mTImR�Vq��F�}�5Y�ڷ��U�ʬ#� ��ֵdG�t[��� 2�qb�e ؘ����"`�OP{���J���4����Z��W3��9l�$�d��g� ~F�87$�^�F&/��e�������an�hL����uqX�2D�וn-�ŻN�_�m�5���`{��ԄGH�ch��c������]0�qQ!����!�<<�$f͡93 ڝX,6�q�_@���~%&u�L\%�T���`�>Bi��S��/c/A2�-��:]Ӫ��-�G�Ҿ��&E;U��� �hgBӴ���3��O�gJ���N9��ց\#�9�=��=1S�e�~W�)�5G�,A�5v���}9���+nM����3�(�`<��+-�h��p/��k����r�ڦ^��������f�P1e�b*�oJwS4Q|��h���E��ܖ�����G��=�M�8������9_jZ��@F�k��,' ��9X���g��ز�L�>��L��A��*�e�����`� �MI/�"Bݵ�g[f�Х!��v�s������;��"Em��EC��$H9�Q��=���,���I�w:��=|[��Aʮm1P#>��� ��z��o:er�����p�2Îg'�L�h ��7Ai3��;1l�U��u�Am4�?��U҈�A����@w{�$ !H܌둃��N�&Z��CH��T݃;��J�k��ΚC�I�)�U���g�4=��W�ah�~���B�YA��y���kKTђ<�L�L�Bȋ���lH��_�ϱQu�Jc*L��; �i���̢;`P�c�|�ɼ��5ś�9����h_�h�o�i5�;�������-vI�cS�Ff!P=��\�����~ ��x�E0>9�}��-�6�W����9��U1wU1?~���h����3�]OC��~�T��긗>v#S�����%�&ЂA#*4d���dc3A�;����c��س�˄*�_|����"8/�~�c�.҆�銼;�$�CK�&���v��&���p����Qa��ӕ]��o^��������J�����2�����a�s�a�jΊ�`r�����������u�E�����|~�q�:G��Ǡ0c���ap4Xr)o��m�D���y����[_P9��e���� Ne��1h�����m��w��) z����QΣj��a�.`���܂�<g�d���{F��t�'G!��c�/����-��B^��_�.�d�XQX�\��;y��ȗs�@܊`�F=S"���7�"Al� s�r��5��Q]����q��n�����5{1)���t�r�?�Ԇǜ4�?���.��U�Y�6d'A:Ӆ;y~���d�LA]ꦨ��IL��aj7ŷ��o�W��p�K�F���,����:Z���<)#��Fm9^��ڂ���5�F�jh�{恐@D��1���\�g�� �� �}F�E���;a��I�i,�`�@OY�a8�f����x���`��Ӡ�/������+!kdJU��2�E��J窘�=�4�����TM:��.9.��dt?�N$�(0^���h{ �F�a � �K�OA�7.P����͕�[�ƨ{��=����A�H�@M�?����?���8j]#Mۚ!�yh���"���i�/��(���������)ꖿ��u�#L����@�ܧ�����a?x�QW��=rqޗy�*�6x��e�]5�)j�n/�@��tP�E�苝!��H��O��o5;����wm�VS�ǯeC?�|��V����[2��yOy�XEv�(����NK:�-�*ĺ~��r)d���������/��4��q#��&|ݦ#��x����e~Ȳ� ��F:��@�ݩg�ΜC"����r��\{�R]>Ô_���2������%L��Bf #6��0IcV6H�0��a � ���̀0ˇg�1�b�K�1�77��ٳ�f�z:�Yc˨������l��N;�`K���J�q� �f�#8LgPi|� ��Q;v��\�������a��9^^F�R��PN4�]k�[�S.���71��)흠���&���#���p�c>�PA�&�:Oe���E�v�����d��������*Y���_yK(��"G�8aɇE���ə�4����q��"��v�.� �ͯ�\� �ƄA�����Lw�y�w>I}��v`=4��o2r��6�el���?$=���Y��m���|k�j�����Z��).@�Q������kne��m�o9i;4C ��}�5� [!��@ت�������a��JH�U�-�����lf^PupA���̌��E�7N�C���-s-�1��R�����df�x鯯=k(���>��?|�-ٽ�EN��� o����Z��(]�|0l�����$�a�Rfve8��<��*mb<��H(����cz������_@��M�t��A�AW�W���,O��Xwզ�,yQ���V�0������Z��j��J�Yim��k�����a���īm^�K�T�"�L0 �@�#��28Ia|����諔W���Z��vC�~\��lXcT�hYѮE������f��6��-Soq�'}�D�*W䢢�h �؝eq���_%�>�$�ۄ2�:�ws|H�!U!�tq���L�g)|8_�ܸ������2ىG:��;"$�*��U��0���}��f����Zu�''�87n� z`l�ӕ��~O�����R�QbN �S��J��r0��n��rN�:� �� �t~qw�Ƣ�M����LBeF�P��S� �\kPnu���:�^*�~��ʩ�uw���]ֈ꽤��9��j����/�U�[����U��$Y�����]�ũ©I�]V���HY=����w�%t�k�A�b\h�����\�FWg?y��-�B;�Nr�����rN�I(���!YeFB�Ԉ�����99e3��'e��։��Z�~H�y�L��S�E��*�����{��ޱV�2T2������*��x]��c�'i�y�����m���l4���14��D���7ܼk��=��N�XM��O8q\9��cX��Q�R���^QO�MQ�/�g��Wǻk?\;0������"�Â[�W4�v�ɬ1���e�̉j(��O��JN�v��〛��1��)�� �|l�PWq�W���U�jp͜ػB��{_�/�N1 �;Se��ف,�#?������~��mY�{��pb��5g�#%�pχ�������j>���AIPb�Dw(4YL��_��M���s���֛SR�C���4��g,��;����72�-H����l�vJ�}��o���0�4�����)��&��U�;�� �*D�%�W�C!~ө=��!��� ���Y#�˕��@�9�Y�c�[��y��x��1e��z呛��z`�B��ݰ�1O�^���� �Ĥ����0���/CA��<�oVn�X\�+���f؟,��a�����ʄ��y`�$�z�fψ%1h�m{.�`*���~�Ӓ1r��gg�!�؋S���r�0?~=ᡯR�~�o�L3��'#�P*(臠�}>�!&G�nI`��/ȫ$������K�x�ׄ�����Qy��>�K�R�s=���%IE���$%5�g8���q���Oc��F3fi�����;��Z�d\����̓���7Q�U h�~�6O_��ia5yC�ߒ�t��\����m�6��b�����|&���4�!� �P��N+w���c�"�K�Z�n��Li��5;|�����fUX�B��b� ���f���J���*�'*��tT���;��z�.� ���Ԗ��dA��&�B�n I��A'pY��O���.~� ��J�
Static task
static1
Behavioral task
behavioral1
Sample
1d8c6818270a2e6134939915477a4f734d437f418798701ddc2f8a31a378cd08.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1d8c6818270a2e6134939915477a4f734d437f418798701ddc2f8a31a378cd08.exe
Resource
win10v2004-20240611-en
General
-
Target
1d8c6818270a2e6134939915477a4f734d437f418798701ddc2f8a31a378cd08
-
Size
4.1MB
-
MD5
5f991be19e5201626547d0f627748ba6
-
SHA1
cb0a9639dd65692aa9e765343185a0f15ded52a4
-
SHA256
1d8c6818270a2e6134939915477a4f734d437f418798701ddc2f8a31a378cd08
-
SHA512
98a62a6f56baa1ef7a6315823a24f32f99d194a138a020ed2ba052d89c3e9a77bc1843db03d6b0d9fc6697f3b55986934afdbfd3847c3a462e8164e471c62ea7
-
SSDEEP
98304:lmcR/Nc1pijDIeFX4+0ObKGFYqaGjbixh8gUomoJGpKzy:lm0lcbijDIeFX4sbKIYqaGqpmoYIW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1d8c6818270a2e6134939915477a4f734d437f418798701ddc2f8a31a378cd08
Files
-
1d8c6818270a2e6134939915477a4f734d437f418798701ddc2f8a31a378cd08.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 665KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 96KB - Virtual size: 232KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1.2MB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE