��Z�}&���^I���{��p,���0�W��B���L#�M/��nx����ZG�h'/�n���^v�w|������]j_1w)���à��U���mj��L��ñ#�V����Pi��Z��K��{���b��� ��ن��8��f�&�v3=���;f�/DN���_��C�g�'4<<F=�_���r �v�Ü��e7���5�����l� ��q�W�'+��9J$���� ��%l�P��yE��h�!�}4�-�� �����<�$o�F�����f�r���%������� �x;��_�N�3�t��f=�]y6��_齰6���q�G-C_���?�QS��:����Ic��/6ߔ��,0�"Ќ��uk��d� v���������u�w��f��8S�/Λ��'��[$��,�GS.4�$�֍�ƿ��@�U���M�y����S��w�������Jz�h�S�%'s�b����p�.���kIO4D������$t5�lwsÉ���%z}g�J+�p��ҟm"�*�)zl2���#���5u����$$�$D��d�Tk������fHg ���r0����y���� �<@��<�$"�pv��^��ƚ��)� Zo�!ض�W�c�`�4݇�A���('�[��dj܋�!� [��SHIk�N� Ǟ&�/N���1H��O����i�����o��G/�����j������w��QM����(��L��p����S��3��%a�C�-)՚gl��-e�g�TIL�Y��e��g'*PCG���αr�n�e��Q�� 2�xo��-��`�:U�;�dӋ\���P��+QxJ@&6b�ЩE=�vC�a�w'�M�0�Յd�#N���,�^�25m\6Zy��M��2�O�S߷���0�ְvF���V����y$�]bt �pO�b��Y�W���B�}��q�7l����vX]}��X�4��ᜏ@*e�"�Kx�x:����h��V++����ϝ=��[P\�b����MR� h����8�ANUބ��B���*�o~Q�5������������S�Ohn;o��N����W�������v���"C|7҅�;��tT�X n����{�k�CN@��CX4�ϭp�8f�@ b��Ԅ8��sܖ�WT+�B<g9��wLj�J0������Xg�5���(llJ��h�)����p&�z��w5�}�5,��t��7d��n�vL��uP�2�*�,������j,�1��OG�����E-��q����\o9m9;h,�\G��Uh��x�S�6�Y֠"߀jm����+-��=m��}N��ֳ�?erh��~��΅�Z~yR�G3�����)"̿��{�K�ڽ�)���D���4��_&Y��ݸ�[��@�.����{��L�욂���^�{�m� %��?�����I�km*41�X��pf;;�@�>�a�%1�ܜT��v�s%'4l��"��cE�_�1��H��7n鱘�/g��Ys留��L[ᙝ9��gT�D�x��D��.��1��VBc�����#>��\�;KoDC�b�9���k�H������E����<6Ɯ�."��в��('l�9��}�M�L5��/��M��.9S��?��H �8�t�Q��)5 ҁ�����pX�r���\���3.�(U�P7J\<��zy��������K;�{r��<�U2+J��x�8zꮝ�?G���M[��K�:����)�D��'E)'���"9��R�����lH��d&6K��b��<O� ���=2����v���C#Vws�q�m�3�^���/�*&k?I{!%W�3'��(to�==5;���T�uOy�|�i���r ��a�4|JO[6�f��WP�j��n��=����'@�U�_�����2��?~Ň���wG8g�Ga㠀����AV~�|�'�k�$B[���o�)���Dt���B3��Ps�����Xm�������NʳFxY���p�֚��k�V�:��c�Hr�n�Y�N%��q|Ĉ,7��6�w4E�&� f@~�D3q]`�W��/�0깔�x��_�w�&�"4 �Dk~�ɢ��5JTU0ɠ��?b��{�F��k/߉�&k���{�Ȣ~�~G����+6Z�6��E��I@��:{%��N�V ZSa�`y�Al�ځ��D�q�u�k��/�te�d4U�X�U�jP'�.] 2�ȣe�,U�Q�N��v��`�dx�؆(� T\�q��x��P�E�]�b�����yp ���9�l�:�7�}~V��;%���д�����Uͅ��.LqG;"��;J_���THn� ��:t�]������n��t�p!� @�;��n���sD�U�/��%n�+���;lxt�x�f郼�"�(�[!��:���@������#��fM��C����B�~�6��[�2��gq�a���L�2 fr[����ʌ*�pwzg�_�#�4�lM�(42v����;w=p=Kʓ�4y-=�/��Z��2_y�w�}�vgP'@A�Ok}�vq�� \ |=R�����>����u�8D�eB[�'�^�\KoT� OC�kG�K����-f]�����o��ћn�'�n�I���o�� �*��e��4���[�T�l���-7�T+3j�R�7L�9�k�Ltwݰ���d`�zb�Z�|��eC��o/��\5)����!��RB�L�u�?�}-���Zs��R�pt��=P@Qg�H� ~b�����f���68�X��1�|��%�`���+#,Fs���Onwf��&p��!t�mHO�l�.]���HkA'a�%�\p��,��l�����9�s|���*�-0F���E>��|яiT)���Gϻ���|]���]� �n�g}.������fv��� 0h��0��"��)������V��%UD��.+�����-/X9�Ki���2���&��O���]&�?��4NYL�}�ͯ��t`�]�P�o����'郺���Ù�>�Sq[���¯fa�"�P��YU�1t��{ѹ����0�Iz���/E� z��vy㖤���M *�s1\���jO���������,n>�:t�Y��PR�a,H��M��j�W�A�E;6�����l;���)e��E������2(��}|�<�����S��?�s�w35�ɴ�l �� ��&�TQ���1����Z��aTD� �Cڀ���?]���48+a ��rӵ���؝��k(������S�P��P?�A�^In�� �.�?��( �,� BK2��ox[F�G����ZH��J��y̘� �C�� ����R��z��!�v���~}:>(���c���Si ,������m�ޮ��!KM���Ϳj�L�eגz��x�?p�g7��.�����Ͱ���C<� ��b�����Hji�,�紃y���c]��P�,��CET^�.Z���`� � h�����A��{t����]�ŝ�8�6U��Ǿ�O
Static task
static1
Behavioral task
behavioral1
Sample
85a28c644b862d4c1ff099e398259723e45f2b1e12b24498d23d5cce01ac5cc4.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
85a28c644b862d4c1ff099e398259723e45f2b1e12b24498d23d5cce01ac5cc4.exe
Resource
win10-20240404-en
General
-
Target
85a28c644b862d4c1ff099e398259723e45f2b1e12b24498d23d5cce01ac5cc4
-
Size
2.9MB
-
MD5
b6c779afd7db7337091fc7fa9d1a1961
-
SHA1
9d9f871af3602e23aeb36e30115abcfafbb8906c
-
SHA256
85a28c644b862d4c1ff099e398259723e45f2b1e12b24498d23d5cce01ac5cc4
-
SHA512
b88d317220142afcb40efe3aa358fc290fb2f2185433f961388f346f5913c9c0811b94df66e31a7fbc0fa04bad5e4ab49b449be2f0da5b2f5a0f9b7a34207599
-
SSDEEP
49152:w0Xipx3nay9fyqUszinb/KwmyLbWcLMZ8y/6jpBvtaRdGOasBf2EyNcjsdCHGyLa:Ynay9//+biw8cL48y/gMvbpvyNaAEL8T
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 85a28c644b862d4c1ff099e398259723e45f2b1e12b24498d23d5cce01ac5cc4
Files
-
85a28c644b862d4c1ff099e398259723e45f2b1e12b24498d23d5cce01ac5cc4.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE