�!Q%�;��}]�)�B���E0w���ZGM�Q*�j ,H����>�]���V��z�څ#9P�>s�\�iF���݉�����ĩ�8�-�h�ݲ�"u��Ӂ���yǐ�-��.����3�%�T�&V��왚R�:�B�����g�ywl#�Amv�7,1�Ҁ��i�N���E��@����}(h@�j����2ς��PނS��Z%�]��N������Cf��D@���<p����������%.r����O�{mj��Ƴ'>;�q/�}߆|Y� }H���$�-�9c�!`��;r1 v��D��6yY^�A�w.V'b1v-�*�YO�&E�6s����cGG�]����Nѻ��9��y�%��Sڕ6|ZuX�����Z9��@�� �j5��1XH1^���n�}rZN������aa�8&"���Rk-r���gf�ȡy)�� ����������z �(՛�ی�,ޜ}������x�� qk�^R?jO�)���t9n�w�py�� U��[U���)��٭�"��0�;J+M%U�&����xÖ/���G����!���TȦ�y����-m����b>�o�M��yڂ�}t6O����j�㰑����H�����#x���5U�)�R����bԋ��^���@��G=S'0�D4,Ҍ���h?����e���ct����D5d�����m�� �z�5@.ϛ&�䊒�l���M�w�d@%�P��%3����E����AKd�Dd>�I� A���婞��9��k[1`!Xv���?�����K�{����B��m��#�Ĥ�1��Ӆ� �����%���Q{� � ȶfu�����(Es�3���N�W�#����J7V��D�ʾĬ��>?Y�3�R����B�aR�3�'�Y*������N_j�9(�r=+D���bt[&;�&���,�{�X��*�\���� �������;n��U�̣E���u�3�G�np4�h�׳��N��o)��4(_?w��;�L:�Fw������qFMy�43��8�,� z�j�r��wi���h��}k�?���B��U*�u����}�� �YGD<�֍"K�C�p1�_� 3��X�K#�Ċ�+ !�ռ��_9^z�������M�7�}K�^�ޔ�68������v�W9Uq���ʤvaX�����b��&�N+����/D��}�y�H6�Z�uC�+���^ �+���7�mri�+'�`�� !h��Mm����5~���B`��;��*z��1B�`�hA�����^v�QCM��k� Pp�t�+�CE��R�s�����y!6k��}��l���N|C��z�( �FiJ�D]���b��W�M�i����g@%$�J36���e�~����J`��i�U͑]�N�x+��l\��b�K[�3\�=�j�&V�Td;Π�����(��E`����&�����C�9Jr���e�i5�`P_��=Y����H�_�7QH�A������Xoc?`���%�<�Y�5>p��B�%� ��Yl��v�dm�7B?ݻ8�r]�6�� ����{& Ӛ��o�i v増�o�R��n�_���pе��Y�-� fXb�M��R�cg��ÏF\��Lϩ(�-��w���{�/jg,2TNē^�Z�y�=�[�'���_k�ܑ����|����P�� !��ΰ<��kd7����iQN�jB���Y'ia4�����[�G�a�2��ZBȒ�,H����8��x���M���Z����ny�b/w{��8�\�0A�D:� o��֙�G��%��x��". �7Xwi�� �m���s>ZT��N�`;��hʞ��ҪŲw�Ú�b��&d��� ��0^l�|ٷ_��Gb�AwxP�������$R�c�o���(l�ܨ�{l��Iܱ�h���c ��!o�3��G\+�F4.k���(��AVu�S��^:�F�c���ish���S�|��������r������_��6xk�?|;�e_��嘓�$ƫ��E�Nt�(��c��\� b���zA������'��ECö�s k�r�uc.v�{��s����b���U#���T���Qw�2�X�C�`D-L��;!E�ks��ٝm�v�1m���hG����T���c㛴��F���Wcy�cH� n۴p��&�x�����_Γ�r���4�coDr�}���m �ָi� ��s���̖Ps�K����z)H�Hg�3��'�o��5�et��JS(���A� �����b�}V�;��^�N�f0�2� �cGPmn답,���O2!����K�}� ��F��b��K�L�ܺlv����eo�b!��AD��JOI��-�b��Q�Q���t��rd@G�7��^5��<=��zw������(��[�3oI���=A�����g���U��~+�9G;��A������M���Go5�2�0j��<5H���U�L��3������{O������eƉq������e���MHOY�Tm���(�l�Ծ���=Q�h&<����z �~�%�v�,�f�h2���"��?h:�>@�= )K��@J]l��@��<=ŧ�-�Q��ۄE�xl��_+�9}���^x mG�s��N��F?❹��$���1� $N��`������?DqY��I.>zq��#O�S��@�O@&�e� ��ݝ���1&#���^3�?xA�r~�;��w����@惾"S%�qE�=?g��g���Wa/�ks~,IfD��^�@`|s� :ʗM|�O҆ ��"\y4��ȟ��9��}jP>�����kZ ��+�L�uA����6���^�(��$(�W�$�=�f�I��~�d�����^T�p\�t�v��Ai9~��n��Q/y%�\�I���K�͕�wu��C�O{��6}6�<�z��E�_�Pͬz`W�P�ʰ������s?���I��vS0����y-�1#sSNX�4�Ө:ǚ�^�Z��`ĸ?(��*����]�Dy1��c�� 8W�Ũ"�-m���)���=��#�Mj&�U@�'�X{�%�gy���j[}��� ���}�B�v �5<�R#������!�Jԫr�}E/= ����=�b�P牴��9&��/_ v��?+������F�gK���|7�O�@A�ذ��;�3��n"Xr��A�R��pb�!β�^��tnj~��h �g��h�9��q?3E�,�ײG��3X��#����aԏ#���7�+69��ަ� �'ٞH_ �|������r��Q D��|?�bd�A�m��Vݬ���>��#�w�0�7�B���=���<.����Q��Q��#��P3�a#.��4���ڜ!��w�,�� e�"�ሔ�H{�j�����9N��NDs/�^0>B��@����I �U����rv����y���Z��;Ĕ>�y�8G2ew��ϛ�'N��9��op��ʹzo�Y�+�� jkӒ�^����S\���̥MIhb�S�bhd�:;�d�(���L (hs_��Z�6/�%O��.�&�� FP�;��w/P�e����g3
Static task
static1
Behavioral task
behavioral1
Sample
466c424198c3beb91ab8c485e7ff9373cd45647324adebf41c296b7e007be850.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
466c424198c3beb91ab8c485e7ff9373cd45647324adebf41c296b7e007be850.exe
Resource
win10v2004-20240508-en
General
-
Target
466c424198c3beb91ab8c485e7ff9373cd45647324adebf41c296b7e007be850
-
Size
5.7MB
-
MD5
3e4de5fdf9415d138df793c294bcb1f7
-
SHA1
20bf43e347f6cf4dc46479a30a16cf14812eb759
-
SHA256
466c424198c3beb91ab8c485e7ff9373cd45647324adebf41c296b7e007be850
-
SHA512
9612c7499cd70ab85185404e35007270934f0b2413204f9a4f8f790ea1e14ad3d47f090b04732a7f0a079d45681ad13a375f552cad4978402035c4b2827a1d6b
-
SSDEEP
98304:WWGetDoM9mvyxbc2eEciCYJgzEos3UE3Hmu6TmjupqdHL/d3Ybp:WWGUDoqGVYu83UE3mucmhxd3Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 466c424198c3beb91ab8c485e7ff9373cd45647324adebf41c296b7e007be850
Files
-
466c424198c3beb91ab8c485e7ff9373cd45647324adebf41c296b7e007be850.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.5MB - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 187KB - Virtual size: 688KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.5MB - Virtual size: 9.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 12KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 119KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE