u�#�77 �� ��X�m߀+EoD2å��O���њ��� �bJ�]Z�Q+��x���.D.��t��%Df�bT�Z�"��-�ʑ�;u���)Rn�k+����ħ�\\M2U��QZ� 0��Ԑ�)�# WЏ�� �o��u�cy2�/E�]p��$e)ܕh����ҹ������3pC��+�+��<(����5��� ��@�4W�Cai.%p�]�����P[rHs��tXq:�ؒ�ϡs���)�G��U˷3\T�43��`k��;�`����D��Ѯ;��wD[5��߄gP����_T��4/� ?�T�`�q3v���A<�+P]��c)�g�,H�� ����'�p�<��X�3�ݍM�3����P�ÍJ�h�i/ �sq�ş�[� ^��x��4������Z�R� )JE�����������������2�����R�����q���ŷ���^A�����_z�n!��:]�%2b�y�$R�����eĀ�B}���=|}�ֺ�F)�[3�5�:&�P�\�,Haw�/v]�����C8Xv�덤=]`W���Ǻ��b��:aҭh^�Ac���Iy�K�!h�|�`�X���_��a�3��8�}t�F�� ĭΑ����)@)u��,e�g��QP��{�̳�D��)�X��O��~�d��u��R}Zc��~���Ȧ�3vg�P�:��W){����92���6ܖ�s� l'�Ȣ�����~�� ��BM̚���̙�eᰍ���o/p��U,I�u��9K��qnz �uʼn���8=/�*ruB��#����N�`=�O��}� l����,�p���9]P�rܛ*c70^C��ʽ���r-�����)"�g����ۍ�%?�8=���I�V�o�uX͗��1���jZBoe��)YNK�;�Ò`���:O�d�(������aF%�8e �ϐ�Lh�'G��U�x�nz�ad�����b��/���Jo/�'D}������g�"���o=�!&O�)���k�yˬ)�f���h��,ܹ٣���2�W���� Y��>�H��I�/�dE������P���Iũ��6IQ��v�v��Ho����J���ɳQ�����)�s�D���G��]��֊Xa�:7v�ZjE`���k�aL������:8�E�bx� �#���*�9��w�E,q�f�)�� �3�ىN����'q��hu�1�;^��|�����i�:��6�v�Q��B��%�FH��o>�5J�p�T�@,]�`��?o�{�˂��ܵ���C�E��4f���d0\�M�nD.���F��Y�C+}��A�9��4]KZs�� '2�5p�8!�G ��+��!vMu��3�dq'��J��5���n>�F�aC{i[� ����\/0����kB]� �N��X���� LM�[�x>{ﻯm�>3�RS*a#�5���f��t+,��.[Ҷo?�b�O�R�ڪ�I�+���U���B���5��H���B��d;sf�{�}�%�؞>Zk���jL��$% ��$Fk_7q�t,6eke �n�W��,T�. �+�-2�X?�����^s�zWs����_�C�X��C_9�WR|��W�S0���hT�4r�G�&}���EW�gڐT�u��h_bf��P��c=��ۿ���$P�Q>�|z�_��P&�$<U�������W� ��q�߶Ep��m�v� �%sG3�>��Z1��2�� �>�����[��b���sr�D�w�B���ق��'��"$Я4V���v��3���>r�A.t��]^���'��e����Fj�����/���r5e��V)Tl�wr3[(�X�x���L��kmn��ZK 8Ny���p�i�Xŝ���k-��A�� bT'�����Z��n��Cd2�{�'����?��a{�l!O�Co���冂. d)\}/( �<��܈����WG���`c=��,�.��U��p���j��g��C-���=R�����3�չ+�{}�,�%a�7�m�zc� �L���Q6Hz�GdV��l�9ޘ�S��I���k�%�C��|�Bŕ�Ou�D*���]��u�+�K^ȍ�N�����S��zOU�!�p�W7O�#��]RM&)�>w�=�A���er�<�߇B/눰[��^#Μ�!J:�ͪ�d'f�d��Z0G��M�@�&�$�����DE0_�"��;��*�����k,P6�W�C���u0� �@ ��s%9���虠��"\�;Y��[<z�&s)꾳s��B�aPLpB-�!������:ݥo3� ��� ���D��Ŕ1?� c���4���m[֓SP�'��E��^�0�������Ϋ��yfۗ��:m-�(�r�j��DYB���AD�!���!�[���4����ᓸ�.B�Q^����� 9cӍ<M�d��c犣A�펧�z��F�� ��˓�J���F50��veG�Pi|��r��%5�7(���<_��q�~�97��º�^ظ��^�b�u|��S����&�r�����Z��X�nC�X����k{� ��B�������@lFo������7E�+CwNJgb�M�/K�`^IZy\"����$�}��� vg?!����ju^5i����i�m&^S&����Wy�乆�w�̠ի侷!t�U�vn�����Ȕ4�A䑩!����Cb��à�4 f\�K��0:���z���Y��r���"��e������|3����bD�x� &��#��?���pMM��ʵ#�9�U��������� $N��*R*��x��FP���Dn��`f[62���b�>�*�� ��o�2�D�� ?��y|##��������JHc�b �`�aAo�,�&���]��FLI��D��#�p~���ꮂK(�>���Ͻ+�ஆ�F�b����:���ܑ��95��<�W��,�T,{^���=����y��u�sD����*�ûZ�,c?�������~���5��F�p�%B�GJ�j���͈�:��x;V������8���U�X�BT��DZ�:2�)×�*����_�E:Zp�{��=�հDc���=�wG�],,p�OG�(��l* �t%�9��"����������&�$|8��U�KB)���� s�B�x��1�qJ��W(=x�D۫��о�V�2nkZb�jQqV5f]�Ғ���8�xS�r�:g4$��=�Ԓ� �=*��5j F5��\�1{Q��|e�7W��S�����`�3��}rO��nf�������֯F�Ci��N����� ��f]L�*��:���_��(��+��,��jk<sd?90ž�2c~���$�$�hy�<y�l� т�0>�rV�h}aI�NL=E�H/%�����VC�����Z��r��yTf�0�2Z��V���D<���I3�I��Y�<=�����7+�@��0�께�^K]�.�GR0}�ɳ6�r��u���_��T��i��+|G�
Static task
static1
Behavioral task
behavioral1
Sample
8e7963520355e4078e56aa0cbb4b38d6ca934a05ae11005a396ff917991116ff.exe
Resource
win7-20240704-en
General
-
Target
f812d7fa7f815e27c65e2e02f577b411ee17c6de45ff6a5e03ab5ce392d4f378
-
Size
2.4MB
-
MD5
1c537b8dd4f371fc6b114afaa0771263
-
SHA1
65c10b8a838352d2d37f9b1db2a1b79c75c575f1
-
SHA256
f812d7fa7f815e27c65e2e02f577b411ee17c6de45ff6a5e03ab5ce392d4f378
-
SHA512
813afaebce0480432f1c08eec8b62968673f4399989bb25746d96bb8c71ee76685a39719d6a563c62417a65afae0095ae48907f93510ee363baf33e1d1f328f9
-
SSDEEP
49152:x0dAWqiMOC2yB8I/4cloTTUa8M3Piw0R3kt1:x0d1RCf8oi36Lu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/8e7963520355e4078e56aa0cbb4b38d6ca934a05ae11005a396ff917991116ff.exe
Files
-
f812d7fa7f815e27c65e2e02f577b411ee17c6de45ff6a5e03ab5ce392d4f378.zip
Password: infected
-
8e7963520355e4078e56aa0cbb4b38d6ca934a05ae11005a396ff917991116ff.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 41KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE