�Ym�ϩ{�j}��s�I��yư���O��wʂ]JG���Ȩ4���=�Bh�^���fC��G b��w�cų�����rBPZLt� �/���`���_��b������]����V�5��d��@uq8�����rZ� �8_"v`�R����E<�D�3$ȥe�Q��3�V��6�ݑ�q���e�x�V<�k<o�,�ZD���72֊��N&P��^H�c���HHkD7� ����(p�B���(�O�������=���j��)�%Љ��Q{��lp� �2��Hx?��P|�c<�������}�a��c�$J��?}G33V�VRqwH1�h�-b��帙Η������J��^��r�H�Z)Y��!��S�x����W����m0�4َ���4�����ث�&c�����iT6��g��k C�#�~�z��hFZ??#�ْ~4�����V���b��/�YX* ��߁.�P_Ba�\�v��� ͒T(a5�����1�6���5vB2�Y hf3����D�D�a"�S���L�u��A��D����#�rao�Kl8�ke%م�����֣J�d����/�g�@˷����&m����ht�)��Ў��A�L���HCnD���v��ߪӆ�wJV_^D����7�L#P���y3�Z���ё#��mf@R'c���-Ib�N����� w���r�L*6�����+��=|:w�4��f�`�( ��$9��r��=�#@�!�R���F I���V���ʢ68A����2[q�ů���!�ew�)wT�8���c:�]�cX�@ͣ}��U�F����I:�m��C��BO����s�V�|�T�f��f��Θ}� �Wt�� +x��+�y[^�œ�þǧioГ�E�`^T��5�]φ�0��R�Ϫ�_kUQ���Ჿ�؟�|z�Q��.c��n\��,V��l���(�_o�O�h����M֗���<#$Ԉ|j��u�h�����C�������m��I͚%>�Y�����h�w��LUWay��Ǻf�9����?G�`�N��}�W�x�����!�c_u��θ!(z������]�:)/"�3{�=��?��pGB���)6�"a?�N������7ה����6��b)�e�ō2���5L�[�oD��/��m�]���XS���D6i�_�5�@���'��4��˰3��N��l�5}�7�� �nL�Dv�I�o�r)�MPM��g��ל�c`$يŏ3:�0�Vhr>�6������Ʈt�Wa��+��p��c�����ݶ��m����%�������G=�`y�n�)��8�(V���:��@����P�T���+~�C�+�W�Zz���^ʞQ���R ~�����N��P��� � Ȭ��Q2��9x߄9c����x� ˨xO �Z�d:��.��]�/@���ʐ����<�z�y����w92E����Z�tz��6���[�Y�V� !8�f�,I L��l���X�Q�J�u��/)�8���"�/{��28=�w��c�J�8V�OTV'� �BR+�n�%�����d�T�'o ���'E�5{'�x�%G���������V�%Ix��=I������[,d����o��'����Q�3&��2�J!����x��q�S%%�Y$4�����\��k��QV�_��9�[��?��q�� ��J�S%�?�DŽM݄�j"Z��a ��v��������� X �y����z�K���#��K�R1�$�O�;���96�h<�ʩ�֕�#_����"��T��;�@ƹ8�u ���ƃ�r?3��F�������%;�7qV��>VA��vi'��jsf�@c�){�.��}���:5 �0?[W-�y��������3f�!poU^���ѵI˧qC����/>�LL�U���:�]���N\x����V����+o�B��xdN�?�.�xwJ�1Ohey���7�M3����B&�!}oe�%ֺ�WY��V̞���Y9L�qBխ�A�@+[M��p�aޛ��t�f4i`�<� �8[���bH"�7-ܨ����P�F����H���yjWz���&����d�ߞ;�L�J�qrO���x�,�4B#i�H]�v���V�(2$4�i�A��Ҥ��Ă�����a`>/�?�9�ۇ&|� �����R�@N��>�@L@��tH��W�*D��!c-�y�-Gj�^�x�u�T��:0X< Z���\ҧQ٪Ve�6�K�Ǣ����)�@��AZ�(����aHi����6d2*P�,�M���� ��p� Wn��H-��7����� -�V�}�*g�ӱR=2z-�E�A�X� ��^��%�j+,4��c�V��6�\(�I���)�j;S*��ù�&V��ـ�QV3p�:��:;��X1�� ������YT>�iWXb�@��oK�o ��gKv�KDh�$7���_�+F�ds��U~���,�W l�$�PuJ�$p��ݺ5��&"%b�K�"�3)��d��X���rlc���*�K�a�ߐ������ s���x��yԍ:-_ ��v 5����]o��>� � t���������R�����z��Y��� �?jk��2 ���P��@�J�a91�Z��~d2�vۭ=��Н&!{Z��L!�(�u1��$��$w�\��8 �H%W.t)e��ȷ�z���CL�O�D��g�Ef��� �<b`a��4C�F��,�]�����,����b��F��`�KiN�T�e��r��Ğ��r ������Z����)n^���)�G�Բ����"�q���^�[����3,i\��,q*>�}��uo��Vݕ����Aeڜp�IJub�|l��ݸ�&�=D]���=<���~lm�R1FGq��W��U��mv��xЭL�ׂ�t~������8�Xu)�F�9I�m��(�$�t͆.;�E+{���is��0�c ��5>a���6���%����8��7��c���o������dq�'{g}_��j��_]�� �ڌl���lB��x���� k$���v�r�לdϤ�|4�J"��Ҏe��T_2s� �71'#$Zt?v���C]Ϲ���FnFE�C����>�o��7��ve�����3l���<�`<��6�r��Z�2'ְRVɓ}/\ܠ/%�۫.Rx��1��bi�}��~���b�2��_R�<^ЂنO�������fR����l�%Ƃ��6P�(�����Ǚd���qLN�C���� |��W�"�I+����H[�f�χ0�����f�����\h>�и��C��dƙP����~O����R��4��I)�2ė��}ɥ�~`��Q"�b꒲�m�i��M�2��Ui���j�� � ���|�r=�+�;zB���B�?T��K��Y(q-�%��*�������Hl���\�s~s�~&�1���ʄ&��ָ��@_�Ҽ��3�Z�4�5��a곁ю�Dbc�r�H�w�X�?C�kz�;WJ��O+MN0�O�����i�@��ቈ�����,1�4fv�p����®�������ng���i�`��V�fQ�n��9[z����|v����m��#[_�*�Fs�'�҂1�S����#,��BeJ����W���a�z����s�u(ό���/�T��Zk/�]�@:�V?�|pr��u��)��(�5<0PB���
Static task
static1
Behavioral task
behavioral1
Sample
2c6d25c338bd37724fa365bd0d073d9e8694e6d81173fa38cf463745476f8f69.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2c6d25c338bd37724fa365bd0d073d9e8694e6d81173fa38cf463745476f8f69.exe
Resource
win10v2004-20240508-en
General
-
Target
2c6d25c338bd37724fa365bd0d073d9e8694e6d81173fa38cf463745476f8f69
-
Size
3.2MB
-
MD5
d65fb214975dc2b7e383c692c5b43310
-
SHA1
4d099ce7a488c8ec3134280d1c9eebd44b888114
-
SHA256
2c6d25c338bd37724fa365bd0d073d9e8694e6d81173fa38cf463745476f8f69
-
SHA512
199c89c7b7b3956090a983f88b389f6aa43e9cc391b54648c096ae5c4a18f6bbf6d845370ddd9ecd6088caf01a8c59a530b2c7176efc23f5f4c53eebd800bd4f
-
SSDEEP
49152:IGqaRK5iC+CM65ld+JHovdJK/l+OwohnNc2RYOBi5aoJ67eNmVc7EnuV4ZFmtl7O:IGo5iCztDK/lxwoQ5aa6762c4iXm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c6d25c338bd37724fa365bd0d073d9e8694e6d81173fa38cf463745476f8f69
Files
-
2c6d25c338bd37724fa365bd0d073d9e8694e6d81173fa38cf463745476f8f69.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 36KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 18KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 144KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE