Y�/�����=����S����>a���gp�<by��hԚ� �W]����Z�2��d�nb}���>���1H�w#���&����@�Y���N&'#۾iu���Y��&h��c�wK=lSHq�t�6#���,U��F��⤩��:0Y�i�C1��|L�i-6��0��*���tG�A�4Pn�9�OM'|���x� [e� wˀߕ⺌��Yz�vӣ�Ȥ����o]N�6�kV��{��� ��ͫj�{�}U�e��6r1��%��Hp�F��n�FC�dÎ0q�����b�\85&����q��h�Q=��kC<�{���[�dB`�A1Jn8Pe&��� 5�&��8�_��m�eg`����� ��z������ƪ2�n�W$�bA �~���˞��B"ٱ�1z�����ܴ:�t�Rv�`D�4�WB���I�&,��Ju�1���u�8~��#�C������%ҿѳ��uS�<ணZ��,�?�m,WPu�C(�"j;g�@�'��� �+�=C|0ܢ#�=��B���?��У�}�$~q�8(��H����y}"Kc��R��! �>f�+/|��2%�.(7�4��d���7����M%y�����w�o�cp�ax������z�DZ�S�+c��u(ˣ�dzQ��1 ����/ {p�G����~�.q:�P�m�s�¯Ф��������5dd�Ծ<Gmkؽ�-��ݐE�U�[A�8��<"��RL ��љgV���Jb������y��N�6���(��&����:�#����H惤d�A�(yFֶ��� ۤb�T�+�ЃI:��MG�s�������K������K-�G����C�11K��^�"�&��Aɹ�1�����<�� d4��'�Cn�Ylc�_���F��H�i�V7=�ۿ�E�� ݰe��GE�k'P'X`YJ�!3*���c���5.���vkPz�`D��<�Nι~�S���S��5j!ι��ߛ�yOV���D�e��i5�w �R|�[@���`(pG��G�O�h�lý�WfptX�"���&�� T����w`k������� g9��;8�#���;��DK�����"CP���.͏���r(���m��mJW�u{���������JZ�}Tg��E�r~ȕO����ʄ�ը.<{"ɤ3��C��;�7���At�O��~߹k�~/����i��� �S��7�|��7���z&)'���j��P3��EmrRTG� ���u�SD��=��\|�p��do�y-���O���.�f29;p��J��˳Z�|�� ů��4���Y;�C���(�ܹOz�as�[N�g�,���2s�X��M鯩zP@��u��6�t���&�Q2�E�<��_諼|�'�nE\���ڴ#�-����4:��� �n����s)�`sʊ<�����97��J������������>к?u2U%)�P��s_I�^�X�q �X��4����yz����pyE��a@hY@�I�K�8;̄�0e#�{e;���*`B����B^⪗ 2y�4)�����w`T�Q|��E�WZ�0�F=�~� <����6�i���z�W��}��zr�NͶ��1���G��k�8�1���|/w���.|OƉڙ��2c�r��,��H��))�Xr���{�y �9+˻1�\"��qo�~��˘�I��Բ{O��t+[�,H��G4�²��<��� �� �^5C�1�-��$�"2ϒߙ#0H餷�l<��-��X��D��:qJe��8�c��^����w�X U�!:`��;s�Xf9��Űն�;���\YY�0�h!?F���&�?}�Ħf����2.߃��� �:�Vuž��Tv�5�3���D�`�*��FfmYF+#���=J�%�&I���� �/�6�d t����9k�0:�vdҒX�F9�]���- �*�P]Q��m��ѵ �]�I�K�dc���!1���M)Ѭ�~���և��h� �=/����n>[��K����E�ī?�J"u��~�4��B�����T|�1w<�^�� ��@z�v� �4���fR�K1GxV�����k��`�0m8/_9�(���a"���LM"��-����Ӳ�0_�R�K��c�HG�q/�̉)K��'��R_����$�0����xGy�����]�s��#�Z�����n(�B��|�A�*b>$�D(cVb��W�7������8Z}��Gg� �պ֝�0_֛F[�A�W-��<����=;�����"���K ��&�����P^�Ɛ!���r��{,��P�/.2��4(��ܩ1�/`ff���,� �;A_�|q��m��O�I٬�|�GU<�wʮd�� '1}�@&!MCī�8[g��K����Q� g���=�i�-6z���5�i+��if(���[���NvQ9^�7p�]�������f����&f!Btk!S���$>���,�R��V�>�e|K�<� ���إ�L��\��3`�T�{���f4ܞz,�?w�����X���ߔ蹐zo�*MElq���3Jɩ��������\���B��, �Z�^mksB� �wl�R�Dԩ{+Tמ�b�|C�h�M���,��G���u�$O���!�c��9�D���3��9��Β]�m?G XW�+��:�bS������o�u����Gn���W�Ϫ�/���$c�;��2�q(�mP��Q%~��V�m~�Y���7L�n?@�O�� !Vp�9vU��t��J&W>-xVf0�����I�46T�K�7�F<�<�����>&�v���EU�%�Q�����#Ͱ �h��졮�%\���k�hD0t*����9����HZ�͵K��z����W�=����]���Q�4��&����������ʩڍ��^vU�\$�*n��G�@���Cp�N�7^X���Uv ��Ч6��~Lx�E�X;�>�[��2[��H46\@^I��v��FM��.b����!.>v��0&�R`;���ss��SC5��1��<�÷����7���`��&�ry�� �7 K=u���M��٩~�:�se����A��P���^�Yf�2�ˠK�i�H��꺜o�J ��d�>G��!weWa L��t[̰��6=D��ޔ��o���ړ�u� �����Y%|��5��3ߍk�ꨑ��8.8RT����s`��b��fW�t�����O���9hw������1�$�n�2�.���ǯ�Fn�ȅ3K�3L(������S�nĘ�
Static task
static1
Behavioral task
behavioral1
Sample
6bf4612c1b4d71558e998e0761e3e4b4481c89ae3827622e86a81f46c08d7332.exe
Resource
win7-20240221-en
General
-
Target
08154d3b86fa169d93fa016adc221edf3c1cf8d63db1db93a86513f64f50fc51
-
Size
2.4MB
-
MD5
e8b18bfe1fb7c081cdcf73502cd9b555
-
SHA1
3ff0658ec39bddb4132db213d3af61e5a46df8bc
-
SHA256
08154d3b86fa169d93fa016adc221edf3c1cf8d63db1db93a86513f64f50fc51
-
SHA512
2d9bdfae8086ee796516b1402836e9d418fd8958a6299c12bf383701fade27c60161d2fc202b0ed5624d5cb003e8ce443954010d787c63f6843521c2acd98a05
-
SSDEEP
49152:dNLZ+tUG5rnnp4F5nclJTPyn/kcjmS7EYwpg1KQ3zfAse+UtwWd6d6:dqtt5znp4Tv/hz7E71IDAswGW5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/6bf4612c1b4d71558e998e0761e3e4b4481c89ae3827622e86a81f46c08d7332.exe
Files
-
08154d3b86fa169d93fa016adc221edf3c1cf8d63db1db93a86513f64f50fc51.zip
Password: infected
-
6bf4612c1b4d71558e998e0761e3e4b4481c89ae3827622e86a81f46c08d7332.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 41KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE