�א�*?���Ƭ�8H�{1�*��N�����L�b�Ct뫅m/ ���l �k�<浌�U|���_�����ܑ�-/a$�fPn�h��v0�G� �7P:r�($�%����r�@��y\L���Ohď�A_2��� p�)�y{e.��$v�V�[>OUML:v�`;�f� �ot"$.Q�F�q�چ�-��7<���ǩ|ߏ�K����n��M<8A�L��ˍGQ�7刺6�2��HzL�鵔���/(Ql���r��[�kh�d �N��盲ahM��֑|������y��7�)m���l��!���v��Q�n��W��/��8��o�%w��������Ηx� ��jX�Y��7�w�w�/[����w���RsX�.����?����kK��8}�\��~rr`~�h����1nk�-z@/���ƺ�������p�V�+ B+���T~���������9�T���}��B����Hj���o���״�P��b���>;F</��1�[�b,)��ކ�듩p�3�љ��� V+l�5���@^����*�g^&y�G%�h���<��n����P�D/0E�Q�8>�WG�/�ܕ|��Ҿ-/n�ɴ-(�$�=Kc��d\d�ز��kWR�p2e^<x��m2�i%�2W+�����Ã��Fbd�@������4I� �n��s�T9g�ԙ�?�-�����ؘ�O�z�����L���zM,���Tr�#���<U���g�nʧ��� �� ���i��%^&\ƌD�E��^�*�ܽ&/����cf`�q�2��b�V��f�>Q�>��j���,~'?� I��-Х\������Y�WB#CE��1<3V�7l�x���p�Ξ�1Έ�J�ث�4��0_ �Q�U��p:�\�\�+��+3ڨ���B.(�&�~��P���jDź����f���t�*�,qRs��U�khno���n�K�n��UE���o!���c��阊1�yi��f�D�T�6&�>{o*#��W�O;�Y��om8t������O�_���W_j��w���ƻ�3� y7������Į�"�1�uiK<�ӢU��go��ԑx��gd vM��;o�S��Hr�ھ:j���r4=H7���"��-�?�J� D`��"����3K�ܺ.����Ё�Q�v�l���|��l��Yq ����������|�p�k�<�����:r����8�8b2t�� G�ksX���FK���x�`�n=�Fx1��Ҿ�w�J�D��b�$�������;��$'�S��_ �]ŷ悒O�8s'ɺCE4��E ��@C�<�d&�[���+��ڦ��=�]T��QRfys� ^K��"�_YÀ�i<W����t��,f�$j��$G]��h�f�ʤLㄏ��Cjp�MjA�����#��07sXt�FU�f� @p���M�����$Oq6?#����@��É���4����������y�|gT̛8:^����ɝ��5ʦH�_m�k WnA����OY1�F���9�JŅvŷ���G���q�iW��0%�k>�z�LR=yQVU�zBr�a��Ev�g;����]��{j@Ad�j��K)eL�Ž�Fԗ�ݓ�1P*O־�l� �O���*g�:�h�(�Q�v)N�ٰQP2���V d2�eh�K���N*�`DY$ �Y��0���m��A�j����38r�$ebn1"� W<�M�͉�HO�ZJ�e�6��)N�b���f,%�i�e��/������v���a�a��lm�x���%�ݬ����G�Õ��2�?��-9oF[(T;���c��i&��&�2�XM?f����S�<0P�1��s�z����^�J�8E묣MC�%�|1�8��K���R�b��=#����WD,��t�n�xw������t�E ��%r^�O�S��Y��@z��:����� ʇH[;I:l /��(���x�Q��BQ=ڈ���z�Ũر�qG�&�wIs��6̓�FKU��l��A�W�)�D��l$_��+��\#�l*�o���h���w*���dNt_o �������m�*J9]r҇G��zy+�%�p�{������i���l��!��j��i��M�C����80VQS��њt�_���n&��!�cM"@!��d��U^�[ b�q�fG��Ш������bU��%���O�ѱ����p�|AٓL�7��P�yW�p�(��Rn�F��'���I�o�W�<�ʒ+����0��ݣ�A��Ch�Z��~��X�+����6?}�/ͼ�����-�]��?@�����SB�p��r����wrY��O���|�vS��}v�2p��ˍzw��j2���˺�$VУ$�a� �Q�A�� ���pu: ���YD�m�y�0B;��V�E���%9���z?����&o�7.n�Ư4E�}�9�8��e�|V�f�|et�M�a�����)k��������^��e�Ċ��yS����aHĚ6j�`o��1����q�\�H��|]�X�ºQ��s$���Cj<��!�l��ɬ�� �8��YuF'� 15J��Bt�w��a��'0b��&{��s�^�=�������a�q���(2��>�,��������`����l���~ܠ�k��� 㠝�� uRV7{Ϥހ �I��۔"T ���4��WA��EL����0;oi\bU���mR���~3a��)�(��|t��/#�TT`;��p�������������$�Ÿ̗�RZ7�ƻFt�[$�$tFX���n���.�0���y������X�� �\�z�i��X�$�FӴ,��F5��O%���!3~ٮY ��� c wʥ V.��;��3��<���� !�ɮ��Q)��$J��}��Vq��PW4�M-]��df��;J�&�X���Մ<�Yz�]9Ek/R��\"0�\ ��n��.媠�pVrK��_9�),*����J��?@�,cQ�ҋG��oԬ��B��b���'����?�������"/#s�6��3��Ky*��c��;qh��D\�h��Y#�[8=�����N9D���]О�y-���9��y���eYbD1N���Ti`�-���@�obY��/�L�:�$j�>�Z�(��D���y�8�^7 ��7�:�[n$���T2��jW��Y����S�G��<Q9|� ���U���elj����!�ǭP��_�h`Dž��<s��(s��{��yMh��gL�1�r������=��!4|Ɉ�?�B<:��sq&X��E}r;�]6�gi�I��a��J� ��t���z�E��^�P5] q�����'ɂd�268ԖPT�a��>��ӹ��T�`�h�nl�=jҒu���&�;0?XP�$d���qU)e�͍��i#�|�*m��p%��A��T�+������I��<��k��i?]�=J3��:2������*��V�Yb�^F3�Ui~Ο߿��9�R��l?���P�EM[��^�K��X�>������wx�ŨI�j�/�9=�ƹ�M���m�,��ρ�q�j�_��+�m� H��&�E"lL��1��+¢��U'��[z�B{�ڇ�L����t�������aR`�c��ި\O�.�,M�_V�� |l�K���jM�G*��HO��s�7^�L5���1��U�~���Q�`]sr�Xm����
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240419-en
General
-
Target
file.exe
-
Size
2.4MB
-
MD5
d7fd8f9fd59b2a5ad6a6c390ae69a197
-
SHA1
9e4302b57b3cfcde37727cd0620540e9b9681382
-
SHA256
1721005326a495d40f67f96882334ac18f10008287986e5511ba9dd681f189b0
-
SHA512
0582114f94e55ac3c2664b88791093085284efe70c472b6b6a02064d1f0ac7ff2198c19b7042a692c32193b363aacb9058b0a44df46f07e517b1c4cbf2f14ac1
-
SSDEEP
49152:t7ofY6S/hsTW3Ti1ZKGWBHriecH4POavET7qRyPMIewnNzd0IyywSCAyD+YfPw:VofPS/yNZKGWBDcHgcJPMQNzd0f2CAy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file.exe
Files
-
file.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 41KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE