�#�o����Ix�3�)�|HC@}e, =\�[�Dɋ�V@²�8��f3DL3��]�mi�W �*�AU's��7f�I#���)n�~������镯b�N?� ���],}�P�� �g���w�F�Ⱥ�$����\����^±��١0����EP�v@���F�G,'�x�o4�je��|��s����I)v{n�e������ �U������#�O J�x ��a)4��i5�'�T*��Y��C��s��3^��|S�>"���[����J���K�;�'��o[�}����;�J�@D����/b��z���n�,�vPȾ� ��j��L�h��P����,��2�D�!����ϟ�I���h�?�M1�ة�� ��S�<������:�ܐ�B��k����x`U�w}�����l����R܅�뛴2_���5-�EXݚ�_�k ��Ws�p�r�|��<���bߜSl�B��",�Q�z�q�׃*��щ��h��Te]�P �sy36#~�]�`Hl-7���M��> ��X!0�ZO���U6g���;�m(���45�((HK��؟���5��1}F��Ek�IY���^�m$�=86�u$RNR��N��/��^��ߘ��'o wx[�>6�_$N^�(���Q���x���e-h�ь���nS���@�fĄ�qՈ0��&d��r�r�Z��!$30/�7��%6��`UU��h6$~�we�cg��� �y� �^*�e����'pӺlx����TQ�-�@����r@�kqlrzl�xr��K��処,~,*6�v��� �匵�J6�<��~0� ]�_d�pHt����D���n��?$�,傡| hB�m�f�q},a������ڈ��NrZ�8O�1+\P�t��EZ�!R�+��j^�Y����:�B��n6�b�CW��f�[x�?�>��Z�H@��y�<^6��,���"�c^�ͼZ�j�G���-%p�t=N�O*Ă����V��ۋ]���4Tw[�u�WG�4WlۓiOC'��F(-ğ�F_��L�j3lj�� hA�}��A�%��X��}��(�,:���"��@����ӉC�$%g��twC~���i#�E��'_ y�8D����@��0�&����]`�� ����Z��M�6X�P�8�P.N��*�\ g��}y��c��S`b��c�ٸ����.�$��7%J���1����?�0�":>����HPK������>bEᨸg�7}Tʋg��b9�K9��y5(݁,�R�Hf�o`�^V�XE$��-O����/��c�[D{��u�_D�<�*�'��]��+�V�f��蟐)�K���T��2��Q����#��}�������*�h;�"o`�'h���FS6#F�k���1vD����w��=����+�0�J� ��S���%QMH�o��N���Q8�^����T����y|.�����\:d��au ���x��\}H� .5]�����Wm�/R�w�n1(֗ZLE��ڜ.�)zIG �gZ�>�E����#&�0�Y������u��I8x2,(o<���|�0eʏ��3����8�|���U?E�=��k��y/fԊ�!kc9��֠Č\��0z��&���{:0|�o��D�z�b7�+1�?Qכ�fi�Q�w���˩��R�c��Y��%ڋ{�`{z�(K]��'~供���g��0^�XHh���k *F�'���#3��`�z�i#mt4n �3����j;����ݳk�]�黼 �����1���R�w�|Y_L� ��|�z��U�ta��զ�9�J���'R埌L���]]�i^�H���O�J��m�6�"������r�9��UmB(NR�S��S���9q~�?���#qO��; �v��^~�C)��o3��-nVo�f�R��Z�u�/~���QX�.'�aI��k.��S��Z� ���C�~/F���[6��5 �x��- ܒ�[�'=�N��w1T�>�l�I-\����fw$�N��Qت{���&L�65��K��2#WV5(.F4T�*)�B'L(�� ��&V�d�e��] ��#9�Q���0L/d!��½���P�kJ�����$�@� rP6��a$���ys�������5����f�ż���'���!6=�64 /^Ȍ+s���zQ Ƒ�"_<qwNΓjGύI�l �Q�"�;�䚦N�z�Yΐj�0u��z6��ju��md��<jsCn������G)�����nYZ�ve>݄��1���3��ەcI����#`ߨ;?:=��`2N�ڌ�M�rǨ6�3���z�.�x�{��g�iH;V��W��i�Xf��b,�����o\5>~�,F�l�>�d��l�^L��m�QQP���Ă���|��m�a��+L���Q,��/�>��z'��EuI�g6���+=k��&Ra�LBAkB�\���f�- �^�=5�P�h�y©�I������1�S��t��=�]��hP"��`s��U5����T&-��P�9"��be�ldUڃ�z�j��D9Vj�`�����C տ4պ�T��Ra�W��@�ڤ�J8w�v�,�^�I�d"r���j��t_Y@繸� "�veRf9^G�,^4�l':�у��f7���r�� ��t�X�~{{Ro~>.3�>���v�M�f|���z��Hz&>R,���%���K'���ö4�KU�O��:��s��p���)���ϯ�L�(ڹ3�"1;�n�������q��x��r�m��:�YR+�s��/ Z�IMӀR�N��?-��x�E+�Ī��?�,���,���b��%����z�vܥ��gW���Z�lTl?QL��f��ߌ�-e�OxjT��fq{_0�UDzM0A�OjM�;S(�`����Ρ�x�t!�<��"��Y�j��MQ�����4�2�%1"Yu�!}:&��_C����e L�]"^�w�Y�< �_��I��ywN$�����W�*���f@�*�#*yB�����F��?^JDX�ß�7��0�z��x�3�&(����ŏ��w����S`��o}OqbɆ"�ر䬫[���N[D���M|h��2*����O����O�O������(U8�/�0��s?,��\�Fa2������'���`���?uOƛ4�{�) mM�u�� �JϢ1����[@a��f��폕6'S�� �dʿ���߹;�ʯu�4�̔��7 ����z������7�U�_,���j�EYyd��$�4��&�8J\�8nN=�K�l�L�ZkI1����_��j\£�q(��J���u;�5��qh+�f2OJm,T�_O��>d�l����������GX��=����b�H>B|� ���g�>%�z;] :4�sT�˱~��qQS3�Kg�����,ITrHh0�.�_M�� �`��}[ܼ���D�,b,�L�U8�L�c�Pj����uW�В�DChBu8z5pR�������H;�w P�F��}6'�m �8J��)jO(���!� j��_��WJ�uEN�i+��'��5g��}j!�0Z�'������O��E�����Gm�o)�>�����Q
Static task
static1
Behavioral task
behavioral1
Sample
1a1da9828166d4ec021510b414ceaffdeee63033049708b8a7a1dd5842304e15.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1a1da9828166d4ec021510b414ceaffdeee63033049708b8a7a1dd5842304e15.exe
Resource
win10v2004-20240426-en
General
-
Target
1a1da9828166d4ec021510b414ceaffdeee63033049708b8a7a1dd5842304e15
-
Size
3.0MB
-
MD5
282b3c4a8a1e8796658c3c588fe1e578
-
SHA1
019dc4b6d3c6ccb54308795d66221ea0b9b36ce3
-
SHA256
1a1da9828166d4ec021510b414ceaffdeee63033049708b8a7a1dd5842304e15
-
SHA512
6e45dfaf828935fa64f2549129deceb7d4ab7726cff20e3b15256ebcf59a6092af03a965dd1f68881a688a8201b3839cd00712c0b37f573bffb2dcaab954d5ec
-
SSDEEP
49152:VT1axJZW3ge7th7QJMLvTiQ90zaqAUkw3KOGkatKqSfr3O4J6J8PPway+v+/0KRM:baxbW3VPrTi1AUzjiE3iJGIajvzKI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1a1da9828166d4ec021510b414ceaffdeee63033049708b8a7a1dd5842304e15
Files
-
1a1da9828166d4ec021510b414ceaffdeee63033049708b8a7a1dd5842304e15.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE