C�dKE�*�HMZ5*���&�6��x,iݗ�0[�����-D�_����,O�^Y���Vo��Z�@r �f'���9�ο�:6x����{�T2��=@��Y�&�ɫ�]��WZDIp_���������=���� K�2=\q�����[6���ӫID����UqM������Y�C� Z�^�s�����7^�<'����^�u@�X?�YEq�����Il̢ѓk2e��3S� 6WMe ���<�W�Ǭ��Bs�۷M�]��F��t��b-Ta ����J�]I�DX������jRɷ�"�7�wR��� fB��U K���\���_�A���k��M�h�\�h�����Vn���3�b6�*�q>�F(M�>(a��&m��rt��5ʭ�3A���!���26�����G+�l�w��6�6bE �h]7P���h��1�h]g�����\-���k�p4!�J��7.��n��֙h}��Z�zjM�)~��q���[�%�y����لF��Z$I�,2DH9\���?#�Zߚ���:x�6G���(�6Z�K,��a��g��q�Dy;��{ A9�Hݶ��]�� D����d���%4�c�P��*6�W�L׳����2�����e�%�� }M7|�����v�;>�XY��D�x��,O��/���L��(���(���yӅ#�dr~��V�S�)���+���Hy�t�P�'����-bܠaf85P��<dkd�Ҽ^N&V@���4�SmQm��LgU�Y�vsB�^����8Agu��8G�A_aʍp g$��C����5Y4�~��`�r^� \ZlFL����t�����H%��*�����|�ԤG�8j^[ �����7tn�'�S���Qy����6߄�b�$A�σ�D;��;$���q�Y�Z'� �Ɨ��_�K����f�y��܅���\���9��E3�����jW:��2I���[���Aw��Ʀ�;� ӝ�vp��c(e�)�ky�= �[���On�\�� p"oˢ ���g�&\���i���q����P�hۧ�yW�&j����5��X8��u��|X��G�lWE��X��tn�ݦcg[P#�I-B�U��e���%�ũ�Y=L+�S@�?9��?~�[��'D�0m�q�֞�[�0�Z9A��_ ������&1x�K����k=N��'Ż�>��+R���"�3,+i������"�U�l�`g l�����j��f5$V�Vf6�n] ��i�˘Z����CL#�M�Q͢�S`У:]��M&�1P��zyvZ�)}����ҁ���j�|��e:�J���d%ʭɘ�o?��K�W<*����e5g��x��b.���z6�������pC.�(Lپ�@�Ԩ���`��J$�����.���� f���ɏas ��e�- ����v%3��H���Iy�i�2�&U�@}�{��C}aZ�fpR��\f��>�\����_9���9pL�'Ѡ'r �省�Z�7r�X6��\�b!����[Nԁ��m����bZZ1X�6����V�n.�̑ �f��_H��[`��2��IA�1�c;�4�<B�lZ�}|3�|��a�� ���p��XV�k�M�����g4�!��^Ԍ9�����J4��>����v��~����߮�.�$_��R��J�B�R������(��1��{�p�y�>�v��fo��X,s�F��=ql�3�`;$���z�'�Z��,�A�D�$��l P�D�!���N!�G<�ST�U�2�}���8���Ꟶ�wb��U�_��X�X/P�N���{�6]]��P��{�_0�tLװ�Ci<+�p��vs�/��Tg<q2�y�c�<��r������H���<�= �- �t(Ѧ,�Y<Y�±�ф�~��4Ǟ���av�O��@.��C���К�H�eQ�E�q=H4_t�@���'[�=")Q�8+�9�z���E�#;��{�@s#g�f Z�^��&�|e��'�M����V�@��jv�n,<8~���8���d*L��#�L����� r�����}c�rG�>T6`/=ZBs�D�ؚߜJ�k�\�c\�r�cQeJ��Wʘֱ�����w0滇hƦv�[�F:�q���-0j"at��J����5�b������&hz�ӛ���0hE_<Hղ@&r�W�9����� �������&_��o�8u^��ZZd@���)�F��5E�0��o��w�-F�e�Ѿ=mBT�e���|��f����ƣ�DE�{l���X7�U?��֒� �,��7���z�{ݘbG>z�&�[d-P��B:9H�'�3n�}�J������8�����t�*��f���J�t��Åd�{��Ϝ�Δ�W[�!M9���p�D?i�_�s����a��6'M"o���Ke3�&�������ᇳ��3��+'�AJZi�s�g�9j O�2����a������4/M�g���ek�z��*b�&���Y��'��w�C���+B9`�>*�7�'�{P�$����'a��!?�B�~��=����{\7"h=�t��C��KY1h�W�(Xa8���<퉰�C魤gZI�+t��ҬcǼ-���Mhl8�"�s�=sHB�7�M9a����+_�� \b�����~mu�>�V��3v����m_��/�̐��}!�l �jkO��CxP��J�U���Ë}�W�PY���X���e�)�sf���\�m��( Kh���3Z�yY��~�<����@�&���%��M��Ӽ�mV�%!�ۣx�{�C��{.��c���5���MB���/Slw$�9R�4E���8S��N`��*�v ��K&7<%D���:���ϸy�xA�nq�D���)�3��51���R���ƃ7��^�LU���2�) 9��m��(�MFA�{��ݘR�_�t���ݿ ��+�u�]��\������b�#*��c���k�V�~p��I���c��5��ku��7�����Ӻ�sf��S�P�h���[8����߀�!@��Z����� b���P�Ľ�!-z�n�}Rv6�6�{f�}�bα@�f��#��3ڌ#w��}r��--Z�߮�9}_1�0�����]�Ţc��hf<n��X+�|$y�@� ��#ō�h7N��{��l�*���Y��"�i���J��V���z�����(+�'Q(f\��[���t�9�bT|����/�bf�w�gp�n���A�KgQzu�rC��d���5ػ���M[��8�ni� �k�f��Nr _1���ԏ7�N�O��0��q0�c�;��U� H-;��IZ�ElX é�d2b�Ɓ�=H��Ja9^�Me��WN�������]�����M}.B� �+U-���qBp v�\Gf���:�[X焺��4#}z�6cfNWp$�Ů��_|�%���g��]�^���q�-Z�lȱ�kW���#R� (]��3ϖf�0"��9߱�nn��l9��T�jaR��pgF��T��D����"��0�1����Li��s�9� S�3�"�oõ'(w�L�HSP�R6����+pP�`���u�+�H �������ӏ?_�B��� $l�6�&�m�j���\����##S����`<��2�Z��U��`Q�P���F6���hC �/K۶��v��H� Bۚ���k��JV�+^X��Ů��wMa�}�p�k3�\�\m {�o+H���+n��&E%
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.Evo-gen.24985.2969.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.Evo-gen.24985.2969.exe
Resource
win10v2004-20240611-en
General
-
Target
SecuriteInfo.com.Win32.Evo-gen.24985.2969.exe
-
Size
10.1MB
-
MD5
07c9ef1bf8898622fdb4542583560f92
-
SHA1
53ca48c202f78408e200b84199e24ba2a50de5ad
-
SHA256
e3d681a2cb0f8e031a9d448db63c6c78e47fa1a7063223be8816997efba8933f
-
SHA512
e82df7f0798326905d87ea8fdc4b50333eb1901a3fecb879ac865d36e39fbe6957a2198866f3c9e9518eb35f0701341f231595dfc3ebaef75c0cb8cf918c052b
-
SSDEEP
196608:1Ly9Bhn3K7+Zx63eVnfUI0AumeCM1FFEAt64JYc3hH+yOViqgKYXFNksZvEJ:GBx3wK0eVcvA1eCMDFE+JY0hHGQK6dM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.Win32.Evo-gen.24985.2969.exe
Files
-
SecuriteInfo.com.Win32.Evo-gen.24985.2969.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 78KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 29KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
tts.pyc