h_.� lf��Ǽ����[T���V��0��L$69T�t�n�_�0��*�M��m\�P�(�]� �od��p�]#0�:#�`�x�\' ��^����A��f�� z����M��'�i�mV��6^f��ǘ��4_�-D�x(`�C���?�}�����N;�Y7/k��M����ے�7�搌��)C��ԚHN�-+m�Z1�������n ����V=���)<�؛�[�9hxt�5@�_����y���Jt]k�#��BL�/j'� �UJH� � �z�|���1(����%��w��'�B���!�����W^Fo8?y�h/�Ym�z�P�W��y�\�;�yJ���Y��������(��M��]9�9 q��4� J?H�K'�/�h�x�����<#�b9~K���V���M�8�'��*@�N6�p ڽ����;d1��+Qs����=��ɇ�a�u��u�`�� v���7�{Ik��s��h,w#�Iy4��ZXWz� ��0^O���`f�'��5 � �w (�g����S9���$���� �?.+a�<��^���4wQ���6���/W�Z����b��h�e�P��Ru4��e�0Ga`'P[�}3AP�ӻɱ��h�R��u,�����0%ρo(o��v�[�ڶ^x�,�'�mN#L�����O�Hst&U��h�N���r�MA�/c�j<;3Hd��n���XK�� �,+��#ɚ�~ϥ�~�S��[�ֵv�PX�wI>C�mb%F����q�� ���ĵ��4����`G�[ ^~�nYBs�{0�vm�}\�>�͊����������F_s���Ê��,��RL�[�0Vc�1Pl������I%�M�������}%�o\Q�!e��#��w�8w�f�]�v�i��R@Dic��G�:�Z�s����o�;J����0i��Dj���&x�6���� ~C��O����X�Q[m䱕�� 0���k�X��4l���r�[��p����HA ���C���%�*�H�g�f�4���QR7̨�#��ʿ��[���>V����GqO�H�fU��2�� �G�y1ʋ��fe�C��a,IX��d��8lڑ�(9��ޑ�d�l>�� �.m��}%��?*$��-/�_�d�&��� �C�������7��~����,��ݬQk�ު ��J�pT3n9���#�r�˟�=� 8�x��4^ճ��̪�����S��nکn��{�Zu!w��𬱟OO����K����Vf��� ���-K�������YE@�VĔ�zv,�g����>��ߏ�E=�B�E�d�(O<��T̷iu&ݯ0��l��H�u\5w�$349D�a�,�"%�Ӆ�{s{��� 8�(}|���}�u�&���3y�����ꌿ4o��ٮ�0��D9��LK~w����hY�v������"��A�f"d���J�|��X�#D�b�u�&������ǃK��% p��@ �>�%�[�'!�LNS+���I���Ӆ`��U��~7�9n���`�"c.\��fm\�`�w:���} ��216Ш=�v\�[~w���Bo-��<a#���g���bG{_���)���,��&���.4��D]�3t[���ܗ�C A��4�6���Lf!�~�_�?C8�!?���XJ��F�.U�-J����m}prL�����B��*{��E����i��Xq�� sj"w3iפ!9�?��:��A_V����~&{������MJ�������������Y��$�>�����g�KJ�O�<e�&�3��M�M�c=�C�$,`?�9�����G��^���696o�����p��a/T�7�3ߘ����8`�y��b�лk�([�7WW^�҄�iY�T�Kx�, ��� �b�8�d�?;����'�_�rg$Y�(R\�q��MG�[q�#v��:]�Ir�_�?��(����3���;�u|������aT8�#9���:���E�z_�&q� L?3��� R�P!U��E ����k��{�{��p*�m��Fy�a���yM?�!��;,r���ڃ���`�q��Ea���_�@�����N,R�wh������L��X$J�l��. I �E2^u�Y�a�����F)!�<�c@/���n�6�#�J;T�"X�z) �}ա. q*���>��w�j w8��?|4��ev� bs8}~n����_���R�cH}c.���;�������]xab���� �#K(A!��W���m,]6��+�Y��^��^ӆ�&C�sc���������W�P�;�Zr!��#�y��T�J������2V�3M����짧$%�E�E&�s��kT<Y�w�Q��G�~�҂�]q�D����Z�|\O���#A�R��x ����Q�o�3"$ɮ5"�U�h��;������U��L3�J���f4������A�|w�.�3h-�3�G�p��t䇹a,9o�ގ���~d���Om�9��"B`Z8p�6�hĢ{Y�A�sՓ �Ҿ��I���x��9'pֽH�必����?\mY��˧�-�b��$��������#��+1@�\{��@�j����{�í �}�7Cd�Ue3G�,2��{����� i?k?�*J����§���8�ǹ��� A���'�&P��<��~Ժ-��0R�!y�� G�K�m<�v��� ����d��)v�d9q�]G*戡{�V؍ �-���BS���� ���4 �i�� �;���h�U��b4Q�/�-�j�iMð����W7E��V�<�; u��MO�3Yr�6Ń��$m���!��rH�CVp�Q�t�b�9Z$�vL���h%�#$�KO�[i�7� G�FO��������&�Za��a��xcX����WF��"?����K_�0l�L��v� C�.�T\��-b�z�c0W����U�s��0�E����o7�@��M�{F!!~,�ӕ�Ț�./�n.�r����QK��:���t�D�� o�k��\��m���;c��K��������wZB`u]�vW�W'Z*�ӾPv�L(/UG?m��!�z�ѝ�ɝE��jrI�T(�s��#�ṟH�:�����>���C�(�M]!�N!ԗ�@!��G�`IM���c4��������B[�
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240704-en
General
-
Target
file.exe
-
Size
2.4MB
-
MD5
1777f237c8512068dc8ad44df646b840
-
SHA1
ac5fd06bab176db78de47f0abdcb28e7fd3762e9
-
SHA256
f5e680092bbd672fc6bf7a403a7f186365032494dd055b24bcb6801a9d54dc39
-
SHA512
3a9415e9e8315f4d91d5640542f6e4751ab706a8c54d6b36bf13f0cc042d82db297735705e7abba17f9a9d26334f7c64d2aa2a3cb6831d4f4d1472d71586848c
-
SSDEEP
49152:C1af7QAF7kaCxwsx8fNlFES5mkHQA0n3vM14QzSFyl+D:C1aDjFQHOzEIEA0E4JFO+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file.exe
Files
-
file.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 41KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE