� {��0�J=���wXy����R��vH:Ʋ#�e�t�7��j������Թ�5e\��mXQp�d��4���d�m;t�F:�`8�$�i�p��*���9⸼��p�<G�Y�4T���kx��qњm�So�%�*<oż��΅�V�C�9l��<�8S����KU���М��TԚd����3�d{�f��S<�'z�"r_�4d?�r�)�~���rDd�>�N�Xq]�(M`Qe���[� �5.K�V.>+�4��=7 U�r �x@z�S1襍���,&�����Q��@��eJ�Ѕ���%R����;��k�������[��1��h)c|da�� ���+�G�`���<�ʽ�v���d[]z�N�MP�1� �/��1��������T�iY���k4�v�����.�sqw��(N'J�R�crl���BE�j�(�x>��l^#8��xsZ�?a����ԿW[�|��C ��JX�o���3ח��sm��J�|%��W�n�Bg�b^�T��PH:�|b̷3���p'�=�@s�1��%d��V�=���Vb���G>� ��I%���E-�In�l��j%�%j���6��Ls���G�lETї$�b��$���bn��X�P��m�Ϙ���i�ع,9�bNޢ����v�/�2訜Cf$������*��8�iV�������̮�6j"��v�s�œ�����FR�_/���͎� �W�LZ͋��֡ER����!���8�J�UL�*"��dQv#N����,jŶ̶Nm��"��O�:�����\��\\�����x��%O�륫K#�z�ɒ��{�Y������ �����"wo��^$�V:�_8�r���{ �.N��0�N�f�:��߂n�,�U1S���*ȝ�3i��l *�~(������mW���F���y_�F���i�i�γ����!ڟ�k7,/����4�D\Rb��[���dJ�(�g���8�v3�3�Q��/�����3r��Ad�sr�25�+�5�R�+�+��pƀ��˖eW@I0 ?��Nz����c"��;�[p�o�A[l5�e7��[<*3����7j��3�`��PÚ���^L�ad�Q#�n88o��Y��~�bտ+��~捏��*G�PT^϶l����-O��M#��~��Y�����G�_���C.�kYB|�6p 3�a4ᒄ���y`7��(��2�����jWx��D����-Hs�XX�h�q��b_i?'�$�n��E���G*�#˹W�V���z6��5�y8uk���P�t�/c8�<� �v����7��XA��8����ǨC�'��r�yA#N�����I��'%<�>���r�2�Mp�,]�!��a7|n�W�� N/ z�����J�!d� �'�j]xA�/�D���=:C|���`fG��y7�M$��r�2�6}�%����\E��l�� p+��� �vu�k�bcjHF� �H1�(����|�=�ݴE��q�/�;�� U���b�c�f֗����:Y�Qq�Ԟz)���'�U��?��b&��[F�&��Fzm��������^���.x���Y�'��� �x�U&U���%���x|�|@y(���ʫ�J�P�JdW&����X%I���m���/�H���思�g����$~~�p�������>���9g�:���<�S�f��L��G�o{@�����^��b� �.>q{c�6x��:"���m��%4�7��}n��p�����e��yb(�o��>zuL� '�C���R!��S����ewBg��������Ȇ%>Ml&�/t� �*Y���l��'`\33�M*�$�5d+̇$ƚݦ�0K��c��6�����B!�K��\d辪k��0S�ɔ:Cg�����t�����a5��Z20@��%ZZlw*�h�-yk�̏�/�6��| *�ٿy��!z�`��mA�e���i�0S+^{���N�iT��\w(�}t۬jxF�z�ch�~�Ł�a�������z����5qm�z��<ڦF�����]��%�0G��`1�J:mH�A�����e�������/�c�\ �?�I�Co��"�d�u��U�*�RL�1=�IrA6&�±F��{K[�oF����j�\�J���.�[�cQ� ��x_DJ�y�� ��+�'8�>�S[?�-��A�\ۡ[0AiN�9O���;�L�|����e�#��GѠ�(��S�_�U�����wB`S)�D\���$QQ0z��a�7C����ڻ��y�W�J�١N�i�0�}���0@�&=+8���6O��v��S �F��$��BYP��ߖ�n��}�������!�V����m��+�g��|�_~����D���Ƃ&�A�dO�pKhIG������B��|C&���p�Pu���0`zH4�-�u\��L����U�<(�di����jf�K�D-�FXg �ٲ�C�s����Zs����� 4�|��>;�İ Ero(]Y��˹~��[�S--��5�^G�mX��S%���P��~�.1����$%�<���RF �O?U��34��5v�V{s�x�6m���<�kl��qf[� �$� �&!n�K�Œ5EB��#�A��xfApX-��a�b��7�$�>�a���E�-���J��������G���7&�IMeC��D�0Q�XF�Z����p~)�!6�����菥{����Yg>[��W� K�\�����'�l�VR�Q�{�?&n�-Yŝ�2��|�R?Ʈ@��b�-�A��]�B���81�������I[��n`���o�&<������$�<� ���Q�� �w�k>c�&i̅�ɖQ))Od��.�5��6��Wʗ���!S�ܐ��~�I#J�� �d͋V��d� M�ՈyOs��B���8�Q'�=<>締(ڀ���b�ɶF��-�yu3&O������|�Q���I_���v�'�yz��|Q!�,K%~��co�Fg�JI�_���������%�S���Ȳ�ӄ�J�6�A�_��2`����TD�� \s�7�V�yw�(�P^��8�> ���ӎ���A�:�Y ���9 ��kϹ���H�_�b�zc[$���l��TBٯ���)�`iH�Y[۠��#~���京x���T���/������rG)���/ڰ�i;y���"V�:ؤR��'/�� ��W�����?��܉|�u��E �C�1$�P9.��{��뭖�)k�QM��.�����������.%E�c�_��w�Xʑ�V�Nb� ��I��-5&n��J��́����msj���J��,ks����7p�:B�1|QeyQ��t/���\7��>��+s�^���6Z�b ��BMKH����B�����OcP� �8�u������p�'��ͩ�S�)oX�"�y��:��`l܅l�},#��7\Q��lL�������>۶���<�Z�$�_P���|��E� e��'�a W�Wh��+V�����8���U�:`�.����:Aj ���&g�=��b�%Pw�c(7���X,�dJ>Js/�p��$�����T���8ŧ��#@�n����:������Fg�=�Ĵ�I��VS[ҖW��*a*µ����vl230c��-�b&���&l����Ε�«������y���j�E��+�l6 �8��]UTGlD�hk�(���ț���c
Static task
static1
Behavioral task
behavioral1
Sample
e82cf5b10d418bcc92e336004ea93fc02f7d9859a5d7fecc878ffd888b0cb1a0.exe
Resource
win7-20240220-en
General
-
Target
e82cf5b10d418bcc92e336004ea93fc02f7d9859a5d7fecc878ffd888b0cb1a0
-
Size
3.0MB
-
MD5
e880964eb856cf56715d27666bd73806
-
SHA1
8ca725ef7ae791952416ca6f962a7cbb0b34ddab
-
SHA256
e82cf5b10d418bcc92e336004ea93fc02f7d9859a5d7fecc878ffd888b0cb1a0
-
SHA512
f30b7c47d1d8791c5149f2c1805e573193f3137b91309d630a79969d11579144a7f4cfdadcdda0e88762e47e90f2875ab4234de8e9d92acbd634d7d2ecca16ff
-
SSDEEP
49152:jCL22f/s7Sn0r9i8r7mjGkTKgCN1Bn3CNzydR1r+Aszkmyc4/WbmBHH1PSxwLdsW:QH/ip3r7mjGaC/rbXc4ebmr5sN6s9ZT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e82cf5b10d418bcc92e336004ea93fc02f7d9859a5d7fecc878ffd888b0cb1a0
Files
-
e82cf5b10d418bcc92e336004ea93fc02f7d9859a5d7fecc878ffd888b0cb1a0.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE