�w��Oܰ���@��-}ٝ���=�e��N>jW��Ԧ�7�;�%�7l�F8�����1 ˏ�QF�AX�u}�~LJ@��V���l>��_����!�_<44�� RY����=���d��bcpj<���))x6� ?O۾V�ⰾ��d���Zy�u��D��Td��v!��B���2l�5�KL^=]�k�R��W��H?j�-Dc�9�(��aC~#黜�W[/���+]��k�`����U�a9�'�7�S�o` i^��/�Dq� ������ .,�ʝ�":r�Qr)���Y��t:W�s�f��V��݆$�n}��Ű2�#�sLc%B�rq �ph��6�@�ڤ )B��i[����L ���4�ӥ�O\մ:����{��= RË(O��E#�����Y{��j�ue'H�#��W!Nc���r���Ya���;�Q˴�#X*��hD�\�ku�!�Λ��J?�;���¸�l�-�Y����������p�Sx- �eO�2���'��}s��<C�Kh&�nm>��mw �oGn���fq�#էA=��!"K������_�]��p �(����2����Db/�Dj�)��?S.���~5[F�������T<,@5�j07gp�Ǚ�X#6d�H������˭}4��i��fDf`��y��2�M<;[�����{�l܃J$i����[.�IQ��]�9���+��"MEw@����TbG�l_�*�� �B)�\{�R�4A�o�����ۋ�D�vtU?B����{���Hf7l@Z}����u��f !?�� �i�.�e�9�/U>������а?<15@�3��@�Z���53��1צf�(�GG������ـY�$9J���= �U���f�v9�2���)�V��~=�����Η�5:b�����o�ɯ��0�t�h�Ri��_�ht�/q�t����q>��N��I�����Ǫ�����`��Z߅8ƨI���̜��'�ιj���Q]���<�C+}8�M��*�$U����}�$@0����Ed\��Rq 3�/=-nu��W9�Ll(p PT�������ܓ���W�H������G8ܾ�C�e�^\{��/>9Zp�QgӲ��0<;���HHlk�z0��[�T6.�p_��܁��L��8z >n=��(�k.@�Ю�wB���P��h Jh�]��@�o�/p�(U�v���U��bL�m�XteSS�����njqqre���c��pUS��4R%��@| �~�*V2��(�_��߭��/ a�M�k���i����m��k��[٭OzT��`N�)q��,d�S \~��Z,�美�j���Y"�FҧjK�M��l�1��%-ݬ�)�V��&�9Yj�)20��A���C{ʽ#(feԳ�R����e���S-� �cG�)}�h������g���� rE8~X=#ݦԨ�������$�n�!u������2�T.�Z�c�R��5�������бC�Ý�7��|���ܑ�}���+_�b����w��I�*;v6_Ġ!ת(�=��/iK�7n1��z)��% �d��!��"w���m����E�_C��dh�?l���D��4��>�e!^�4��ek���1�QXw|p��mɹp��m�w�"�[���y�u9���3�1&��6��nkMEl�-��G����,N\�����.��B QX-���4�B�MZ(j��f ��u���a8�f�O�k\4����(t(P`.��+$Wmy�emX�첒���5���G^���֬���U�������`j���J�h�����Nq�|��'4L2/���< 1_� #<����Ķ5��F�ͥpش�h[�-�gn���j@���myėO-��Ín}Vq��F��r��������u�Q��,�)�;zUߎmI�R��|�Y���P�Q���e}�ǥ��z�z/'e�y�2Tз#8Du��?�A���j t��(��x2����[K�z����e���KG�d%A��[Ƥ�G�<m�mXq���iD��Ɩ�]4����E��H�<���}�rU,�_�����|߹�``I<�n�k����NFŜ5�j7�;X{}�g�� |tX ���4nU_�.�{,(���+c.'�ߞ%���I�^_D��5���_ʶ�L����P�i~�� #V�>�����k�����Z� ҷK��#nI5K<a* �}h�w�/M���͡�@2e{����Lr�)�[�������c_���n�׳�-9���#����9���Eͷ�� �v��5@Ӣ���sc?�i*~���|�NG{x��5���H��yo;� ��C4��QF_~ޭ+S/?�]���I>�vq�[?��� A9�:��ր���=�hwl!��/��?����(J����r�b�iܤm�JR�<N7"q�y��^�IX��~~��@mn�ϯs��( #\�\[�i�G{�Ms^�����ِ�Y� �����~� \��QBQ��o���o��ሃ��y�;."\DB��}�''���m�-ɻ���Ũ�oZF�z�sL���7p���-�r�V���1K�"�xY��N;�fG���<�a���r�Ψ.Iy� �X�xt�$���i��"l�+>�5��4ɞ�_�nƊ��;�>�M�r�\�i^�֝a?C��H���T��҂���l���(]��*�k{�2�$�|�N� F��$� �='d�Y������1���][��g �UTN(Z�T�ˡnCC[�U���'*wt][9�%��% "3r�_����G�j~� ��A��B��� -�7��[�����E�u��c�x�e7���������Yu�vl �R��xP�!ɾ��c-hAK���(�lmW��q�8� �t]��n�b��dA��c�)ŝ��i�|������N��Ú⼗sH��!P�*`K:<γ�.*r�����a�x_X��H�t��J?���'5����DZc����;�c�C���f���>O�Q���tG�1P��Q���I�GYJ��l����Ƌ�+�ɿ er�幹�2�����-C܌�w ?���_��.UG�E���r��Pj���FEf5}2�fXrj�5����+�H�2t�Z���
Static task
static1
Behavioral task
behavioral1
Sample
11f5b01983cd221e28aa672906d313ca45dc0ed41f351602779590576104c52e.exe
Resource
win7-20240508-en
General
-
Target
11f5b01983cd221e28aa672906d313ca45dc0ed41f351602779590576104c52e
-
Size
2.3MB
-
MD5
362aadbd9dc628c321bc33892046b8c1
-
SHA1
f8831ff7c1fa70f4d56985b08daada57758c3171
-
SHA256
11f5b01983cd221e28aa672906d313ca45dc0ed41f351602779590576104c52e
-
SHA512
03a8100cd8cbd9a519e19922a1f29dfed84514b029e3e7dc6e6f76d45078deeb2703c074f8b8faaac9103302fc90a93d26a9302967f9b9c992b3ecd82437c9e9
-
SSDEEP
49152:Cy78p6FyspLM6JZID0V1/VvzkUrJyORGcR5cD/96lehH8kRyMx:x78k/pLV7IozClcPY/wsZ1Z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 11f5b01983cd221e28aa672906d313ca45dc0ed41f351602779590576104c52e
Files
-
11f5b01983cd221e28aa672906d313ca45dc0ed41f351602779590576104c52e.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 41KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE