��b�z��1\T����ܐ>F�ym��7�Z�. }yn&��"틢=�� �8��N���z/�B\B㊧ӕ2��ب?��j 2+(��``v+<�fV�mV��f��,�\��C�w��7D*�����F�4���4��5=p��65�/����� ��੮��I�_��Hy��F;ȣʃ�U�4%�I�'l�W}\����|�ZY��0�W���'}t�j�$JP���P�a+T� p��)A�U��k�a��q�UX��0�B1L�O�O�:�����6���*� ������ ��<��wB����vL�%��nYp O�V���1Q�B<a(��g��%udË�˹�Tq�8q�B)3� ����Z¦���S|X)U(��r9}y��%�^Q�MܯM��bq�\�����t�9G�`/c��Tʒ/Y@~3�w��F��$�\�.�����F֤ɜ�����kǒV� @wƣ��M r��xHU�3$��V��4����66��rRĎ.���m��D��<�^��,F�f�jg�%5�o��3R4�n9+3bB�ϒ�a�ʥ�lԧ{h�@1^-�29㯌 ӻ%��� k�) �]L��I���LY�p�_ܞ���"wOo�B'$��N���������8�}��Y��N ؇�d#JC��ɸxǟ��H~.@z���] �>��Cͬ(n�F=|���e� �Ufr7G��e6�.���E� (��P��*��J��J~0I���K��'�j@��"������v|�.�-��c� W�˾b�W�\`T��K��QC�vn`��.�,e�X�X�t�-/�5$��0=f(a�Ɖ��Ģ�^�Pv�OP�n�r��ғgg���C.ن����j/��z�3�!������P!��m��S �O�{�b�xq[Cc�*ԆH>�cw�϶*�a;��@�T��Ŀ`N��Y��������h�M2�?2 �����x%d�'�Ll�w��eK��Ơ>�?�wI��M#0�s6������5x���J��Ey�3��Q�+[S%yvJ���g�s����z�3��J��^���Қ���� �4i� -���LOe����s~�����@��ƻ�鲃���}�Hԍnv�l��8�ͯq\�h �ğ�@bTn���t��[��l�[����9���X�YڄB��=����0W�&�Y��?ܿ, V���ą_ՔA��/�/8�0���?I�u�r?ۯ;�{w�졶Jx;H����'ˑ��1{��:�}�� ��?��]Q�RD�F$��ڦcŭa�8�t�g��n&�C��7����AѠ��������h��p��M�#�~b��0��/>櫏{E* �-��^��?�kǨe��r#N�x�~'�����u���H�V>&BP�����1ۤ/ǃr�Ҽ0��@m�벞�����&�ʾL� đD⹓�s���G���Z �S��� ���_3 U҇~�����r#��r��h�gRŇ���;�q�}�y��उV��M������[���L~���i(ڥ�!?\E>�Y��g�YѶ�_�a��n��(��;���o^�r�,l���x'��� ���fL���}A�r+�eO����»��Qaf��/k���C�,o"7b�����7920$ ���۩Ǒo��Uڼ�m]�R>���� �?w�{B7�H�9nR;~s�)w�����Q� %�5:� ��\y��4�:r�����Z9�!��� ^�žm�eZ�Ŗ8�#��}k'O�m]5V�;4���l���t���;���V���HW��C� 0J����M���Z ����'~F4+�]ɱH����/�I�ʞ� �ȇR|�Oј����`.���i�G����Qy�1�A�[8kո��Ǭߦ�֍}\Gxp��~@�F8t�HB������_���.�*w,�K� GLXY^~��j4�C�V>p1i�+�S���)À�#�>��m�S�̲A䊂�RQ�{�N�Ň���M>�#���=գ��돿�nx�*���2�nu�@1����x��H2�E���vVO�sy������!L��Tny]�v<0��4�_M��6m�$����MC,&2=|��֊Cj����@ƚ��8D7�r�� �/�'Rgg��,Gy����2i+LaU4�{��a���C0|�w�r�n��i���ɳ�U��X�G�$��v�E&�\���Q�z��`��w�㯭��x�j���>?����Dt^�����y�n����w�SL�~V� :��1bGAg�Ȁ�l�1w��Y�'%ܱJ�+����{��h��t�8��k-Q#�y�?�a��O�6W����3cx�j5���m$�$v�J��A����"�jICs�N�%��6qN�KRt)u��>���-�ќ0�<��C�� ,z�'�q�EV����\��oj� ��R�XsW����R�Q[t?� ��y�Pά~�|�E�bϯ�\�u��?\o�;^H,T�vq�dFet��qY��ZS�m�m��S�P?:s�f˲���ղڣ��''����3~��H��}�rK<hz*[b��A��dTf߶���U���|�j)��וR]�?�@U��$"�Z�� N�oW��K�4�SA�sD��!��ۜ��l ��|��;K�ri\\յ�!56���!�7� ^���xfVf�"[C�5�T�b��ʬ�N�:�q����� P�Z�Y2��%�Z��(���*WF��.bsTP��̏�����~G�/�RME�VC�H�|��*WsY��D��O�"B7�\i�6 ��~=�v!�Gxy8�i��Y�40�.���^/�'f�^zb$8|�k���ɷ'B���7����y��y��$�H"���*�~sc�]��&m]5-@A�ii����ij�,³�@m����V��eV����MLD(�a�0����!���Q���\�чx�G����v~@=��]֣]�8EZ��3�B����U�S�x��������@U�L�%ܛ��QM�h"��YV,P[�� ]���ݍ�(f����O`ݸ�mg��=���F��2��D:KX �89 xzc ��#�~��7�m�qN��ՙ=�?�4���(��������B� Jllx��ɵ���~P��������q��F�R� �7ceX�� aK �\��aI����~Pƫ5p�9nB��`[�qT:�<e����dHؑ��4�7��͡�٧yM��S��4�I$ؖV�5�ي�8���yG�vl�6G1GH��>��k��6�UW��?ǚ�%_q.���`"�芠���n����UJ:���>a'=8%�ZPi�������M��QM�26P���^���z�3ˇ���d�,YE'Ž=�Ԃ��߷�,��%p�0Hz�&�|�d=ZoL�ruz��⬓�� �r]-r]�"�_���G�*^?���s<�Rx��� �>ߵ��nOZ<��e}1c6#v����Ԕ��+�5xW��_���DX窷�D �e�H���|O�o�r����`&(���7X5�W����zx�����pQ%�kɗ<_�/�/���2�����K��h�.]{��D+�$>�s�� �o���a�<�uD�A\�V��R��>k�q��UpۨΛ��LV��Tԗ��$7�}�0h��_��7w��Z��ԍ8�e���\�^���
Static task
static1
Behavioral task
behavioral1
Sample
b57ce113e3a350c259ba04e3459ee2ebdb4960fbdb340cfd2cb95ace7d42ef88.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
b57ce113e3a350c259ba04e3459ee2ebdb4960fbdb340cfd2cb95ace7d42ef88.exe
Resource
win10v2004-20240426-en
General
-
Target
b57ce113e3a350c259ba04e3459ee2ebdb4960fbdb340cfd2cb95ace7d42ef88
-
Size
3.3MB
-
MD5
7bd09ad8fe23e6027514e8be4c085662
-
SHA1
335b9bfa65dd3a75a4fb53b19f88f1c753b9fba3
-
SHA256
b57ce113e3a350c259ba04e3459ee2ebdb4960fbdb340cfd2cb95ace7d42ef88
-
SHA512
8c8f956a843ea5d13bf9eb8c83d9c7438071a7cdfb1058b25bf5c16e620297c22dba290d47db3dbbe8b0a6557a5e54cc063afd50886e84de804092e23a70078b
-
SSDEEP
49152:dInudDhKISarPyT7YoFqy4OQKT9e8Qupml5uvN3dcx8hyfNq5z27RSYMhtQkfuPK:CmFSiPyPjq2+8/k5u1WQ3yKuPhJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b57ce113e3a350c259ba04e3459ee2ebdb4960fbdb340cfd2cb95ace7d42ef88
Files
-
b57ce113e3a350c259ba04e3459ee2ebdb4960fbdb340cfd2cb95ace7d42ef88.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 223KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE