���P�J�#���� ���l|���!�H�����:^�]�遦|o�DX�����Z7퐂�cAiʜ�*�XѺv$� b�~����̶S`*����������S��~ �V�=�{��&���D�L)�]�o�"+�W#@v��[%��A� 2����������;��B�6�8��ے����Y���Z=Z'��k=��f����_�@|��L6��(ݍf)�����<�z��>n6���6S�⥺��"W��"G��J.s������ue>�0)�^gt)�6�ogsr/�o���jS�ѕL�5����:���=0�[x������G*.g �u����k�Op�ژ�9�I�;c�Q��afc���o���%j롢���*�RHLL�Ẁ���l��AX�|�%Yl�#�6Ub)��[��E�P%5�1��q4I����J��B;���1���u9�WY "l��F<50q֘)��g���'� �[�M4�ι��W�+N��P�_pL%M�.KCP�FY���b]9X���N��4~@\���:/�3멣�$5Z#��G]���-���̌��y�I�l�;0g���(/�J�ijv��1k��u���@�0�GB�m��oS��2Ԣ��9��k���b�|��C�nl57Y�\~�����ÿY/'<K�u��P���c8#�G(\5� F_�C�L!{�[23G�K.����v�� �y1������Z�k�1�=�CL�I���6�]������z� �:��B���Tqlr�mQ8qʥUk7���ג,҇:Q�uc�{_���l����`Ntט}��'r�X�{R\���|TOi�I�Y�R¤�J^!�Lɀ�s�l����/Z�c�g{�l��7r"u"���CBw�+��^6K^�����ՐvE4W4C��?��Sܱ��5 pZCrI��6U��C��������Z�4�� 9Beu^4�yw�(�)� �b5���2��I_Į�vK#�����َ$��=�خiM3�^�䷮n:Y�N*��&@r�; ��s���64�ģ�]��<P^�hQV���������;������w;1O��s���us��L~"��M��!��=�)@��Fc������[�U��t��~>�˺�I��:Y�:r�pSAA!�{u���ϓ�Gu�-�>�kݞ��H�H�6�:�;��=�@?�B��+����p�_/^{�_�����t�(��1�Pt��/�x&W֔�#x�Cf��o.h�A�ۮ�S�� �γ��.Yݮ���M�;x�������_H�k 14��$=L1a�������5��#��T��cO�ln��ijnщ�n�G��p�8�\��'�}��y^�B^rW�c�H�k"�˭��(����̭JsA��Cd�,ԓ͏��Up%=�<� ��W<�p����Q��o�9�֢t<6��i_S���c; &��G���Y�ջ�2$�aJu�,�P�������Y���@S�<�2E�oU`t�1(d`ۜ��������of�2�s��v����({��D�5*����;ؚt��a�.Gk.i�� x�Fi��d؎)�Y�҄ f�`;Vn�˼˳ש�ϫP� [9�h��R�X3>��d �:~���vC �'�O5pf��U_�5Lf��� $��&��j�������ݙq2�j�~�� 5�|���>��$p�.4���t.�# ��{t{�)`з����PQ�i��۰O�S�h�O>��q:[8��&�"1��e��r�*���j5]��/���O6���rÜh�H\H�^J�]�-�e���;>-��@k�4�r��Ƀ��CCLQ' o�"��%�y����\Mc�A�'e�O'��Ӽ0����;��H����JDexŇ�KC�l��_��8�ȉ�N$�*剷І�j=oϰa%���P)����?����K�J��|�R9Ԑ�������f�՝���U����C�P+���*�q�f����� t �V��D#?�Ez��4Ćb9�����V1n�nH��q)�Z���a�bd?�)�v�蟗xW���z��KW~����ț=fη [��p��C�7��s��:B�|-j�E��%�����tl���k����(l�K�IJ��xA�Ճ�vI-�:I}�b��"~�E�5�ޥ*��C�i[��!�4�u��s�������;��̨���2Z�9�=��^V��ǖ���p�*�)�����K�q��)�=��P��d�� ��~�3�0�[�M�nVU�Ɯ"ڮg�d��ᔆ)���f�Gl��@��̬<n�c���}�����w���^3z��Yp`�ѿ�����~�諵s�:�����X�6k�9��t�\_4�(D�x/D{U��ȭ���N`�^DՃY��0��V�_���w�i3=�[$���u�I{��c��"����b��9�Rx>��W"c� ���W9� ���"�����I�*.Y����)���2l��v�d���I<Y��$,��;`�S�TE-�� �(\)�/f��4��$%���ց��c���F@��T~g*7�P �(tCy�)�!��4�;^k���HU�_F5��v� 仹�e(�:�y��Sk 2b�{���YV�P%�-]K�ыe��c����� [G[@h�<���Ej�*�P �gE���1�8D~���� ��J�+Nb���C;���rC�W��17�0���0:��u�CQ��.>�2��)��?������Rs���g1��z ��@n��;��'�M�n~L 黧����T��l"$E �Ѐ�Ҫ���H8��,]�w�PR�Я\��+y�uٹ�d�� `���;���?aA�[�|캜�GS��*�2�Ol� ����D�l!���Ӊ�� tc�հ�$��WHPI<Г�Zn�Pp4�������z�켦dg0!2�����N�M�D�6 F�n�ԉk���}ZBj�(�U�<��gch Ŏ���c�������@k٘�O/�!������MF�1R$� J��@�˗�iR�:��m�Y�Fk��qAӹ@r���?��Yd�� �Z�$����v�"�RB�b�!��G�*K�݅q�&r��zj���&Ǿ��(ST�̥�7���s�C8b~��b�NŁs?�chh��|p��>�P��n1 ������jnqKC� )��C Sj��1P]��x�:���A���o���f{��Y�GW�r+~3����D�����lCaU9������d#�6�m��iP1MÂ��=p�9�`���{^�/�߃Ņ�;�)'{L��� ����3|�)S�:. *�۷��-o�TKT4e>��d�ϝ]ؤܫ�B���$y���L�ނ�OExmo����eI�^������0H���c6��F����+l�R!QO�;�o�N97B��.D�TL�G���b�҈�8����͖��S�_W��{�C^�i�����3�)e{C5���23��y ( H��L"v��e���ʋ����o�@�x�[qy��u7�0[X3h��9�d0�&33���A�!{�?|�LQ��a]w��i� �}j �R�D�%�<�;EV� ��31�0�B���_��5R�[�������n]$� U1��v0�ȗ,��4������7)\�����䌵[a/��X�'n�1��k�Ұ
Static task
static1
Behavioral task
behavioral1
Sample
797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe
Resource
win10v2004-20240611-en
General
-
Target
797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436
-
Size
5.1MB
-
MD5
12ebeff0cbc67b2669736813eacff30f
-
SHA1
5d5c9cfb2de811e5f98104e4e404fe4f3661c620
-
SHA256
797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436
-
SHA512
d7bd27fbb15497500b5c83e9f952c51a866eaaf0314dc566ae85d835aba9978c9109ecb0c96a072f90408af0af0bd41ba6411d793edf2403117a7e7c37dd1b8f
-
SSDEEP
98304:vgRS4EdPC5gYJU5ue4HV8n1qt5WjphbsC2o4wa+eO9OJsvJ2l6VY:vcEZCX6BCu1qtChbJa+eOUJq2Aa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436
Files
-
797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 498KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE