|���bc�z�q~ΙU���'u�kQȳ�OiO�M�|�����T���c"$Ml(����s��Jt_���P� F���� �5b.��%.��G�~�g8�Yi��f�F�2�ux����_-Jn<��VrG����h�9Y1�u�gb-�g���%��_��݉�:��C����N9^i��'�N�h����R/P%����;�0���5"q*^�`�AX��=^��6F�'��*.Uk�W�q���n5T��l2S�4� �Óó[!�������H^��g���j?CQZI�e[m���N�]&-;K�i%��WL 9uV�!�cyr�L4Out���7Z�����9���5��U�nG����PSY���p��d TK�x)ե����{Pu� #4VNt�J+�7�C� O�E6U|\��5��{�`~?:խ�ѥ����I}��v���]�IO���z�g�pJ��mj��Gz�Xse�]gP>t�]��kaױ# {���z�tZ)�?����o��N�OW9���#9P�W�,rH��z�b��=uKi�i�7K "s��G��*�����V���_��..�4� ��*��{��x��������T�WX(_���۵:���x��l[�A��s��s� �b�4^E��g�E&����w��ֶ�ƭ�dG��g�= � �'���9�w����o����N�8�y������;��oLM*����`�;�QgT��@CFة��Cf��cԡ��S����2�S�DM�r��{Mu3��&���n�����W8Zs�Eqsc}� 7J!�Wi0Y����.rL��eg��.G py3�-9��Cd�R�����P_'p4�3$x���a���Ǒg��f�"f<�u�R�\�b����E��56��0 a��AM�&�'�Ӧ�&>|���ެ1<r�.�s�j�^�L8��"Ө�U�$��D���N�n�6>U hQ�H�A���S$��O얩��@qJU��!0{ ����O^��ȏ���Q �W����e2�%�p{6֦���i��B�XA�XLԉD�_����ǐ���O~� OnW�ԦE��w��;�P��`P�9)E�n�����rؾ�������}疺y��Ar;#.J��'��0��j����+�6 ��v��B����SpȌOA���N]^p+�B�x���}rW�w~����T��14l��ᦧ#�%�O>�LoE�Q�i���������}�G#����ù�ha&=ϼoP��e��٦�5���IH4��(C��;�?B:�In k�Z^�|��6A�_���yR�v/��̹�������_2���9%L�0�w_�C�xS�o*e��X..��f7�Yi��'5��r��%�ǁ�jh�����E�����] ő>:]��1/wC�Gi=���~�E�+{��,�s^�(�5�F�����u�Q-�(�Z������7138r~���rQ� ��klsn��t����B�H��!�[#o������'` ���*Ȋ��̘�H^��;-��_hf=md.A%hТ���r������nO�X S��2��51�j��'YD�r��z����W���@�!�$L���H�����g�G�� ���4��ە(�&�ѡ�O͍�o���5���7r��4���zgl�<>\�"��t�l�'s��Z6��/�ڎv�<Yc!��V�5*���r�q^C�#��F���O�T��v�Zxw��� �5�����^��'^�Z�Wh [����dA�33U̟��9q0��$,����q�*�܇x|֗7`j��\fYށ���e�i6���N��j4��r\!Ń�3�����gK!$��'g�K�Epg�6(#S��K1�~ٖ��ٞ�G��W���'f�ڟN�a����n��&�Kk jS�]eo�Ĉ ���&�Q�Ԥ��`�@t;M���S���kيC�֑���($��l"$����;����~/\�읺<;��p�>��h��Ȗ��:�-+[>mf�� 8AR6��Y3;�=�+���j�|5v5|�����w�X(�J#�7?ߧq���r��|/������A<�� ��ೇ�m���bv>�n�0t�iG1ri@2�&����{�h/S��U��&� �c� ����\��������d��� �P2�СBm�oNMt��g&���G��WjLT}� �*r�љ0���e�&��/O���w� HX���D�}��:���M���`Wy�O�nBڲ�n4���k��,Tپb��CM�n��:놫m�آM^��Ԗ�$���ri��֪͝���d��_� F\B���\c% ~A�8�Ne_��N����d�a;�� ��*�A�eׄ~n��3�$A?���mг{|�j �HE�s�vu-s/�̡��{2��X� ��9�T���Aб�����%Ǯ��s����l-�5$>?�h��3ᬍسT[o��9k� a �t�?n\9f�`S<����u��ne01�r�������T�?Ӱ]>� �Ba I)n�3%9A<Սu#��G�+J ��&� E�W��x&���^���lȹN�D5yN�Y���9�GFp������ �Th,q���T��*5�&~���q�+ayX�����y,�ֱ��T�gt�W���#��:]��ȑXHb��[��9�>��zZ��[��-��3��B��r`gG�<�=�pW_D�.1���븱�Sf���k����˓[�-۬��/<F�|/��A�dQ�Hy�Ҕ��h�E���L'�`������ r I��2y���ʄ�TCh��bwF��A��� ��m]�xhn���ym�l�J��Y�FI�@Dp�/����������P�%���w|C�~W�5�տ/��I�}�_.� [�jA�~�j'�ɒg 4���C�� w�rBu�2%����L�=���Z"���n@ц�p�0[y�-��F�>�}~�� t�CN_�)���)��+���h��B�ݎ2���O� �G��CCSͿ=��m��m���_H�C�u-+��m��]�j���1����lrb�G��ݒ��eO�Q��G^����R�UO��� 7��C'B��#�������R�a���;�����7�Ν�lq�mP�>��əU���D0�;��<�tU��}�쭤�c�U�����#�C� �Ὰ*p���E����]�uR�.� )��}��ט�; ���l����ID ����v$��.�Ԗ?F�c��f4a���������[T��(�J�$���m-0�� S =1~3����>���)������F�X�j8��2�Z��J�J�Hej�J�!p48�c��oW���H�6R��L1F�&�E�)l�� ��M��'��j�\�O �$L�����٧�#�D����M�!��� <�2�kvY�j9�Ԫ�$~ V��S�5�"�[��y\�qqh�(�2�� �����(j���%��X�2����I%�}9��:A<�q� ܡv��Ȕ��������7��LYMi�`��s����dS�Dez���~gu��m���?|�y&���<q�L��X������50��Wr=�:��������]c�i�)ͅ���*�ӆB�h��Z��:b��x�j_�p�#����j�R���L�4b� �F����1=���~ɫ凞&aЇ�t��c�뙭��zx�.9�4^����<�#C��|*5��C����:#Oȵ��e�cw�����/���ܧ����?jN鄣��4g�$O��D��-c:&��V!��}���(��w�
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240508-en
General
-
Target
file.exe
-
Size
2.4MB
-
MD5
f19adb4ea42ab4e1cfe99d50a00956e3
-
SHA1
5da5eb1c673010c0b9999c4943999696ecbcdc9d
-
SHA256
9023777f5529c209b55ac61d14e2a7f978491d14df51268b49d947010f46376d
-
SHA512
6583ef56e91d3fb02d75d5cdf1cfd47d543edbefd5c311f1e6ddfb800c943a4504ab0f747829a75dd98a2c8831e010504f1104d115359a3a8848b1645c57ad41
-
SSDEEP
49152:qPiKGXBUQl7x+fss5ceOAlBqEO110m5GTsDM4nk2OMFCAsB5uE6WxBHnwB8z:qsz3ns6eDBqEO7R+IDk2OMF/8uZghwM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file.exe
Files
-
file.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 41KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE