l��{�*�\�OI٢l���� L�m�6�X�n��Dm�5�z;!�5<@��U�Fo_�:�\��dL �w��̐�����ئ�3ȞJ�B�z��0J�F#�+ ��МQ�L#�y������Z��!} Fu��e�V��<�U���1��K��2��X���n���xq���+%;���$ ��M(4 �J�9R������d���O킿lR^M�y��.`[� �F����R�px�&�=�4��1rdVM�m�41����D�� �o �7����V.ަ>Ϛ<{+T� qV(Z��%�u^��p�<%�@�#@p.��e�Nr�C �k����Ny��[�1���I!�(H}�P��Ti`����l �?���V��&�paR�\�H���st���etX���i!�qO���=��p� �g�o2��Yp���&���!J5]��!�vK���� &�l��.d�u��)u� ��r]p����6�@�9��<�Sb�;��t�"1���ϐۺ��'�E �����9�Q�Ǚ��u8c���1m���\��3.D´R6e���]ꄋϞ�(�� :�Ҭ\�F��o���Á^�W�3�ԞV_ۈW���UjB�H;����l���V�i��V�ৢ�P�;��?)�n ~�y�8.��.h��zջ�ߜl��/ϨM�)}=1���9�1VF�q=t/^�r�|n�T9SF��R_���a�Qzc��Z�dI�ic!/r~���.��⿺?�X�҅m�'�[�.�Vbƾ�G�L��u�%���#�?��գ�t���'�d�ݼ]��Fڣ�fs@��Q��\�P ��t�N��ٚq�^�K�|mWݵ�qբk�uC�,q�{��,���>-��=$:k�%��ʖСC!=9~q����@K-��Vu�[��ŵ� �� ��� 7��so3����A4�4D��<=�h~\�H�/��?�=����K��-ؠ����h{�#��ƞ���gP�(ߜ�G��Ֆ�隉Z�$(/���\�8��t���T��@�Y� x��������e��'1�X�$��S�V���մ՞�z����4t��<��*5�۵��:<+S�9�%��9#r,��֡+,,E�/e[�m7p���lo�Ry9�a�����%?4-w<<�~R�w�(B�+N���ݥD������#IO{��(�C�}���#� �g|�M=E#��YY�:f��y=��^|�Z�X�b�D�f���b��6L���;��\}��!���g3>N(cmSȒ��1[P�e��I�pa�Z��ed��H ��h4C����'Ǭ߀ C�sxж��ť.��N�2ۥ�T��*���!�W3�;YtU�����`�ik=^ ��jpTH8e���!��:{x8l�CKĖX�f���`,�o�]~�����x��'�;���QMG��%2H�; r��v��Vx�]N�v�������0b�?5�:a���Q�o0�ߟ=c��P<�L��S�ۀ2�a�f(܆�hj��� �.�yUC��������*�[� |���5���\-5d۸�5��������G�,����q�|ߗ��:���d�u�Cp$��� �=�g�R�,;�����S�� �藅XԎ�d��C�%�4L�~ e�U�nj4�4��,6��)�zuFy;~'��������/����Jg��bxıh�.��:� �¥^�{�ܛci�?�bc=���|X�6'�&��1G����I��rB�I�lj/������Rp��K��� K<����W�C���RH^7�����ųJ Z2�c�&�TW���2����T�/�����Q~����p����o�6�FH�a* :����g2�tKx� ���qi��˝[��d�x6�q�##�3��=٫�.���cq�eFէѕ@�S_69��+]�N���vl��U ���i)H�"����.-Q��P�@���a�����1�^M$z�-|X��,UB*{-,-�9���NP���g���,�������N�}+���p�������8��<Fu'�LGZ{�4���4�wQFqЬƋ�����@�%�<�|F�]0��9�@!�bV}�+��?�c�?ܤ�����^��@�T��7E�����ai�r��ϒ�>�I->Sb��\��-;T �c�ũ�L�5M�����/����`���RB2ˬWٌ�6�d����[Gk�#��m��cC��&C(�'��.�U��9"��|�"D�Z̅` ��ȶ�u�4V��y�������h=A?`.���H�e/W�_3����v"�1��yrlkhB�� �ua�O��v���7�T�պi��Ip�a�/��U�E|}��Z�����"��?��������V��MΘT������e='vun����E���&��Q�#Y�Ǧ?Q|���+����Y�����<?�:�oӔ�h-�y�*���C�.��;�x�����[/����ƨ�o҇J�NU��En���Y�CԿ��\ \+�����c[Xi�\�5�Gf�-�N��n ���x�~0�:�o8�=�a���]��F�^T!\��X[ZR{J������ �B��~3'ʞ(�� �X3����a�1�JӼ�e���h6��{E�im�$��w'�~���A��v�C�9!��9�k�Vp����㫖��@�~��_���!���Z��!���K0�'�W�UN��=�Ef��D*tNL��B.�{ںh�����?��W�>Y[��Mr�w�CCL���"��1�)��!����x�V�f�"+�*-�믹���/Y�D�㓱Ϋ��!�L�%���������o$��.��M�tú)�b��=�p�BNpՂ����8���O/��3�a��ܸ�k4�Xd#~�[5��d}1��>nݨ��L&ӂF��#&���M_f��(�i_�C�ݚ ������0d႐P����fz��^Q��彸i+R�>� T�m�#�5�� 9&��-?J���wp�H�IU���;(�.�d�Ț��gp��Ey�+�t�d�feE'��r����e��|`*����\r�� ԗ&z���Q� r���m������NeᆀuW�حjj*��]*�W����:�T�`�|��f7Qo�98,���%�5Te���Yk7��� -ѐY�y�u�����(��cJ����7����V��,LqD����j����T:m?��GV b��q�o���Z�{�������l�H^"�Ç����yyK��:oR��6�`�����������iS}.�ͥ-t��~@vR�r* D*���1���gx�<�n�����T����˶�i7EH��4�C�R]�_9/B�[�gxɫg(Q|�NI�␋rγTC��O��@�^���e�vr����i���m���[]zz����jl�O�C�t{ڨ?����⠵�˅K��&w|,sm���g%��kn���9�O�oGB�ON��I�II
Static task
static1
Behavioral task
behavioral1
Sample
382c94eb356e3ce4197b00c3dd5f22151e71bc84f43c15d960f42d21babeacb7.exe
Resource
win7-20240220-en
General
-
Target
382c94eb356e3ce4197b00c3dd5f22151e71bc84f43c15d960f42d21babeacb7
-
Size
3.1MB
-
MD5
db32d904b43e7e86f7001a7f0a70a514
-
SHA1
55b5d849616368b8d501cefc81246de0a00d40fe
-
SHA256
382c94eb356e3ce4197b00c3dd5f22151e71bc84f43c15d960f42d21babeacb7
-
SHA512
1b5a84967363c241c6618877f2ffd455b9bef7f4bf0e6c91dcfd6b07cd72f70988fce09fc391a20c4096f310e1bdd5420aacf73348184cd0f792b4752547c08b
-
SSDEEP
98304:RNnjTx+zbDjuKmp0VRjTdv8UYZICiEklw2XL:RdHQbuzW7jTOUoiJGSL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 382c94eb356e3ce4197b00c3dd5f22151e71bc84f43c15d960f42d21babeacb7
Files
-
382c94eb356e3ce4197b00c3dd5f22151e71bc84f43c15d960f42d21babeacb7.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE