WW�˜�.:zaG8G+�aE�k�;�;�Gh%�P�Ex��� _���㫊{��d*+H����?�N���E��*ABD������5���cM�}�" �ۺﲖ2��(���r9�Y�&�����������*Փ7>�����j���1q2��f@n���w?�ՎkF-kǤ��2�P�8���yZ\��q�<�':� � K���-چ��Js-�W$M���(�����_�c�Z�G-/_�߲��q��a�����Td$3��\�-&ȑ�M�ӏ6M�'��)��ѯ�`����- �W�"��\>��P��m��������NPi�#������[1��.#�>j;�)_u�p�<�kO徴���L��9����)�ܤ��!N��V��G��K9:L�x�� 5��g� �I-��`���>GZU[Itu5{K�0*ܩ�A���Q`�~�/��v�IQ�3�!w�d�����Iz��2�}�E����-e���$a��� �� 0��FT�@ՈV~�%.sq���!�_E�0��B,�Y<'��B2�+�[�A;�������H?B���'��0�2�}U���5��A��C\ޒ�oL[2�^��X&�m��L�j�����5�^�����*�X��5�xѨ7�e�u���6�֏� ���}���/(�5�g�t"�7�Z��/#��>�l��:ye�F{F��EF(!�*�ʍ��-�z����~Z9���ʣS}�c{Փ�a��z���t_"sL�s�3�ü�,Q��O�Y|� ��w��U1+�ڞ���3�UHϦ�B�E�H����`��B�� ڡb^�5�w�M̥��Zk���!�30�h�M�ඥuᮍ}�k,� d�%��x�F�C�X�%Yv�ָ����8&A�<�yf�����6#�~�܉L�r�)��'��Y�N����Q!�������F�WQ�/��c�w�`�f����B� -�A�%� 56/�#���jd-����h���M(�J+��MLk&̉�O|�Gun��? �uJU%Z1�L�S�ۡ���.�C�$C��yԓ�����RI�,-D_���8�������X�>�B6u�U�@������s�9��[CVB<k퍝#,�A�eM9������%S�s*�f�CM��D'(|H��R����L/G�X����Ԃ��>b�Lw̺ѭ���h<Z�o���0�a�Z�=P�w �f {��Ǯ>A�G��t�w#-��=�!y��[�y��BȔ\cX&!i��C�:�z�p��YI%���0�d�F��f�Y��+"�̃@�o�_6���BpӢm����zy��w��?ߦ�ĺm��� ����F �o%{j� �W��r7t�YS�Ш��8R������G�I��*��OZ��~D���`��H@��� ��2�+-.1�ky�P�x|���w���㓫�����r��K�Cp� K���m�֬a�p��f�B�Ɖ�o��bY�6��Z6�ʅ��<]�X�{�2�*3<�7����&0dAyP�'5�Zi*�ۗ��c}!�p ���1'�0��]G���HMW�1CQ!C̦�{p��`��)p�HD�W @��Pb�A� ��ּ���kj�T{i�3�Σ���h����|"��H.ć�Cvx�o\�<+�F@Q|����I���7���]��!X�К�/���H��/�-L:����q#���`�)��5a!�W;����'�T���r��tƈ��.!WM �v�R��-��yqa�#��=9�l8�9�3�w7����K��hE�����f��1�s7��Q Y�q:�ǘ��%�����O(v��N����h�!��������.}e�F[��t�m*^i��[#M _�1ngP�xL7��U�r���kz������sI�:N��\�G$>�L����� Xm�p�W���-����s����*�p��B䵲s�L�Tٖ�E(��Ɏ`���T= �o��\HP��<��J�-�S�-zL�2p�|ǩ�M������`��t$����̍�[ц0�v��� d?�Y"����u��ˤ���UM�D�-<�S>^<Ot3Ol�̭Jh[um�އ3�n8�i`Da�������LaK��FLȰ, �6ֵդ��N�D�뎽 RM�.`p���:��AOdA�N��2y�'���qQUNפy:�O��YբG0���:>�J�*2b�F���5�@"���Bi���Lb+cY���o�E!�$�uM)e��]��;�$$m%;�.@��Gϙ[���֡��e � �4�t��'..}ʢB�hT&����u3 4���������i`.(�-:�4��#)�O�3����бMS��0s�4� ��\�sʫ�a�Z�L�{�ĭ|�h���W.���5tʅ����Xog�D�;8��]Zg'Җ`��1*zw��1��.�5�r�����q�#�9, ��R�4�o�]��`��?�/Y� �J������ᶂ�B��j�ώ�/"1�<�BT{�1�m�欕��R�)W�|��{���$�k9��ӛu���/��d6=�X,�-�H�V{�\:-�u2r���?�}%t�B+�۷���UG9�{"�L��鴄�W��yx��my��n�����H��${�`�U����+�H�3e}'�p�F��#P���*��LL���@C��״��|&�Z��a���k�����>b=-<�8��4F\j(�j��;�b�&��z9c]��O傟���]�b�N�h����K?�f_kכX��g�i��^`�/ʧ����p�>�PTle;nj�G����ty1��(U��.��p�LT;�� vѕ�_�&�`wn�e5����E1h�Syk���;��o����]vR�����G�]���1|��%̛O��R�i������y��0����I; dx};� �+%V#�6�rd?� ��d��kL�5D�Pe�x�1��d�"늴���aƖ@�ֈ����,� r\��������:�mЊK�5$��s�.��/>A�'9沚��7�ɡ&���m�^�)�,ý!H���s�g����[� �t _��6:*����.?!��L��� ~m�Dx�^�=�,Bd)�}ɏ9��}-�UGF��D�x�J�k !m0�p���a��[*Lo����Ð�������"q2�͇����rak��;2�Y����ld��A��t�<�3��������]�Nga�Q�a!�| �,P� ������$�Q��ݶE��b=M�v�&��ſ����P�+ R0Q!Z˃g������HP�8���(�� �H�j���*��R�P����(���Υ�0�n��7�<��';/���Ja+et�;q�\��$dg��ib㾑J��1�oħ��;��;\U�}���픗0�]�� ������p1����1�������f$g���$��$%M�����v�J�u�C��́ V1wR����;iѻ]Ŀ/��#�Y ��?�`Pw�g�L 5{�}�X�z�6�ed%u�n/H�@ҡl�2ۯ��P�p�3��q�^l��_JK���j(�5_
Static task
static1
Behavioral task
behavioral1
Sample
41a1d2e501af864b1d9640fb49ec0d80f3d0209e27f43a7e632bf69342f5f583.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
41a1d2e501af864b1d9640fb49ec0d80f3d0209e27f43a7e632bf69342f5f583.exe
Resource
win10v2004-20240508-en
General
-
Target
41a1d2e501af864b1d9640fb49ec0d80f3d0209e27f43a7e632bf69342f5f583
-
Size
2.5MB
-
MD5
38217cb710b38b2db6e50c329d0a92fa
-
SHA1
fda6bc9e1cdbc0c0b51bfc1d6c034f154f63ac63
-
SHA256
41a1d2e501af864b1d9640fb49ec0d80f3d0209e27f43a7e632bf69342f5f583
-
SHA512
d8574223ba98c7e465fba47b280d4ce50a6b06bfbbb2e53707951c25cc07b31a7b221a0c8b85d821325326d82455e74fb71e34b96cb26653d4a938028ab0e6b2
-
SSDEEP
49152:frmJKHmXXmiw0mEzEQC6Fvw8pyAfQcqFnwL0l2yQIq//znQOqOG8:QZ2iw0msTxTpyW8FwLuc9UOqOX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 41a1d2e501af864b1d9640fb49ec0d80f3d0209e27f43a7e632bf69342f5f583
Files
-
41a1d2e501af864b1d9640fb49ec0d80f3d0209e27f43a7e632bf69342f5f583.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 284KB - Virtual size: 680KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE