҇R>W�Ғ�V �0x�EzVjg�1ζ��w ֳ�b�8���5L�߱1|<�����f���C�����fP-,s#%��m��/���R ������M�2��D>0x�Qu�g*jyg?h���8 9a�D���<3��^�GK�װK4b��(g�@Y^m 7��l��R�eU1��l����'Y�z��ͩuJ���#mgONG?�Gy����O{�F`ƣ��5��D E�:�K6϶NɳOa��# X\���*j�9}�0P14Rf�PWj�������h_>+��mJ�#"Bz�B�b���xų����,��`�� �$K>Li��};�y����W����VXI�����+��Z���J��O�W<�0���������p��0#ZS�'���9wܗC��#��X�qf����[?U�:iV>fYm��~�������L��֟�ٞl�Xқ�#;��v���VRl��q=A�D�>�BM#�:��m�`�j@D<��k�T��O�^���G-|G#�^�P�����H�~;2�:qY���i�p1�o>�_��g G�e7 <`���Ap�B,{�8u ���K1�����[�߄h��n��t��\�P���&s���O_�ո������9'���h�d𮋐,��J[khU��bmTq�ٕ����U�.�RP�kW'5}b|�/d�p����&��2t�in@&�����>������������҅�F2����e���ݪ�(���Y�� Pd;�?!;z�*�6�Hػa�n��9 ��?��\Aa"rxr���IQo�� ���H��ye�W���Vn;�@<2��J>�M�t��;�������� vj�P���ݲy��m���sU��Η��0.N ��b^�9�Sjf�#���h�\��[�=��CI�k��.Mnr���2W����O��D@1�z �����u�6T�?�y!>�E�?[o��yD�5��� Ѿ�dEA$�pɘ��}�Zl���C>����Z�J��ƺn�z����M4u��O2v��3�P�r�-����ߪ���{��g"��n��3��U�3�a��6��!Q@)i�C���{):���F0�M�yϳ�������}�:����Qo�s*O���8���F�,{��VjFm���>�����6+��qOhr�m����M��G^W�*x+f�� ��%�(�Q6zK� ���l����B�pV�����?������[��M��M,ЧB�CI������ފ��I���Ψ���p��3n.�bЏ��*k%�7܅c�Y��b����y[4�wQ�t�Q�B��.�bmg�%::�IJ��,zy�h�;۔�߳zy�l�\XGk�Az_<*� t��6�UT�_����q���0�N\�,�U��(\� ~˛m�"?���a&�s�68��x�$U�� ��I"�����w)�K0���an��Ha�Jx���&�!�Q/�ウ�1��=ycBi(�=;1���(�A�lL��f� ��i�5��cz���v�//���ߝ7Р�D8��U[r�oZuɾ`�2�D��*:�!?�z��F͌u{��'Ș:�,�SU�VFyGA���� �*���FJ��,fq;UJ,_ ����e�8���ޞ8N<3���V;�Q��Ⱥ(-P�-���V5�Y��[�,�O���C�1�lb?�]�,���v���ݰ�N���vj�Q��C<ggY�g�CO�ر,<�H��|��p���WA��-��n�%�K��J;u �$ros������ *E� /w�[��&�\#t|�՝f�Q�a�+�Ri�1F<�n.��ER���/�<����d~���e@{��˯���*2�`{`[�#/��>�߽�,�����@z�Mm/`�0k���h,z'�ɹ_�0d�ؚW�W��z%ݬ�d|n:y��^Ö����ͨ��7����p�XL8u E�=�W�%�S�0�^c�;�[1||[��X<���\#+��M&ϟ|~�ۏK���p}�VG�e�i���{}��ao;��ܙ���{��}Ioι����W��Q��C�;�dI�B�6t�q�_�~x*j5(���g���<ᔅ�v�ͣ`��������3R,MHnP|�Ft�(��iP�8�T!w�j��I46��M2c;�1���;Qo�p)���k�3�S�rx$ʥ��\���`�;g|�ޢ4�jݚ����hm�������4J���`&��H4Z}����$v|$Vm?�8LI���فH�y�e1����D������/��1��8���|~hFȖ���DŽÖGu�������:����-�El�����������]0!����d�ξu�����Xo���bAz��0�j��ߘ/�b��e�*t�ӟ���y��$Xt�j�\}��3�1kRU ?�̇T5��F���<N8��� ���j���Ca�U(���߬*,���?��n�����e}z,j.g�XCg�։(�f��N���=���j�H�/H90n�_��OU�������{���hG�p������GR�ʪ����2@D2��_W��?I`YU�;k�>3�N��F���u7��m�H>� �:s��w;W���i���>|�O��U�6)��;j��7�����Z�}_�ٗ�"'�� usy}w@�(�� Ӕs<:�:ԻޙK{�����ױ��;�*�.\�c�^�jnJ��v�Am|�ӻ�3��^f�����s�������F;Ũx��$���j�x���[�AM�{�la�'����3��f��e�<A����w�}��X�3�h5p��zB�<dx¤�����M 3t�O^k�uGƐ�p��X�o#?��2 �zA��[4���^L�l�i;�+�j} ��A S�����_N�n��ړ���R^��� Mi=���P��Yނq� ˯�n\�aL���?�����O�&Q��q&��,;`�)0�;��k�kl~B�i:&��,d�)��r����E�3�#�s��A��ģ�#"�c�/}�,��p�}}O�9q��+snc��iv��|Na�aZ��b6�3ĸ��L��8���\&8� �-��r�7����7�̐�� ��, �΅��ߛx� ;uj4��Q��/��F�{�U��Tm�Ahz3�b��/��^�*� �G��#,j ���a�j�L�1 ���wH�L�(��${���nx(���es�̀�+y���*���"Ʃ����Z��Sl6X�w��K�*�H/���7K0�S�-Hq|Yq�XuI�V�w�C)_�Bʱ���S�/�aCd�c�B�J��Κ�HI$R���m+b�K ����0�����)��A�{��� ��W�8���xf�c?�2���4{����"{�OwDV�+y{PN��s,`�X�|��ZuԳ��k @>q�% ]���y~�=V@����
Static task
static1
Behavioral task
behavioral1
Sample
c68a9e3a3e2265221f8919994bc05a10522579ab54fe7232baf91e219f28ceea.exe
Resource
win7-20240419-en
General
-
Target
c68a9e3a3e2265221f8919994bc05a10522579ab54fe7232baf91e219f28ceea
-
Size
3.1MB
-
MD5
6a1fd921792d73ccbdc66e3ce37b4fe7
-
SHA1
937b70c6667e2513994dd63625a7f69eba100605
-
SHA256
c68a9e3a3e2265221f8919994bc05a10522579ab54fe7232baf91e219f28ceea
-
SHA512
3ab7ef8b0c8d869bece23b36a6094d0836920c9c88008d78dff2e49d0baeebbf2559fcc1cf4e657555fa228b095bb8294780a078d2c75b4b1f01d35a56de6f92
-
SSDEEP
98304:1jleqHSCF8z2lfbrZV6/cIQh+B7mhk+ykQJFEkkDPs:NleqHSCFhljrS/rQh+3PkE8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c68a9e3a3e2265221f8919994bc05a10522579ab54fe7232baf91e219f28ceea
Files
-
c68a9e3a3e2265221f8919994bc05a10522579ab54fe7232baf91e219f28ceea.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE