��=��ꓗڼ�R������ [N���� B ]��#�6o�,)6��i[o#w��M�IS�=� _���+��UQ��t��lx��ޝ&Xj�4�K~+�x聰(��]?�۰ݳ��RY �}��<���uC������[�[wfh|z�K���K��|H��v�"��$'�3�����m�lYvS��Y�r�XT�^�A)7��a\R<��b �3���Į�w���Ⱇ�A�)���7O��Z��KP�:KFD������� ��9�o���g��3����aZ$+{�rg���F�5�4�Rv�Dy6�1$W�E���!����r/���z��b+�)�I ��F+F��ѧ�5���S��2����_��>��v4���!�ӏ���ǽ�����KLlv䘸���1��Ύ�-���=м_r�`ֈ���lp֠".��c���C�OR��>P�!��@j������ �#�h��W�,L�����Z�yW�^�4��xer�g��0r�E���@r�����N���ϸ��nB��%N��b��S@���yae+!�ٲp����S]3"zU!�"�m��@� )]��t ��j�塋@^�_F:�3��"�1ɐ�k.BՂ?Z�s#�V���Ͱ6����`�*��t�]�V�R�[9'?��,"�������̀�]�Z p��I��(����2Ǣ��<� 1E�w��i��~=��u��h`Dm-*�;Ċ�H��6Z;�5�3���'}�~)>�ySɅܑ!��_���'G��c��s��i��~�<o��<�-`��R'�y(�>}��S̎������:Q5���)����cv��������iOj�=� �5Y�Ņ�rLJ�Z!�;��?V����Jj II�)��-|�R[���Д��D��q\<_M���.��*t������[�E����p�u�4�OE �|���: 4�~�Y��� �A # ��K��:��Vs �)X�/'�[��;D-�K�(Zz�e6;"���)���l�m�f�$[S�?�5��s���W� j2�^�K��v\�ݨvg� ?�7�k)����?y�����X�wTX�� -u!�a�,/�/kl�M�rV�7gE��+��5.��x�dM@k���g-��Kʥ[��ۧun��zS��zQ:�������ժvt��4B����%�]�(ϑ�W��H>�҇,��oF��E�^���& �c�I��Y[C�`%<�k��6�D��+�1A�F~J�us[�]��Ä��Iq�ʛ�wA��2P� q!�����}�������͇���ƗHӍ>I�{.y�3��[y�i� G2��{��Ww�#�p�_�J�`ꘐ4�&�0�K0Z�)vy��|���AyQr=�V�c��$~Pi ��|��:��*?����~=��D+�P��3������5A�NCTc��4߰�9K��o'�Eob�)��O�L;]-A�9��q� ���7�p����͜'��ʛp�PP���$�<so���#���!FR"@(�ϝV�0���R�w�E�*���⍉e��F��h*=������\�)�%�)�YGS=-�c4��s�(�(b4��Q>dCCxDG���Bw�ν�ܟ�}����iD�S$~iē���E� 0��%�N�{�߆���+�b�Nq�>���30�ێ�+2��G�������м�>aͲH��<F[Ҷ����|uSt�]q�j�z���k�>�ٷ,8c��Br�?b,[�� �׆u�s6�Lګ�Z�ӳ�aj��]�f� ��yc� ��6��V��By/~dd%5��W;L���T��b�k��Si����ȣ\��A��f����U[���?_�W�+&�����_�4d�vk�v���%Z� %�nfd�T��g��S�Fx �tznd pA�ƭ3^����P���̉ey��1ݿ���3�AA�Y�(�2����"��pD)]s��"�}-.@u�:ř E����п�>;Ȼ�>"�5��[Jc��+�5����覊�������ǘ�*��y��5|ng̩:MC.B)��?/eTB������U\ȑ��22V�=�ޅ�u�O'5qb�g���?v�7�ek�ڽh�����1�8�E��^u���� ���"�"�9�ae�~?9���i�Z��t�.v��u�BbL�1��-��\<V����ΪU�����w�J>���C��iS��=�|�$�=��%��n��~_�8�D�N�-p�M��m���>����4U�/+G�N��U(H�\������;C5M���,E������o��5�f�$��q1�ڸL�Q^�b�O�h�7���ؚ� �*$�L���H1�T����]��Y2�<P��_��kEj4i~J☻��I���JO�k5֛��#��HӪ����=K�ad+��)a��]<q�rFqo�E ���b-�3�L��ʽ�@�m�qrƲ5�q�#�tsS]��߆eG_Ty��� � ��l4ǥ��=m�6��l����PtcvT�3l�rY����>�/�L�l�&���������(�{���� [��^���n1��X2hd?��`)�H����7X�b�D"���5���P�vU�����n��q ,.���G]9LRڀ��iB��@5k��p��r�)y��6FdVs�g�rG�?rSzt4�)F�>6'�jܜ�=tP�4�ud���1�nB�C�x����?H'�.|�SG���:�洐�Ki.�����8rJ}x(��!��Lo�Z���=G��wgllK��B����:1v%�ʷa����M=�� �}��}A$w�ޡ��N:�����p�����F��W�=CH ��t�������>S�������Ue=$q�O��[��Y�n�I�@�h�RTE���]�< �x���_<:|��������K� 9CsK�60`)�Q#6��{��60Z�c]�!W&[S���/� ��aLFs^O�[Wu�E�ʾOt�i��̡"t�Xpi��B9H`%G���R4Q�m{�kY����5*-^*�k��;�A��>̋�i|�!�(k�E �eΥ��~�ޠ�D�H7����P�d����I��+�+T%���o��ā{�9��lC����Ʋv=č�.�:{E��<��?O^� =�smo��A<fl�r�-b�;���_V�ݯ~�`2J$K�7��m'�2�A�3�R؆?���+9�f9�������L�잴��#O�8��Tm;t? �r�b�[��x&�D���$#�O�@4O_����|Ĥ�)��i�*��d"ϩf��f kXHG��"�!�aU�=�硈�Gc��ھ2��tw��kq3WUPyec�)E�Q�M^ė�'tNH>���0��﮺��l�~:`ݎK�v�T�#�,Δ�K���u���M� ��ƙ���p�Z�M_d]ub8�����K����Fz�Z�����9TהXW�O���7pN�4�;������{�0��,��+?i��Tу��3�@�����!%��z�ݭ��w�b�� I��DIEB( -8=�?��#�R��D��ot��1�[$��i�<:x�-��U�K��8��7��,9{�_�m1�����Ј�p0-֟f<瞣��3T>9$�����/�r�2JgF]W�ܲeP�����Q�u�����S<|�q�9V��W|�gr�J"�p[��<����U��i�0G)�H�]T���Oe�Ե2�����V�-�~Y��X1�5�?�"��R�͉#��^��Ŵ5�k�(����Deg}lm�.,R��aVv?f��
Static task
static1
Behavioral task
behavioral1
Sample
fca8f8e89a18a8f2e33467507470c63ff70c9739ae4588b53ceaaf4acf465f3f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fca8f8e89a18a8f2e33467507470c63ff70c9739ae4588b53ceaaf4acf465f3f.exe
Resource
win10-20240404-en
General
-
Target
fca8f8e89a18a8f2e33467507470c63ff70c9739ae4588b53ceaaf4acf465f3f
-
Size
3.0MB
-
MD5
d2204fb7b258c988d269cf7d3751e361
-
SHA1
7a845c39d30dc4bc60540e4d6b7e073861ac2455
-
SHA256
fca8f8e89a18a8f2e33467507470c63ff70c9739ae4588b53ceaaf4acf465f3f
-
SHA512
d42ebb8b19816112a6b5220fa02406ce5374c57cb8768590deb4495c0e031fe59482f6cc66946972a286d43a25d58f4d3cb27c4b5ffaff6d90c1c342d0a08396
-
SSDEEP
98304:DFev0/P9t3WZ5ni4r2kFL+dVh2Qj4TdjcEyML:DF80/PH30JzJ+dVh5fn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fca8f8e89a18a8f2e33467507470c63ff70c9739ae4588b53ceaaf4acf465f3f
Files
-
fca8f8e89a18a8f2e33467507470c63ff70c9739ae4588b53ceaaf4acf465f3f.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE