�<��V�M��9E:�@�!Fjݚ����{�V�a4�@e/�4���Y&�i���z���� �D_�'���p귃E"�������[��s�ȩU6KT��{���q'(���(�m��o>\P� J�x!= �}�Z����u�X������<�+P�¼!�[��:�����p�Ӹ]�C�������7'&-OC���7���rl�y ـ��.���j��P*�:�DL<�nIC�A�< J�K��â8���=�=D:�a�mM앚,t���[��1�(q��S2���C.�e���C�t3��re��eai ���'3�k�(}�����-�V�y$(�pB���c��E|����A�7�z ��u>g�[�n�����$�-�Q��ʳD)&ɵ�?���5^%��u����.�d�y��:I^��]���3�����m'H�i9�MT��f����$��xNXp�� ��/�&)�ʌݷ~������T4���ݡ�mCJ&�n>Pr\c��7�H��Јػ���-���렼|����]0�eod��ۡ���i��� ۚ[�w�Σx'�����CB��u1�=�ϙ���"U��1 ܩ�3�xK�A|c�a)le7���y���>��Q$rLp����?cr�L�l�}�B|��8��u��\K�\��⛙�B���� ?hF�x�eܪ�\�����ύ=Ll�Tn B{���(1M�������pós|��=�D�2vv����N5�*��&Hr�̸� V�P��d���������H���7�q�+�%�#P�I+<����a� �.�i�L ��� ����l���Q}n=0�l@}�g���Q�=��UHg���I�w(vR4"��Y|�����m�K`}��G`��uP�N#d|˔D1Jh��%��r=��ܣmS@�-AX��CCB�����"����Þ�Ge{N��e�&�Vi��w5�Y�M�c�.�:��ܸ ]�f�.�T��������<�\�P�5@��NI�WƀT�_u������<��^�:��� ��\;�x\Вn��Iv�'b("�/5W j�� �q!6v�ۤm��?�j+y�����Ed��h,��z�S�қ�)�[�n���r�nf�W\�R�O�M��v�����Tx�� ��mR��f�#$ I6@�������G���Sr�oy���C����h<0ܜ�n6��Jd���-�Vf�����(0n8���kh�Q4|�Tu��[/��Ĺ����K+�:� Fr�& ��ȅ�6L��2����N�O�����۴IPy��<7��)g�<O��L��dS��-�yw�S׳|�]g8�{�5��Uub�Z�c܄�Q���=��2[�# �4њ��f`^ԉ !&���`�pL.l�?�9� �������+ޕ�k��Y(j��a�1m2����<��Lƾ��u�~����Ѥ,<�&��kn��א5����#�#N�Y7-��5Dn�N�Ȏɂ&O��U�&�PQ�km���| ��E�/���H|w>*?h���Dy bq~`�g���)�Z��CI���!��60Zӳ15�xBk������AS����� ��Y߮`��x[�k7B���g �!�Q���Y`#j̏�� �����E��������0�ǫ�/����!6ͱm�&#�YSam��"�{��Xޏr�x���./x%�+�#-�e�wG陆Q��A�'�2Q���b*L�t#eHR��A0բ���U9��#�/�,OO*��J�t��{tƯH{���3q���R1Eg�:@�\��Ӏr VD�J���`�> �Y� {����@!�ރLaa,2�]≟�Y�[�4i���;���[}�)(�9�@V�ͣ~���a \') �Gfw��A�c�ˁ�0:.�/�I���}�E���A'�"����'3��v�k���"�e/=7.ҁ����4�R@��a$����XUu�:���� �w��4S��9��������a�}G�8l�z�$��sV��F��:� 4�a̭A�hڙa�a1 �g��83��v��}/Kme�xu��pz���jo��) �����T�Bn�-�C����P2�*i���<��������X���������рu�.�� ^?5S�*�w��ɤq�~��01�)@Ld��n��;;��� ۱�O��!?�����C��'��]��A-�;f<e��������|��rE�`>փzê��q5�Ԃ ڟ��9���Ɵ����v]�-K%H��s�6�Z|����ː�!巖�2u�4��í�r��l:p/4EJfF��3��9��5�_1[��N�\�l^�ZO�-v���xvc�F�y$XHP�j� �mP��c�'�}gDK��`G��O��{�y��}Y��1� ; +ඈb��R�"6M�<h{d=c�s�ı#�����vpĮ�� �w~���s�PG�b BO�ȸ�l��x"�I��Z�.1�H��;4S;[��$��H;�!���I��u��g�-�5uC�V�e��tQ�^x�hl}�-�j���&���� p�(4�6��h ��J?u��oL6�̮�+~|[=P�}?���]�s��9�c�#�V/n?@?�ܗ4�+��S�O��M8��3��w>)Π��?����D�ܓ�Ut]lNW�5q�F'��3���X�����J����~L<��c(��wnnB;��~��o�N�,�Ƀ������(I���jўeo�*�Kzy�,������DMw�tY0W�k��ɐ��tD0Ѩ�;��ƏEV�lS-�a]�o+��ch�/q!ݪ僖�HΦ֦@�����|.d�D��s�G�5��.Č��Z����P�T��+�������@�K^lni���6S�3�:~R�GzM)��fT�lR�-��):���᪦vK/�!4?k6�߉Kk� ���^$��%QDh�7֑�W�� b �t�e�6���哉�F)��5�S��g����1֜�g(�h��4bꑄa�W��yO#�u����&bf�g$�z�n���'��` ƨ/�ŭ6hqX��:��x�;�;��KmB��K��W$�>�R��;���E����`9�yެ�W�,(X�����)f��pmH0�\`��q B��]��G�����q���m��^Ʈ�م�;��ǖ���
Static task
static1
Behavioral task
behavioral1
Sample
78e17298dce8e52b8fc71227081c3fad4cc606fc34cdf7d68e2aef5d7fb51f5e.exe
Resource
win7-20231129-en
General
-
Target
78e17298dce8e52b8fc71227081c3fad4cc606fc34cdf7d68e2aef5d7fb51f5e
-
Size
5.8MB
-
MD5
f6c6fb65923fcfe7ab6f6f0c3e69b494
-
SHA1
8af3ba5eecd90bc8e2395979cf8a9a852ca4d4c8
-
SHA256
78e17298dce8e52b8fc71227081c3fad4cc606fc34cdf7d68e2aef5d7fb51f5e
-
SHA512
1b22f1341d024379363e25cdaf924623aabc0222fb71f30e634268818b42db631692b94ee36a2a836a5e293f91d2c00280f424bb39dc154e395cdfba1476737b
-
SSDEEP
98304:fanHy41UhVDtpso/urzoHJDjoq9Uau9ip0dSK2Y5GwluexO5Wv9:fuHyMwRsKFpDj/G9iKwKP5luexT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 78e17298dce8e52b8fc71227081c3fad4cc606fc34cdf7d68e2aef5d7fb51f5e
Files
-
78e17298dce8e52b8fc71227081c3fad4cc606fc34cdf7d68e2aef5d7fb51f5e.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
.text Size: - Virtual size: 840KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 20KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 60B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp3.50 Size: - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp3.51 Size: - Virtual size: 502KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detour Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp3.52 Size: - Virtual size: 552KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp3.53 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.enigma1 Size: 2.0MB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma2 Size: 284KB - Virtual size: 284KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE