�?L�) �N7_ky�xh��&+1}_lٿؿ]pA�>�y<"��9bZps@� .u����zs-2��=K�<�R�\��B��F���YGP3yd�-KyXIٕ�T�m�Fi�i7P}��}_�����[$���.�U=/�������c����/�$˄�� &��o�^u?:G\i�?Te��d/�<��gKȘ�e�z| ��UJϝ�Q9rϱ�X�,��#��e��4Vy)��B�7#2�$����6֢�(��9�����hǟJP �M�����R���bp���Ǥa�1�I�y��Ԧ��uS`�������ضWI��%�i���%Q�+��mK��n�>u��lI� �}̧w�hQ�,О��.�-��]� �6Q�9��Q�.:X�h��d���Z�'����K��Y¶��'�A���8��/�]}*��MD��jr��-�ׯ�swρd����F�'�KV%hD�Z����c~���TH$$W���?�$_,��CU�Auo�Rk�Èp���/+��*���R�Ǧ�F�6���x~?F��u��%s�AN����{"Ҳ�nt��f�f���i�51A�;ӆD>W��j�b��Ɨg$#�~% ̧�NՏlgH&��L �ʈ��L�~#W�ݟ@�T��(���Ő�� }� �YOKιFJR�mr_'�>�Nb����`�ى�%SQ�Xe��)u��hh�1��b��5g섔I_1C[�ׅM7.�.�[�Z������t��6�ͳί9��{����9Gk7e��1)�4>�1�3�t�99������-�ا���<n��Oy�zN� Nc��%�ì�����u9� x0�9H�|~ٵx������,L���J}MY9��p; w:��|�+ݒǟ,(�n%�O��&���!i���|M%��f�;��P�#(�+�KDU_��}�¾������U�}oN��߯=0��u0���#M�vv���.�5������s�Р�4$E��&r�ɠy�m��U,� #��6��%b�.!9�)$i8x��'v����|�+i��,k ���z�Y�8a��~�gn�-����q�����[��%(����Rw8��j��!�����d͜�A�{ˌ?���x(q�`��g�䧵Z;�:CWWq�nj��欖���)L���(0*!3F+�y��+��U���O=���j�Pu�g����\8ӣ��$�*�����8-0c���(�q˻�1�'³� �m����|�_�toqMX�!���������K>_��N@f����-vo�s Z�r�s)n�D&����H2��X�stQ�������Z�٭�u�ZZ��7�>){';0�%��<X�s�w�͚ //�������~���?%_����V�l�Vv���N�Ym�� ��~��g�ɖN^e�#ݕ��i��{��w6OQp�O'.�����i������p��Ξ���78W#�K�H\P0:lC�L�%ּ*�'����j�tc6��z���6Gt�Xi Jd�w:���$]�����&��*GCg���vo�a���'&�e��l2����lK��3�[/3���OúwY��fnk>�Ԡ�@������Հ͋�� �8�Ż:m<��7����s)T�RefA�S5�����m��Y�vJD<˴,���~q�s�F;�Y]��ԧ���OUɵm�+�Y���Xc������*(�ӓ�̎qO�0ꂓ�l� ��Q�B�a��-��>N�ҽ�?���hG�3]��*u���6d)��Q�m<*qx��&��~�q�/���+H�B����[����5��8�}i(�S��+~jh��D������f ���?Ly�I�:�,V{*���, �ە���Њ>f�6\�(0U��)���<��w�3��M�EvwHى�}�\s��/K�$L1e� Z�D�ɳ ԇK��Y��m)G�����߁z��M��tƍ\�Q)�������6v��0=E�8z�8N��Ǥ�&/{��MZ1گd����jw�>i��i3��p�ڲ0�[%5ا�u�AB�)#����u����n?i�W*��[��l��QHI�cKo�:��S}U����a솔���N"��f��=�q��5��T���S�k�QҸ��ꊝ������f�O��0�}]�q�̒B*N7����X��&�Z�O���*�gl���m�u��2������ٗ҃��Y�Y�*���@�1�q��e��=�FZM4�|c�?�_+����v��?j8wD����U�9�"Y�\R �$~/�@~ H>�s�CR��p��ƇP&bpX�J�|]��2��}Pd��!�lp����*s-���*��� m�Y:f(F���l���#�L�J���[��iy�i�1ҋ��������� +�r氾�NZw�x��]T䃨>�/��`�yҴ������L����I9��o����_nͪ[��_a5�s�;@0[�Et���נ�h69;�-o 3�*�Ij��e���x/�_�,���)�;>lz��Why+�s2� �ٺ��3\|'W����ڨ��D��vcVكa�#����jOH� ]�.6 ���A�]֍���� `,�D�;G�xX���Ju8^j���P�Tsa�`����1�XY�� ��5���D�]u���1t��C�s˽�lK Xhڮl����[�rh������U����b�c��#g �9��w���K�@S\�4�e�dCpq��;&��_��[����r���֜� ��57 B9�/Q�x}�C�u�Ɉ��}_q�.e�g��{��!�橁XҶlB3����;��G�x/;�����U��x�w�����iS��V1��۬�)^�0��C\�(m��&�Έ�^z�o_��G*�pO�<|�g��Ȏ;T@���jd S�+Vą]�%�n8<~D�<����"-�Q�����?& dl����|56a.E�s|9�l �^����p��i��æ7�� S���]Oֲ�#��9�֧�ov���/ӓ_�����#�&��T��-֙���!�ԚJ[ ���<�L5?^����Z�(H�d��?TH�xh�h�j:`J$N��Y�ǟlX���i!�|1�p�~L�h�K�,�t�f��0��S%����� �N�睥h�=�e��� �)5�0�o�U���k��� ��?�9���ʼ�x����%��t%L+璣�՟�`LR����@��x �\��w<�&xx%��}[��"��N�(���ڄ,������M_�&��� ���eyS�o ����9C,��0)`:V��q�����3Z�Q�$��������H�#�\��(pY�c��+A9��Ɓ�Yo�۔;�N�@[���Q�d@W�tkV�)+u�`e�4SӊL�����'�u����&���}'�;\Gؙ:gy���K��W�/MB���)��0�����ɼ�:���o������=�Аz�Q�f�r�g��[0�O�m߆��i���������z�r��ad#`��D���V��[T ���$uR�Xl�[)��/&��مO}�i����F0���M7Q�4S�zZwЬ&�����jq���"�g��tE�l��p�P�F}�Z�Qa�\=��.Y�=���<^�˭�|�u� ; �"9�'��#SX�z�yU� �铩oP����^8μ6Jm�9�j�i��Z��.*�r-� Zb�=z|��\�/0H-��"�^�.���z�Z��� *��R�����}b}��E��ԷW/�E��t
Static task
static1
Behavioral task
behavioral1
Sample
d1f04b4bea67cbc6f469855826505a16e706b514858fa73c123df263ad34a292.exe
Resource
win7-20240611-en
General
-
Target
d1f04b4bea67cbc6f469855826505a16e706b514858fa73c123df263ad34a292
-
Size
2.4MB
-
MD5
853f97821f33b411e011296b97d0cff3
-
SHA1
99824a9224dd7e097cbc5804d2d9536555ef95ee
-
SHA256
d1f04b4bea67cbc6f469855826505a16e706b514858fa73c123df263ad34a292
-
SHA512
71bbd39e471766bcc4b4418d39ad0476cf3b894f9833be971df9b0c7a8691d51017c7f196a21844af19a0b7c5fe8f8bb05492ebf4013d05fbb29903a834e4fa2
-
SSDEEP
49152:XN1ELQkaEIo7DFYFuIqtvcflkB78QWtyGPcBD1qouXkd/0lDb:XvELmEI8FYMcfmB7MHlkhC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d1f04b4bea67cbc6f469855826505a16e706b514858fa73c123df263ad34a292
Files
-
d1f04b4bea67cbc6f469855826505a16e706b514858fa73c123df263ad34a292.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 41KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE