������=�H�Ђ�t�e(A���(�k(Վ���q.kͥ(�K�j00oc� ��N���T�?Q0���������^�a�L�f^ �Q���j���d~��jZB����HlR�z�/���}%g�V�W��wtfH)FB2`�ŗK�R��ٜ�R��mI<�F.� nG�62����U��V���A2$똓Z4PCO��7��[��ޘ����=��[mcej��"S�?�i/�����j� r��|ѹt�����I+�$0A����-�7�6XF��}���gk��W'4_�kq��|:NͶC��h��y'�ԥ^�j�� ض#2j�S'���B��_��s���=#8;���h"�Δ�Q��a0r���p�}B����ʒ� Ãԇ�XC�<p��h�x��z�+ܶ�3UqwB�� H�{R�����5�@������KN�*�5���x�́8o���E���d�/6�~�BC�$R�l�1u� }�"����:>T8���E^ԡ%�7hdL�<�J2(�2�G@n������٦����3� ��s�� �5@. �n]�?)�-��K��L�{��wi�����up�>!���$�f;7/ԡy�6�9�!\����%��z�EgN{ G��SI_��� S�e����@�[͂Bo���;KN� ��.�'b��G�"�#)���;*�V[�30��-D ��}1b���Z�h:b���� ���;�����ɞf�"��3Hzp4:b3�c�I�.g�tk�'Cf̪6}+!���S�P���I���S_�O�s���W����P��/P>��F�iN���C�C���J��'����V�T��t��XmWڒ�:�a<0�Q���U�x#4��ܱ6��ds��Vz+��H[�K1Е[y�'���jƖu}$v�)�� ��g���=��z��gU�k���j�v����(0(d��Óm�� b�$��%� m�@%A�$%^o�z�"����=��}=�Qj�A�Y��S��y���<� N(��xFvy@�݊��o�HG�����_G�k�-����{�Y����g�;��c�B]�A�P�돸9l�C�l�Q��B�W��*3R��� ��"Qm$��?�&X����(��R������A���{��ē�.%\Bzc��O1ş�)Ĥ��p��i52S����Ɩ@�<�l33V,�d�7x��T�a��ʊ7 �G+�AoU�����qݽpL4q�2���=�cƎ�[F�ڤ��I R�L�X�~��}�s�ZNM~c�$SggcmW���-����.���L(��(Ø��CR�zu����X���2d�=b�ש0%�S�J xn���V�Z��̾��o�Fa�)�`j3����� ��F5��!�I?�y��������Nk�-��<®�T�,�0���i�f�����<��b&"�[=Q3�U��n�]�= �����"x��V�H�,ey$������;��5Gޔw�u�wI��Ia��3_Tq������g<,E�����)��bzw� </>��Dj_z����?��V����̵��Y�1����t����{����zˢ�c��!cl���� `dE��말�a��S���a4�釅?��G�?FlP9���|��2K�q�I��r7+� T�w�۟}i�p�4��{Mޏ�!����q���p��Ⅺ��L�Y�*É�(������'��x�I�S1P����_ϫ����^A���?s�C c������;R�r/�Kܫ���m;v?���=Ca�����y� ��I��0i�� 1����>�t&�'���C �5=� x������Ip�e�j�Y/-����`�>&�j�h�VU0�f`����w�f�]��,c��J@w��*�B��,⨦[���&g��`4s���K�"��W`W �r�50g<3��Eȷ�ym�E��8�b?**��C_{�<�����E*[�;ߛ�Iػ�c����x��c����Ƴ��@��tS�������Nˡ��bn�� ��e�H�Dua{�9^�#j\�}��0˦;Xh���$$��x��!B�`��2sJ]�g����!Q��&%ڱ�!c��6�hx���#�ئ��O�'��I�ݪ7I����d����4Azr��3��W�g��?����<!��d���@T�!֟f[qPɹ[��mb�9!����Û����N���T`Aw� :��+��o�8���w.�nmܴ!���&�4��1������i�Z_Z[�6��H�LR5EO�d��gH��n��y]z_�/6��n���ڝಬ�l�2M+���s��"I% 4��狲�� jz��l���y �(��5����cn�?����-#�v �ԗ0�o ����1��#�X(�:��b*�,ٜp�xM� P��Xl�y6F��5�v�ë���n^�T����ږ(]��,v�:���y��e�����¼��`0�}��q s���ߌy<��%ۈ�GU��49{)����JY_o���@�4��p����~�Xi�n+�_��]�(��-w�x8yOF��H�h���H�Q�v;��X��!���z���K$e��H�̴����篅z�M�����ҵ�\_��Ԋ�h��G�x'Y� "9�?��t�}VIE�tE��Wf2Xէ֓�6�|Q0x��;ے�N�N��#�g�.L�D1n� ,�;��,*KY�\�ю%��K�T�e���y�Ss�)/�$�dNv�D,b���Ru֣&.c*�EZ��i�a~5����@�����]ہ��:eeB(���Т�R}��u8�Q�J�8��9�U�BrL��ɭ�ڧ��$�(� >T�6�=�vLi������E�[}��f���]������]�C���,⟹�E t ��8�� qx�n�٣���Q�Y���EG�i�h��e�P��g��R�2C -���gX��T�*��j���u��t#�O�G6e��#�]���ҫ�J�h���%x:�}1��;��%q�? %v!�CЭK-W�ʹ7P��F3�'�`N��+4��!��o����=��]\u�t[�6�Gn�$^0QatN����.��g��Wl8�?���?��+T�q��e �om�q6S�a O)dӰ9VCf>����6��U"5؏$dVuf����;�}��6h��{37�w �g�ٺB@����Z>��i�X]��wH��R�P�4���wEB* -CBD��g��-3���Dsہ@�����`�_j��*������U��0��;Baʖ�r�2�\�V�?Rg'�Q�� ���AE��݀gDG�3+7�u���"�2%�pː��u7�;��Ǟ� G����hī���{[s�sWû�ܧf�����/s������<��� RE��T�t'�@�C �]wz걩��4x�-/��Cv.p�szwrR�?E2|���p5U^�ow]>Y����;�|v��L�f�p��ʞ�� a30�'����ש�/�w79m����8�ZƸe������pI�t��I�����vy������C���3*�)F��h�P����ܡ�ʌ�;�r[.L6;*$��_)��wx�����3ɣ�ܒ"� iL����8,2n��+�2o �~�X��}u=w����������w2|��Cm�
Static task
static1
Behavioral task
behavioral1
Sample
bb1c62a0e4be43a513fdb03ffbee4b0925d1691c7e7782253afb9fe99b71e028.exe
Resource
win7-20240508-en
General
-
Target
bb1c62a0e4be43a513fdb03ffbee4b0925d1691c7e7782253afb9fe99b71e028
-
Size
2.4MB
-
MD5
601febff419d24d39e90881b9b6a4c13
-
SHA1
b65292b40d12a621a148e595b11d7d9f088d5315
-
SHA256
bb1c62a0e4be43a513fdb03ffbee4b0925d1691c7e7782253afb9fe99b71e028
-
SHA512
c4f8befbb821679f27695684c370f6f9f5a7d6b8b080e6ba2967030f164107240cb7319b0ad8e8f57f854d1e7c06423b417c8c01d6f21a64b8827d7eeb5f118a
-
SSDEEP
49152:O++G6KZkCUzQ8xRj+PLi7ucdeCxdua7j3UzP4MMcK8uB:L+G6KNL8PjJucZxdua7j3UT4MMcKB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bb1c62a0e4be43a513fdb03ffbee4b0925d1691c7e7782253afb9fe99b71e028
Files
-
bb1c62a0e4be43a513fdb03ffbee4b0925d1691c7e7782253afb9fe99b71e028.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 41KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE