�����o�������`�й�'}�_��X~��C�����%Ic�]X������)LV}�iY*`)�,�&�%�ߠ2f p/��Yq��LQ u\z�� �-�w��4˘�.���\����Z���^�V�b����躖ǯ.�֖���{L2|�{��+g�z�?|z��M���E���&�0�����ƭ��+/���?/���Bz�̗G8=)���ن8���ʲ���������7��,�XO�6JXX����. ��^e�ؾ�k�6�t�����g�[Uζ�G������lO��#̷���`��8<��Ω���G������_��ǡj�����ɮ�'�� ���`E+N�b��*K�}�{�����Ro�c� ZT��8l���!�h�¢�%E0Q_xO�\E*̰G��c{������x�s+E/ڹ�κV �c�1�J��a�6u�� ���Am��;x�~�ثO���� U��yG�}����E$J��Z,%[-N[Vx�@���������DÚ���{z��o�%yceCp�l���Ru�¿$@Ǣ뫢\�(��kSe_�xb�*��P{�,�\ZfŰ?t�vWqj�D˱�%��V5��X���ݞ�a������,r�C��১-��4nk��j{�tj�Jk���x<9�R*��;��PG� N��{&1��<rX�z�|_�q��t�?��[�N�a-�I���[Uc2��o��ޥ���qt8B�#J�ڊ/3 ������66���҈b��m����MH���u��?BƓ~+�Z^�㌀л%R �-˫�t� j��?pz~P�]�s�H0���ĺ�i��$ �x�8�Ir�8(;��}]!�|���z�i \ֽ��ǂ�����J�< ���'_<o��ɼMO����]�Xu��2/r����a��ޔ��QnY샥Yz�8lh�>���+��h<��Ì�5���%�>���S���@�;a(�,/8jWB�sA��h��ю3b�����Cz.��M�n��O b���c0�ܔ�$�a͆�L䇝;dm_E����Ҙ�*�D�~���$��Y�K3Ҝ�a��ի5E������Hu�A�\���ܯ���ɻ�/,���[r;�Kh�M����^2xE����]>��n�d'��&��C�S��;��]� �|:��Fҳ9U�(f7>�A��;��E�_QA6}F�GCf$���u��y ����Rۯ^,��`���5tQ4�d��ۼ�l�����{�H��JtH�u����{�S��L�AS�G�Y6idY;54�a����U�T���L�N�H�G�F�f��X'^0J���&-��VF���zئ[4�;�a�G�Sq��*�5_��x�k_�?���w�b�א���jg���=b�#A�Rč�_�!��?^ʏ�-�����RV������|��� �x�/Ep�tk�`�����@��C�NGT8��H"@RQ�x��k�h#Uq�CԝĸnA��Kg��k��� S��g�靃ɵU����d�V���6�=�AXBI̙iqv��S���`�{��4�&�zm�4R��H��L4y��s5�a鴥#�5�s(��O�*,��x�jY�,�k�WA�4/6�+.�]'�o�8fJ�!�y4x:#��'���Nb]�?�j<�:Lخ�X4ؚka?���?� mk/���Tz��5T}�a`*����U �sck����z�<W�R�"��STB��p��Qp�) �"�W�az�����J>_z���G}���%m��~p���� G�@sG�H�:^��vW���ݿ/#���� R���X��a��-h��U�f�W��B��́�����Co�ygד�� ����w�R@�3(p����c���p3���R���;}m��\���T͐(;��5��.zD���t:�m��O��Ý��$��!�-߂63�.~c�'{�������M�EB�c��gA^��Yf����xc�����|����p�R�+�N^_�}��m�.�$�Y�����L�'��Y��]�%Y��vA��-R~ a|� �^�v�p������.�U�L�,���ZZ��ij �db��)����.��gd����ʝԚs[p�ըY���6B!��S� OVbb�����;yV�$�P_+�tE��^)ҙ�#� g#��S]w�6N���c�ܭ���p�Ṿ�N5�G�/6�����%"9s�l0�&�I|�����ub�G�����C�A�xZ5Ö>��?$$O��~�E�(����~B8*3>5|)�����|���d5m����Uw�����*$�yF��vc����o=j�/��� ��f�DL�}#Yc}��:xX����M�X@~�LoΪ��Fv����=,���k��aʋ�Ct+�+By�G�m�����+QFʮ <Ƅ%�"�Q�Qp��?B�e)K����K�~�%��U���M�,���"�{R�>em�-�Q� #M� �H���#�Q0M$�rVKh��_$Ӽ]���-��}HW�H����i�VN*�"*�<�0�Cy���wj����n[��^X͡��2V�!W�}���}MɁr�V�?�t�x�+�յ,����e6H��a�Lgj��LZ�>���Ww�B|s�㽠�EYAl�K�Fs�`����}�JT��)�0��m>#X�L��1��g�/j���ܩ 1����*¨�i�Y�r���i0~}Xm��ݭi��a���x@Rn�"ǽ�ǖt��6��qUc��j���~�K�ms����|A>��ߋ���!�����@����Ί�V"G�_Dy�o9��p�J��/���16�KE�1��s �ǡ�( ?�����4�4�F�$s�n�ښ�0�]��R\7�����s%��XʣQ�s��'|��|� �=����C�OX`$��|(� ����eН���)�xp�ۜ^�8����?8q8�ڂn�����g#u#;��+��Gk����pjR��$zS��m�;���mZ�9���( ֏S(�U��{�s@xꖌ�Z�R�A��w�l�o���8���|,�"9������G���)�&s��'($�T ��T��rݴ㰹k� 8rOa��*6ġI�S�%�Q"٩=�t��xpʶ3)��t��R�ڪBo����堅p:�����}j۾��
Static task
static1
Behavioral task
behavioral1
Sample
871a490c6bf0f54eb282793e08e0989f196e96998ed1b48b6a9de1b861adca32.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
871a490c6bf0f54eb282793e08e0989f196e96998ed1b48b6a9de1b861adca32.exe
Resource
win10v2004-20240226-en
General
-
Target
871a490c6bf0f54eb282793e08e0989f196e96998ed1b48b6a9de1b861adca32
-
Size
5.6MB
-
MD5
47fa07fa1d8bda90006604ad97f4bf25
-
SHA1
df2997f8da3a626a3037d5ab68894ae1e7f42545
-
SHA256
871a490c6bf0f54eb282793e08e0989f196e96998ed1b48b6a9de1b861adca32
-
SHA512
41777d53026e24cf81de0e38b57a4c217cad9aae98163bc8e5440dccada8e3012b6005d599aa79be0d6312cd260c5a420fb34ce1a51e9683ffa53a7e2ad93249
-
SSDEEP
98304:zJbJCGeQ41TO7u0DoEdDEQwFJxZzwKTDukcNB7LyVJ7E4c0Spm6G:zR8Ge1TO7jxYZ7NDukCIVJAR0cm6G
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 871a490c6bf0f54eb282793e08e0989f196e96998ed1b48b6a9de1b861adca32
Files
-
871a490c6bf0f54eb282793e08e0989f196e96998ed1b48b6a9de1b861adca32.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 45KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 17KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.4MB - Virtual size: 12.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE