$Y7����Ԫ���TF��� _P��"�����ѱ�)�����B���ж�ciT Xq�?���ر��.���j�ld�4�d�I��w^tt�Nk�=�2����FjQ�,�ڨ�I�J���4����{_�9w�#�O��Į��!Jv�_�p�J��_ �<�������[!1�~4]�+X%A�7ᠫ��B�ы�?hy'�d�!�K`�C�xS |�UUvV�!qT�����������������v��pt℺xB���0Т��1�u���}Ew���a��#G��4�v�_�5hGc���7�������z��������[K٫`�����0�ao�0;�jor��Y���ur���@j�7�+9>_<0���!$u>B�u�QS���T�~�%��f`��T̿V�ه��<>�A��oO�[�s�@b8�>v��1?<SV����V����l��[ ;`� ��Rt���wtf�5>4�Ć ;c-�o��E���E�I6c� �&$CH2Xd]�)jq�35P�1�����W�"\����O��z@�_H�,��j�5yRh=8|i�$�x�GX����=}|�3 ����.���� ����d)Q�Y�:t��^��5�_�'��L����Lv��+`��.�%����n]�7SJziv�>*�y L`\g&!��7����)�����q_�������S���9[�*���N�BH�B���e�c|[��a�A�V)�lQ���k4�EA{�]!6�)t�=���5�QE�A�~�rb ������6�YQ�F'��˟2����7kd"'1��/]�!ٲ8*���cxB�~���Z�fMZD��+{{���Oj�I�uϵ�Z��e��X�S�Y�0��yH�s��I�3$Ci��[+����Q����]��m�x����G��HW��M����y���ʗ��nO�>��������M@wǢ���wU|�f��XѤ��b^�h�DڂL��{����� �W��ۗR�I���x�' Y r��/�5*� �CSɚ����!��z�fΡ��45 ��.֘�.q-����@3�ִ���L���|&1("e��u�����ձ(46�..� �H����~^�;r��60�M����n*�`��(�ǿ���<R��?,�O�?��0c ��&������YV�s�a�B�R�G߿��DVD�cy�C�=,���z39�w�B�)F�]��W|�����n��9��e�_"����n�q#�ok�tln|?�f�w�Ǚ�Թ癜J���A�K&��p��Ư7�i-c��/U��� ��<�cY X����0��\�rA ���s�������-����u�q��H���{^S� ���;��j?��SgI�@���Q�ձ�O���;P4�e 6�;��&&�(�i�ޛ2���� Å*CQm��s���ʑ�? ���$q���mښ&���B�\��^?\���p܍�0O�:.�/�}�<�P����r�a�~B�/�^=�.|f�W�Z�#iO�{`_=߸7_Ro?c.F�9����=$M���%�@�9�����$G��T���N�H(�����RI�p��+÷a�@hh];0�r�B|�'L3�q2�&�<��q�h��Ֆ*'B�vd�T�z�4�2����>�����k�i����ʥ-?jV���� [8-��g0����L' �����:e1���Տ8"��hמ��]��~�GL��ݲ��Dӯf]Ϭ)Uك�D&�iN��-4'WT2� �T�FF���_�(�G<*}p�%�S;��v����r>c��P�t?M�Q�*zږ��ӣ�1��ĪL�[Dv�r���J#�Bi��a�L�d�����)d�JZ���p`�Z�hd�=Y�Z��Z�s0��c��vt�����)�arN�4|��?e�zZڍ���zCO"�+�x��:�.+ l������3�U\j�'���:irYFKD�Z�� I%�e'��(��7T���H�:6T��0v��,���cr@'��[|���I����E䣰�ћ�gw�oz�9[��T�� ~�=O�F3�<��N ����`�����o�A͕uj5����b>'tx � �"�5��xe�̘I�@=Uij�y��.���o�{�'u�~��kw�b~1��uv)��[��%MR���G^���W�,�M�����P��H�^��B�*m(��w����%�O����._bW~�- a�h� ���qH�^/�]��^@���P{$�u�_�|)�!~��}O�y`+a���pM64��"m�����"�%�ٮ�HS��AW���U g�m�N@�$�~����u�0�uyk,��l7�*s�ʤ~E_�,!�{wT^������<\dN�Kd�g>��ǃo������.�_iwR���MExfL�NY~~���Ԛk��p�l���G����lX9�P�^$��QǑ+�����^�4�5����X��iZ%F(5Ru��u�>�U.O���Zx���=�_��Q��쟯᱂:�h6��bM��\��o�0k�s��^4t��:O�a*� �J�Q��ӟ] p�]�}�>��r5a�!�l�&쳟M��� �z�o�zE��>n�=���.��d������ �k-\�[�*��˴�+�kYHN_�����3��%Į��=0��ՉrOŹ�x�;��9�c����5��(�6�v�F��������ڬ ����fpu3�P����do���Q����@ıA��� -V�3���㓐3�)��2c���_B�L�������H(��t�ć%{hgH�V�b�������Kc:� �:�o:��0H�9�RX�D��k�x��GPSq�M���x��h�F�)�>Y���y�j�&����$��o�Teӳ1kM��y�oXR���|K���T�%(z���+�Ť��:���fI������<�0���+����c5ӍZΛ�<Yh�p��7^���*G�[#�@�\`N'����%*�w3a��8W#�gY&6�z�Ƭ#���3�{���J��@��q�H��I"s�iQw#�����ʩ?Ɇ�Yu�X�C{�̭'A@���F��WN LY�B1���t�M�o@��K�� �W��ь���RS�{2`�p'���R%<V2s��nj�Y��9��B&�kc4��ԣ�ƽ�$F3M��OE��� bb��thJӉh_�=�����d5����d�X��n��Fȫg�3=���Np�����<��p�0��P*۞�Z��0}�S�{��GYoSU�j��~# ��p$�x Uu)F0������N"�����E)P�C<���1�Ӷ��Qa����nX'}�x~ ��LSA��uģ�'���9��^�=rnй��1@�[�$C��L�7/�FE��#��s'Y�!m@$uϘ��bzX}�I���d�6v{�ϟ����3�ഭ=u�vkB�S1I�#`Qz��ea�q��N����|�Pr���J@��!3%�@���UkvP��K(2�v�h#�M(?�&<�/���'ͧ�n�T�njtw�B��!��6�V� �%qt���bR#[�(��q�*����#��}/����A̋���X�֏:(�XWsKqi�����ˍ���돘j��tv�
Static task
static1
Behavioral task
behavioral1
Sample
e7897d389e04ca0c48c0a50fd3735f25db707526d3f773a4fa9772a383585633.exe
Resource
win7-20240508-en
General
-
Target
e7897d389e04ca0c48c0a50fd3735f25db707526d3f773a4fa9772a383585633
-
Size
3.1MB
-
MD5
d41e94049123f298ad8d6635b1b423c8
-
SHA1
895cc4504f96726bd5335c66add03f8ae1124c98
-
SHA256
e7897d389e04ca0c48c0a50fd3735f25db707526d3f773a4fa9772a383585633
-
SHA512
d531363e1dd2faf98a52ececc8a0ec044931f0dfc8a7e10802b6bd6963a6efb1a1607a7cbb41fd00db5b38333269e69d9d5e0b749bcaf396f9d310b7a94f14f1
-
SSDEEP
49152:qGppQm7AuFaNKpIIiozEwZSipeFSDEQcHx64eOc/pCnuw8v23BpYQBTzvq5u:qspSypIA3rktQedeOc/pI8yBNB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e7897d389e04ca0c48c0a50fd3735f25db707526d3f773a4fa9772a383585633
Files
-
e7897d389e04ca0c48c0a50fd3735f25db707526d3f773a4fa9772a383585633.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE