��"�+w�*J���`�zz˩���L�ej!}�v��olR�`�NJJRpLh���e]L0��Ν�*Kq�;�ּ�5}r������-V]_Ϯ�k� Ñ#4pfN��e�l.��J7�ڱK���rz��{`�"x�yfYPth�![v-_r렣��\�"�`E� WC�S���4�O�H �֫��������o$-oy�MOPY�Z�6�P�.c�X>�* X�l\���J?���iQtt�N@�j�j�K}b�(ܾ��ͷxk�??U�����4���Ӥ�x��<2����I�R�1#���5�i�X���k�����4�ޞ�Jܝ�Z%�(u�jܵn ���t����b�` V>xh��L����Wn�F�V�T2�C�6�F~��� �{L@h/�N��@�AE���mD���� ��_���u ���a�MЬ��Jb�lAO���JX��~ \E+��q�>��� ]['b ��w�3�E�b �vXO�}v!�}|�&���H�S���j^k�[�K�(;fg���j�;(��,�N�d�:2��]'���ֹ�+��O���n�]�x*zV%������7�]5l��XX�������)j�A�\o���o+��$�� 3�G����SZ��0��:}�kW$�¥\D릳�g��eS3�鈅�.I����c�.���C���T�mb���7D,7o>�'��=���Pt��o�˞���z��el���7q��s%�� )���1���H"J��$ z�<Y�9�@�3I(t���:����`͛V~�Q�YN��U�: ��U[�$ P�n/�"�*ܮ[6 ����Q��̯�Y��C���Ln����9hB��h���4�X��CQ|���ف�f$8�"w��<ş?)��$<���T]���3Zq+�.���N�}����t}���XS�B�� 〸����cQ�Ә������m�)f0�lQD&����7��;< ��1�@�ObwujAh��~gO��x� k�3S��m�{�Ni¼ TH�5�C;,�R��q;T40���X}}��b/%%�Q�yO���`�o�K<&��Wl�T�x��gcw͵� ���@��k��BI���f� �q8K1+y�J��&����������ߚ>ZY�!��ΠjVl�N-֒���H�-��]��/�3Ə-.�x�!�>!�ܣ��yv��gΦޙm����6]�
Static task
static1
Behavioral task
behavioral1
Sample
c42abc84c5714a9dd51a60f70febc22465808a3f5d58a58df554ecc3e94afb8c.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
c42abc84c5714a9dd51a60f70febc22465808a3f5d58a58df554ecc3e94afb8c.exe
Resource
win10v2004-20240226-en
General
-
Target
c42abc84c5714a9dd51a60f70febc22465808a3f5d58a58df554ecc3e94afb8c
-
Size
4.6MB
-
MD5
b57a079a95af30047e609ca02bf92095
-
SHA1
7ba69db2f0d46d490ba42ed404a004ca2c7a26b7
-
SHA256
c42abc84c5714a9dd51a60f70febc22465808a3f5d58a58df554ecc3e94afb8c
-
SHA512
f775e3c5b4c92e006d3e51c4a08c4474a331bc39c8916c403bd083324c602cf16c3bf5ab7fbcaf3190a80149ad60ca5038c41d9308dd97f6d19c3be9ce43a577
-
SSDEEP
98304:dcJiG5OX30KGqBsnm97J1n/H+C05bR5QBYMyYyOYNuq9LjscqK:WiG8H0Kjim9H/HDmMBEFZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c42abc84c5714a9dd51a60f70febc22465808a3f5d58a58df554ecc3e94afb8c
Files
-
c42abc84c5714a9dd51a60f70febc22465808a3f5d58a58df554ecc3e94afb8c.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 72KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 597KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
main.pyc