�2Ƀ�f��y(�t)�x�Ӏ�,�*Dh>���'-5F������/�*e����|���Wƈ������t��:Ԗ��1�*6%��1�5?�ZӮ���Ҋ�xu��ģ2�������s�����-T%eGfY�T<B B�dj<���]e�� ��t�.=�������p@I;�O���;��1�QE���%Έ�N��A����ܦ�O��$�:�C ��ɛ�3XK��t�K<��*@'�]t�D�_m*r���_+#XB� U����$��N�k�O�iʝhX)c���\��/��G宩-�F�;=���vd�<����� B<�Mp����Ͽ��������B łzUXn'*��*�8���,������*5��;W�/WV�1�C���֣[��=�V���a�~[�M����W�e���`�t�$H�ѕj͌�\�5z��L< �=\����gn�3U?U�(��_�y���+=ɵ� ��*�����d��g�/>֨ �&~#f��6���A��3�a�#q�g+tD��"����9ז _֦��砌�8j�M,�Spn����U�Q-Ÿb�K�?1�b'm>����<���}��@fYM�'�]_�7�z]�t4�?D��~ +������Q�� wRzG㻁��CX!�/݊g�U�����K�x~�5}���h�-V�R2��2����*+�ܬ���(K�﹂��H"�͌�7���R�*�o� �[��{/T��8�C��n&�4�:�o痢�{u墁�1@7��Fpr ��H,��M��6[=��]|�HR3�Oz��%�>����]��z�Z��Z�|��S�e�I�Yw4 �U�J���\u��v�߳���Ђ�N|H�d �P��W�������l��?�g�3_��T���.F)��] s��6>���cz8��x�**+��&q6_��"���$��T���"٬���-b�1�a�c���hx�_�ZY3�2�ȧԯ���6s�4ؑtg�`&�P���V��]+�2��|���G�^�k)Y9(V�U�|��.r�p�=b!¨� ��|O<�X�aD�4��$x�5�.i�lU��i��h�������Kn,���~�$be��Y[��3��jwiZ��ڦ|�~+ǴU��\��<�Z� NX=fܺ��A"�~�����Z^j�J�5���FY��\�4������8�R��:H|�wڢ9��h&��W�G9�r�[.6[�<�x84�,ِ�JS�4kL��d�D1.���G�����R"u�B.�s}���%Si���[�k�1_���oLV�g�����^����;�t��NEW�;�[8���wƳ�8�~��H&��͋�����v�[�VNLxrʣ�����w��5u>m���R)_�]�I��yb�$*�d������i ���ϖ۪f5X�s�l�~|������~˕�����c��V�U��u���[����4�d����O����H٪���m$N������\hipǩ�\t���S��J"����A��4Uڧ0a��I#�G�Kq���I�I1�h��X���+��Y"O�?���p�*9� ����`��b#^s�zP�j���|O�>�2��ώ���>�������jk� x4op"��e\����= � �u��9�sC8��G��HtݍO��'a�O�c�r�Ϥ��jc��:�[�qn-�o�ehl��UX�aې/e�c��)�C�:��QN}�@[�+a�F�[R2�����Q{#{2�����~ �4g��]E�V�+�\Kc"T�x`����I��IjO��8�ؒ�q�{LjLw�3]a�S53h/�(!!CP�L�t����$\Oٻa�ԃ��K>�$�BIZ]:�`m�����Fu��� ���)g�l۲%�~����~�m��ƨ�,,9-��C�u��V�Z�],ޠ�����+2{��y@�Y�S�O̍>��}��G�%e�I<�x&��w�k�� �,���?�_�)��bEw�� j(�AAy�K� �U� $��m%����|��wL��e�a�S����4�Z����}4��LQ;e�ƍ^�d5/b��kחy4�����#X�ۦ��a7xOj�PS#K�rA�o���D���ݓ��t��*"!�߅]ꚧ�h�5�s���f뭉�.F���x��]:2fJA��&�Kt2�I��5�_<q�hu�7��������'����V^~�Nb�h���s���vz|v��>z�F��T�',�b��j|�����2>cs��:h�tqN!1K]�l6��lJ�� �?�zqBV�ԏ{Ζį[�=�# ����IR�Χ��� �~]kq ���oؠ-܁���e���?J�-��F8���a�%A����-��+��ؕ`��E!ͭ��{~��X� ���sVƫ�z��� �6^�S�u�����`���A^T�ﭟ6y��������x�ȱc#M]��:i�A9t������MJ�����f(�,��7��K�u!i��#�X�8>�a�j��m�$�5���Tg:"+m�~<R��)���D��ڧ��"C�;Ĝk�"@�<�@��x����ȃ���� 7�Bq4$;x��q�f+7U���;�`:�N��]r"��sJpA�j[��f!�3\�O��w�� /�[#�qC%�H��z�y���Bc�p��ǔ��'�x�mFn����NC�$�V�����>��9N�y�~т�7�ȱ� ���G�a1',<����K��Z:�u+9�)d�zaY5����C� At�K� �]1T�������Rf�j�= �R�۬��g5���L���� {�d�'ȑ����*d����U3�9����rV%|bE�`sLnI��c�Q��ݟP��2ɱ����l%f>��d�N������M �n���{�����j!�����No��)3�fQ��g�._��yg%�ZE9I>T�v�9��������Z47ȹ,���3!�+���쉏Ɲ�c٩t��DP�E+���f����A]�0����Zq�s��HY�<p��#������jx��ب]²��L�P�B? 2���ys2j���Q�;V�y�k�������Q�X� ���6�4V~�d��$V?�r��w"Uly���nM��'��v����˹% �^����j�W 4 &����Z����y�f���s�ϑ2�:��R��.��\�U�o���%�̀����Dj"S�{�o� r��Y$6 ���8��G�� �9����c�el�o�Z�zd�P �r�j.�[QC�y~�;<�� ��;��<����K�'L7���__�Q駌�Ja�j�k��!�� ;���Tisp(Љ�� ~{9�V �� ��C�Т� &��Ѓ{������zA�3��Pr�a`��X�^�;�9j��B�Ð�1h�B�[$���~�����[boW����qH�`����a��}F��>u�)����ߡ��W��{������/U�7Y!��雞M��� ��K_��"�K����φrߝ)2R�2��Rԩ%V8v0�d����ڇ&�\b5�V��C���y y!n�Lo�������8N�D[��(�<g6x����6O�
Static task
static1
Behavioral task
behavioral1
Sample
d825c35a588efd0111fe6c2990a6676276b2ab6c9ff7ac83cd24276adb092b57.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
d825c35a588efd0111fe6c2990a6676276b2ab6c9ff7ac83cd24276adb092b57.exe
Resource
win10-20240404-en
General
-
Target
d825c35a588efd0111fe6c2990a6676276b2ab6c9ff7ac83cd24276adb092b57
-
Size
3.0MB
-
MD5
1b767818e2661bb4b8474b061803c285
-
SHA1
6d44eb8775ab24956346024a462dc2302f14ff9b
-
SHA256
d825c35a588efd0111fe6c2990a6676276b2ab6c9ff7ac83cd24276adb092b57
-
SHA512
42c1f13b79971c591bc078bd9df4ecfa37208400a54dca903649590a1eefd356fd8011e0ef3ff090776e2d3129e573964fce8993515a53c81225a920e1388107
-
SSDEEP
98304:t62iRE+Duucml1o8P4lpiqLo8lSrK1jBR:8sancmM8P4lBo8E21jP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d825c35a588efd0111fe6c2990a6676276b2ab6c9ff7ac83cd24276adb092b57
Files
-
d825c35a588efd0111fe6c2990a6676276b2ab6c9ff7ac83cd24276adb092b57.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE