F���*�'�r:�>nl^JfV�#ι���U�^��Z�5��_�������sF܇=�����95�2�V/6�`FLU���9Ȱ�+��Lָz}�U[��S�_��g|�@��aû�Kk�s�=�:}��ӛBCn�Y�e���p.,�3b)�f��8�D�J�����U2�V,ДPP�����E�y�\�ϿN&���F�����K2���� �~'JI7ssG���w��.T���7v��K%7���7����B��_I���Z `�\i=��:.���=^YQ ��Ri)^7i� ?0])����A�)@�@S�^LOL��+[�F��y�ugV��L&7���[�V�F!I�]��Z�=ŬO��O�;\��^VY&��0OG ��ϭ��O����^���M��T՞�rd7�^&���E�P��P�"�x���vh�9��d��uR�2��%�+N�ʾ��t��9I������9�tG�$�{�M"��4��lc#�=zO�~�6o֝�_��=��A����W�G�4�0; ��A�Rr���▭��{0|/�uC)�oi3��0nx�P��G-����(i�����/B]ǰ-T):l�����Zޑ��&���'A�@�r���pÄ@5�bmN� �_L\���b�!3�t�Ǜ���Ys�X6D�����T%��G2Kx�4Cp�Ɋ2�� �֢�_`&���2gz.�%�7AI&��(a�,>�����Y���^rE�y��W�����:���3����"&�P�N�L��S�<�y"�a*�a�c���4�!9n�0�@�7J��gX2E�����&0�@�8 st\�G�����|m��O6�D�u);3��3�n4�ln�fn�ۯ�'�ArRn��w>k�O>�N'clzd��d 0C�p��l����;� �sq��Gi ���Q*R�lq�ށԂ�_�&�[�v� ����W(2�b��[3�w��8�]�R7q�Z���)�V�C@v��;-q�<��,䟭��-C(��b���P=�,"��8nYU�| b=�.�]X\J�y}.�;��6���·u���"��(_�1ӉNt�9\$i�1��r�آi�Chu{�:�Wo;'�< ���@�Fhڗ�1�T�"O�1ބ��͵W�HsǨ� �tw����g���ۇp�jZ����\Ģ�=ӎC�6i(�Xf���2m�u�k����Q[N�~��7gt)�-S�jSR����3^{����>��-��}X��<�ޖ�ĪF#Әl�"�L�N�L�WC �b�>�q���@V9ɛ�4�uT�հ�5����6]�XT��'ʹoy�է�T�qa�g�����)y#x�� �6?E�q���Nd�/ ] S�0��pU�f�yZ�� ~�vC�i�r.��fqQ���|��q���Dg�D3������#�����R�������V�4�̪���x"����)�=�N��i3�3ftEy��ił5�h>�B�hIǣ \Y^�J�F4�:�s�6o�0.V2���& f�ĚO��W�s���N� {+�����f0�m*�1"o��"7���%`��5��&���**��/~�+�j�unh:����� q|b��z�O�R(�%?4/N�"\ޮT�M(�Z��-ԂD��}�����0�A��g#1Wq1�O�N�=��brA>μr��8�,m���c�k�R�I6i���>�j\����[�#�^��k���컴��5�Faq� [�'l�v�}_FF�_>H�b��]���J-�NP8�Ⅺ[l������5ENX�V鸮�r�������[澱��K�b�x�J�w::B����l(�a4T�!�|qjR�g+kݖK'�0[����C/�xh�!rIr0��!n�ql"w9}1�@;��0��J��4��"��Ġl8�k���兪Ւ��B�����O٠�\:�����ǯt)���c�c�ԥЎߴ}����ǁ 3�="a\��Xud��Ƣi�a% �����ϩ�~��Z�N�qC�)�@.C\�z�y>Y�e�=��Xm�Õ��Af@O�Y,���G��Մ�]��u�ұ��Jxɸ�=�b��A�Z%+o��~at��r�A�;/4�� "F��?�qռ.��>+ @%�ƜG��y�Q�볥K������#0��^t�U?F��d��)L��ȸ���\�qt���/#ɓޭڇ�|��Ԧ�~�-�w�#n%�0��Br`���Ǣ�onrI�"�7A����[��~��=�4� *�.���a����~UA��1�ҥ{w�J�;������`�3Qs:�"[ڐp��YVœ�R��j������`��pB���B�7��eg70.�n�p��LgEHA�h�7aA�x%F�z��h�z�����n#m�E>(T���zN��hs�C_�:����0,S������W&)����Z}e��R���L�/��#XAϲ��lhU��u���h{����^]V�_�ʸ�D�!���ӷ��p�(2}��[+"�j���������Yv.OP��g�uf����QI.\����a3A2� N�H&]�AiCG잗;����<��+�WRU��<��9�� Ze�h�`��j�<Ӹ]����\z`����y���!��K*GGs&�_P��n7���T�Db�����i[�V��S�Wױ�~�H]Y�*�v���r<-��3����9f�R��n(�G��ȮpD�`d��eٱn%{ncwh��)9�7niXW�(���Cw������t,�5�OE�i����%�+0vc��u*�Q�j �^YL@Z�>a��:>ބ�^�hd��۲����S�ٔ��$"�!��,� �S\fKnb��߀"PgG��V��W7>#7J�$7En��W)���Š��Iצ��#�q� �3����U����A�:L��b�z��~ "Ԣz[��|�3H� 0�g�0c�d���W2�U��/窤����9��-�|�l<`�[��;UPi������B�A�\�<t�F�_��� ob��8�g��i(�d�O�Kf��q���E<"�E@� D߭<C�k��%�9N)���')���ÃҐ;��H���CpF�URv����2����E/wC'R�����@ge���h�#�IlB�� R�+w#�->M6�-iȖG��L�ܰfI�O�3*��J�#�މ����^��������2D�3�>ĨhoX�wX�i���w�e-o�������E6��+U�f�N��Y05�(�(��J��周`�J�yK��o����i�f���`��Xϗ�fOl �*�����剉�Br�.��}"�+I�ǘT}����E*�.��x���\�1g���(S�E�!5p���c'&I�������v�Z��� V߸VN�d��)����YW��֧d*�[��v�����V}��>�Rbu+;�6�W�"D�l����0d�)� n��MG��� �?e��j��q��`�L��V��ZT����v ɣ�J�
Static task
static1
Behavioral task
behavioral1
Sample
53bb64ef46c80eaeebd72758584a7af11b213e7314af8f9680f4193fe63dde85.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
53bb64ef46c80eaeebd72758584a7af11b213e7314af8f9680f4193fe63dde85.exe
Resource
win10-20240404-en
General
-
Target
53bb64ef46c80eaeebd72758584a7af11b213e7314af8f9680f4193fe63dde85
-
Size
3.0MB
-
MD5
cb0ac8b7910532033cef306667de118e
-
SHA1
3fa809712030057dbbfc020b6b6c796cfa95edbd
-
SHA256
53bb64ef46c80eaeebd72758584a7af11b213e7314af8f9680f4193fe63dde85
-
SHA512
c7ff187af3785fcdfce6f7631785e34dbe8a9d79007c3b53968fd1d575bbf568024e52215fb82dc93fcc2f843deae0a705044e5aeacfbcaa3d033f57671ec843
-
SSDEEP
49152:IN9icHi3mWWbAGMkqtEmharUfmYNwy6ca8EeUItWizNIan8fprWfyAXqosgyOA1c:tmJZbRmhdfmYNzRJTGan8fprUy9Okc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 53bb64ef46c80eaeebd72758584a7af11b213e7314af8f9680f4193fe63dde85
Files
-
53bb64ef46c80eaeebd72758584a7af11b213e7314af8f9680f4193fe63dde85.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE