٣� 9h�Er�������oS��m��D͂�7��f���ޚ��u�h�s)�9�EV� Fk��39���'���"Z�#lIC���Ț�����/�2�+��5B��E�ͽ���m-;�ed���4���Gx�����#p���h�j�2O#�1�3��>7s5�6����mo���2,0�-u���cA*�Ig �B+�� Fo+_�$��w��)r �������DeIc-n)��p�Qʷk�8`}�)���'Y�ƱHj�6k���n1���)�+%h�$:Z�G!�h;��G���{[&z����ZN)��!�P��%]���EI\�>�d7��UM��F�W��/�0�z���YR=�\7Q^��dU1��^5�+���ۭ �:a��+L�I����zZ}�4>� y= ���Y��T��0���HՑ����p���%�{e����[am��V�:LV�)^���+[SQ[G����@�!5� �k^}�z�w���j��'c�|��<H�o�J��;k^�ҝ���pA=�NEGf�&X�K�j��YA��q�z��@Ijj-��pW���X��p=̾$`�W%;�5���^�b��o[�,����d,�����0�M�I���ؑӱ5 =c�\�X뇻�}n���BH �֮�#o/��!���0�A���q�Aj��������ZiT�9����3`p~�~��W�LC�=�f�P��.X+�a�*0��'P���� ���"�:_������IӰ����Rm�r ��4:��]����)��Ld�;B���.Y^Y�[�ȧ��GiϾuM������5��j�����L� +��[` BgcÆj!���Q�.��ºl��}�nw����� ΪO'c���<~�B|I��x�=:ոJ��{�����~9( 4A0 ���AG�m"˦�ؼ�T�pGQ���Y����;���#��!`�I��$,�&�9���Ѥ�%�|�d��"*���{�9�tI�|��7Q��et���'�ݬ��A�p�S|�3ֱ:�4@U�I�,c��G*����r/��^)��HV�ы8x@�� �C���|g͠qaO�)���?��9� aqG��?��G�����R�辦Q*IY%Ė���2Kd�R"�%���*q�-߶�d���_��lQ�S�>�j�Y��/[_yEa���V�ؽ�Q3��j��+S���1�)(�G��N��e�t���[JNg��x�0���&���K��Gq,���[�����v�ς#����ص�]���ր_� �#o��_c��=���6b�NH2� �ե��ۺ�-��J���RNn��@���&0�e)�|M��O���ΈQx�%�����p�)+�G^d��ϥ�d����7��8̈�l�Mu<z�b<�H��Ơ��6��L|�ǹfDo"���v�I���5>ƚ0mG����mf��r_PE���1���+�~Z�$�^���øxTsO��u�7j��8;�h���I�.�-Y�.o~���<p&�"� ���K�U!�sxQ���kwV���Ӿ�&�_��/����\rĵُ��=ٺ̳� ���*o�8���y�M&I�y�� �z&�%f�f�be3���n4ָ|!:�/{�����F8�!����Wn��g�%@����-��|�]���ät��x����Kx���溷�s�S�'q �e0�2���zߺ�� �/V�@!l�ㅈ�A�rjե�Ƒܖ=5>��>�����P�<UN�CG˕3l/��|w��@( �% ����u¨7�y�/]|�(yȤ7�B{��l�QIΠx�ddy�пuk��f�ejN � ��������Y ']�=d�o��L|~�A77��%�д�_�Y����^�{�!���τ�g*��|�P��'�ѩ�q�L.iKi�zj�-���iU;���T�A�h�.e��8c��N�����&��P:�5�G6�Q��5τ�t�P����kn �Ȯ�i=Z����)b;|#Ui���C��!�"l�dP xQ?��`x�;`w;�L���/X /�q�e*�ď������"'��Q+��bt���3�ګi��8�e�>3"$B�-�E��&��_�գF��ᔾ_��0c^������� �g��"4]�N,s݅�c��W�K�h�8 %u@��v����(�.����@�:j�P���V%̨�kBP�moi��!��aG���e ����C��!�IOþ�x ��R���/w�tW��/|��>��vR�S4�Pfڡ�d�>x)����Z�JI��Ə���^(A希�Գ���"{Iu����FǕ��l�0���=��|��9���E E���"��v\���$]�E�b�|v"�cm����"�\]�m��k���[�K����YL�Τx���/?حK~8�����F;���5[<�`�"qB�G"�t7n�)��K���.�u��&��-k�A�����خRݜn�;��p�uAr!m%�&�iN��.2|v�Zy��ej�2&�#���_�N_JY��~�^1ͬ�UF�BR8��J��Ô�x�,��7��GE��� �I�i �����U|s���K�M�8Q�h��F�a�B��7��7B~�Si��n�vyn��:�C��K�&4֪��쩷(:M��_��ബM$��P�*�Ą]��N'}�>�@�����/���l�g��+rw��"�������g^��C��k[�� �AϺ>���u�nܢjM�i�N@o�����N���&��h�ۢ����e�8gӌ�Ç���e����^Ƈ��W���}L#�č/�.����c�8�L��D`y��j�oK/O`� ��~��P-�Ob�68�%e%���o�b�hQk�*cĬe�ٮȋ��J�j�cLj붠��/:�9PM!J�iWJqs���Ǒ>��B%�|/{��y|9���������<�Q�;�_֢��]� ����"5�8D�g�K�5rD}/s�Et0Q�}�coaG�5�"����Xk�?� �03eL?�V�F ���#��=�z?��S����j��JN9�).�5ߥ�N��Iώ$�r��e���b��� ���εg>�C�tq駟|C@p�0R�2VYL3��0棔�����j�ę�[M���ߍ��� �4P e6��[˝��CYߥ��~t(Li��*����4GZ�DȪ�@��"�-�`�q�a�v���B ����2��S�"����g.�n��¼���{4.�t�:���6^�� en���U��U�o��z]b�r©��I�� ���S�?����ߛ;�g=��ȏaB��l�BW�i夁�\�4/�`?�MS�N��%S?#�@"�'��Ug�� �`Z�6��&ǻXY ^��c���q��/��X9�-�G]+�l�Ⱦ�8#`\c,F�r����-.��b��g
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240221-en
General
-
Target
file.exe
-
Size
2.4MB
-
MD5
5df47a238d51fdad9b442feb6c833886
-
SHA1
9332ec9a71256cfdea81cfbf8627f0a274802b1d
-
SHA256
d06e1fd08af8234eb7d356343329905327126518eea8bee8e00f10aeaf7d3a09
-
SHA512
8f0e92e9e7f2bc849819fc6e2c6cd332f2da8ef41610107abc34696f27176bb01148c54ef0c6dd1f02642f99bd453b0efc2f5d58055a543706e16f5eb3e75bba
-
SSDEEP
49152:fM+AtxmEVG4o6E1MmGcyUB4BmAP0julxkp3tJXpgttFlhTKquE:U+iG4olCms9uUkp3XpgttFlJKqV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file.exe
Files
-
file.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 41KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE