���@��q��z,�&�� d]�������,��Y�B�� >���0�1b:������c)�grj���3�9�I����-���9:��C����ѐ��p3,wbY.y� ��}��B'�̻��Қ�e�Q�A��Ǧ�Ȟ:O�� |�W�$}F��"�Z��.��=�V�Q3i�7,7�2���ݖ��<|Oԙ�p��@Z�|OT���V�4��%-�wB��d�/9!�i�q����J�o�R.oo� �N��;�7� �01��KC+(R9g<����vƯ�_�i�e�R/�0��Gx��8W�->��i��� � �F�h�O���_���)��+�u}pM.R���zf�G�]���w|Y5"�:?�}Cu�5ׁ<�(8�<?�/�Utv���v�׆f(j��f����{��p�A���y��>� ��w�^SGFm{o�& �7��y2v�¤�LV�އ��R�n�f���ƣ����aG�dǢ��<tCM����^�u)-�+=G���C鞻Z���Z� �=Y��o ƇS�3�/�3<#�@�OIE*��*K�e��i����RN��ׂ�%�+R���ȈBv�hr��ʲZ;I��e�2@k}��z�+{T�tfp��Ǘ[�1�9��@�f4i?Oa�z�>�)� ��Ƨ�`�d��K<�%:(�AV�ذؔX�q�M*BE���Y��ʜ̿���u���tj<��]璥�D�c�:Ҩq@�'�x�VN^���������B�5ʃ��ގ+��fH]/���{�b0zz#B����}l�i��̫qhπ���8$��������G˦P�l���V�U�gO� }y�5�!�j.�=���Q3[��DC�j�~ᦷ�"�/�C���t��/k�kb�I�`������pz.V��X��"/6׃k{�D ��h���b�ߠ�+{~ϏN*�qZI����(\+��7�S��|�ȼ��gQ���N���R5���L2�% ����g���hU0�,������2�Ҏ�N��v8�������%{t��q��5�a��Gذ;�%|,*�t����}�7�|>�kx��Pn�Z(s� �"�P� '��@J��C�R�f��[Ћ�I�B��S?���jTxuxCzu�|�`�4�m"# s�4��f����$b�OkD:[���|3a��H�OM.$i�j��Xj�V�z>��,��'����,�!��a���:j�JP.h�@~T���@L'�hY ��Щ��}W/,9�7O$:�;��?J��#�m J�j�F�-��\g�{�K>c>������_V)t9�\��)}ֳ�9C:Ȗ���-���7�Sbk>��b���Q���:��۴(���*��nu�+�r��Ld���v��cې��Fr"jMMYޚ��~�6i�VaX����S��8#C+�!��Dup��l �����CqfƝ�!�e{��b��#*� �b��V��z�S�q��"<��k����v��y�#5o� �����_�%*XS�U�%�ͫ@ ì�~�c��f�����g�0���ɂ��LZ�>*Xy����H<n�K~x:h~��?cƜ��W����<��/�To_m�t\��������YG9�偍�yΌX��&�ix��:o�F��5B���}s�fë���q��B{R�à�]�{���e��T�P����sK�V�k�D��}��`=z��Ùk�'����V�;!�bx]JW�W;�!�&:������ʹS��d�����j�)��8S�Ze~�-a����h�����p@=��l'��߂�ˌ\dg��%�2)Z��߭�5���wg�ͺ�m����&SGw�0Aw9l��H�W�{"���;�Nw����g��LeB4��O�NT_�_UT�R�Z�l[_X�{1aaxTh9�&�&��ߺ����=O�G}��1{%˿)��ui��M�B�a�R|P,���0�L��=����<��fo�O'��,Gu��`*R�:�n�(�� �g&��6�9��k�R�ؒ��b۳���T��Z�5�9d]�q����gW��"a��aAH.���L�~�iI�<�b, ����Z���s��08@Id�`��s?�k�8���qk��:��;��b��g�K9�&����'�m8>c~&X���X��@(���aj��U��h��Zf ��5aO�� '�qi+�S���O���0I����K���ғ��Q!���IX̥RlvӢS�J8�qju�S9��\��S�4'�����϶�H������~�ws��PqZN����-b�oٍ�ȑO���P�GI�<�h"5ˣ$�3I���P��=�⤦aГW��r�"�i*l|2�X���9z��*�u�&�H��f���$�+�g���L)e��΅?1#��J�l���j0��� '����.<?ގڶ�V��-cC��*������B��S�%س�42+B�V�(RB0��N��§5�k� �t�\�̷2_�M&yq���/ئb��&��-�k��,�:��Î�� ċio���� F���x(��kF��D�29��:QvLv�y���&f��X��-˙~����:mѺM�~F��A�����J�L�O|m�ܱX���q�� ���*��&��7��䉸�d��wp|��D|틡�%�9,���2nb�Z}���`�����]�ȫ�K@��_���!����?l�? ���ЋO�*L � �pSv��nS2|S�љ��A_�o�A��[��o(��~F)�)n���$�h�S���a�����u���w�K0ީU����'�� ukʋ�)���N�X��E��m20#m���h�j���t����� a8���ԉ�-=P�oT#(�h��->�J�>�a \`��Ț�4K#��73!��?�I6�O1K���=p�t�u�����(4L%#V���Y���UJ���f�h.CC2���M� ��)�F>��1!{q��.�g���h�V���Q ^y��R�����,}LdA4��JMCf\��7�t �K�^/�ئn�������^�t��+͡Ѩh�ǶP��d�����#�;)P�Ύ�u�$Z�4����W��sV�B�,���9}c��=buۢ�D��g��N���3��L@�=���v��\�?���~J�-��$�k�J�l�kA�tYa[fm���8Z�o몄1����47�R<�s�)0"� S���f�{�Н�0a�@����=7c<�pNL��Ul��3�]�ߕ�j]�B\�:Y��� u�����r]ݨa�����K�5��6����S6-�a�����}�R[_�^���mi� �����3����"��1&^�2i�6�7p�6����P{�h�.��+��ts:�bs-��֚��!��kD7���=P:gU���m�C��>ȮY�*�zCj�Z�s"B�(塞�0�-F�+��L� SY��j��k��m�'���XeQ �z �J��E�N<�ޒ�' ��&�?�����_SŌuhaU��q'����P����؆T;��v9�C�Y�����~��Y�봊ϑ� �\{��~��)�m"m4�H�_�QfT/M���:�V3��F�\�/�ă������BI�ޙ�%=e�lb����l{C�
Static task
static1
Behavioral task
behavioral1
Sample
fcb6cc374abd4d21ea47068eee534e0e3d3ac88a35788acef686303d09794e78.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fcb6cc374abd4d21ea47068eee534e0e3d3ac88a35788acef686303d09794e78.exe
Resource
win10-20240404-en
General
-
Target
fcb6cc374abd4d21ea47068eee534e0e3d3ac88a35788acef686303d09794e78
-
Size
3.0MB
-
MD5
df3faacf9c2e14ed8f035db136a04172
-
SHA1
010c53a280f05d17d4f4de07c70ee67108292c64
-
SHA256
fcb6cc374abd4d21ea47068eee534e0e3d3ac88a35788acef686303d09794e78
-
SHA512
3c45df8ee0ced83c6a7dbb13d1ead0b6fca148b2439a43582fdfc0b88d8ad999500293e84895cbf47ab851ec51fbf68e855de1478dd26f2a3d685c554ae98448
-
SSDEEP
49152:8x3YxWjXZN8FIG9WQBijEKvXyu8NkK9G6vASwMCeaAj/M8jh/gkpU8txDpQ:0YEgH9Wr/vXy7Nw6vjafAxhfNrdQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fcb6cc374abd4d21ea47068eee534e0e3d3ac88a35788acef686303d09794e78
Files
-
fcb6cc374abd4d21ea47068eee534e0e3d3ac88a35788acef686303d09794e78.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE