�)�H�<m*ʪ�<���s�2���ߘ�o��9�'۷�(�<�fuЊ�W��Ʈ14P�TWT�P����7��L48���f:�bp=�zzG^��im��Xԉ�?�����]!��#s]��z���EԲ[l���eI2$��:��ْ���x�����i�9�eۡ�;�x�P�nE��e�tn�ӗ���E�>y�,��L}.�*yU��w�p/�����R�gG��ͼ�,��[�����έ�g� ���5F,�=ϑ��p<(/E��)7L���z���e�:����7 �F�����z ����P;=þ�#<PgT���Y�\��*�e�8kN���iꉮ�����~R��2�����|,ĵM��_I��۩f��(�>��nV!h����D�-�؍+qYg�� �'m��Upőx�[��A��l�WKMN��o6HRN4��, �ج����U���ro�������߫v�-�u$QB���Ȋr��&�������X]yՖf8���%s�1���L�jz�ŘX�u§ʦl����`�"u�嗄.�����v���Q��8U����m�YR ���W ���bw����wx�O<I��Пow1o���k��=���j��//�P�ډ6����!.F|���.���G�T^f��F,������6��pU�o@��q7@��T��v#�-�p��A^y�~Ԯ�6j��i���iqA��Q��3������D=�qZ���h<Q��J�l|(��=vn������^���']$�S�: ��y�2XIqc�g��ڱg�Sa�M��� �f�X�;1Ze9�Y�/_.�j�E?�W�~_Wed�� ��'�:9���~�V7�<�H`�@0=`�B��vt�"��"��I7i�JjA�J>��[itЎ�kv��={���[^Nܳ澅F�s\9���Q8���{$������A�S@�W��}.NY�q� �g�cY�d����l�,w�U��0�-=�o��z��ȅ�;C���L������ĞV�{��IV������@���e�����l���R����g�Kc��~~Q�x1n w�je��T�����z�a^���@ �U�{�7���)OI(�csTRK�����;?�����/��i9��>:�w�)x��{h=*Ce���.�Ų������#29�;��A\-)��2�,�CT/�p�煃J�e<��9y��������\C�{F& ��������o���N"�M������/�&�E � 6�@�Y�dq�����ر��S{���;��1��䓿_&'���>,0��3��n���8¨�hL��B��4~�{�{hʂe5���P��霤~�v �`�="=OX��f0u"�)�,rO��$�O-�_2D�0�|Pś��W�o8�ҫ��ܫ��r���Y��|�z�qg��n�xg�i˶+Y�'��<�$Y�]����_w���ݵ��Q�ҫd��<�3_�/@>�a-IWT&<��L�# ��m\YfXe���^�!�O��n����Nj����k�:B�^�S\/,�]E�V��?9�w�ah\���h������7�=�gڿ/���<�vwj�:��S����|�v��.��T��;��D���v�^��S^��A# ��??w�-^jQ�K'�]:�=���z}���h�_�I0NGJF���|��[�}�Jn<våj�ʦ�u3F���%ú ���4$u(v��C3F��%w�@@�|��2n��~�)Ya`�?��yE��%K��)��i�u�J~��4���:�I4�C;2�ܹ��q~���D����)N�=k�ILC)��I�[Mn�f���H߰�n3s���~ʧow,Bێc�����;k_��k�|�y �� ÁA\I�F�Q�^W�'���ˑ_A�WV�F���| ��㈪�������X���.u���]%�`O�C�An���z�Oɒǽ�{#�)B��yڀ'�"<�l�[g n�+y.�WeJq8���,͆}E���V�C켹}g��Z�$�cڧ��n�Y�I�\j l�ޒ��_"cME{[��2S�&E�.�O5�e?����Q�2�A���vM�r�XG�Q(�R���p���T}ӷ�8t�S���9~�e[�(S���t��)�<�5x��o`�KhQ�D�m���TP���lQ�h̾� ������Q�� �+x�q� �B�yK�W����,��5�R{����p��Ij��5֜7U�f0p�_|B�!}Q�9��`�Ao�7,�oK@Nm��p�m�5�o@K,���39}C�����s�1�1��F����8+��ҫʾr�-k|3�#�Mp����{$�����b�x1~&�������_橘�� -���M��͞\\M#�fm7�����d���lK���?R�M4D��FF���,� p�S�+kN���4�б�^�V=���"�!��� \�M�&����W����|���=&EMz\��N�$V��r���9����0�d��i� rH�g{ $VF���3j�:n����V����5w>�����4��Mja����^�ԑ��ڮ����.E@s2E�mo��X�}; ��PЗ����GQ����4ı�<�����c�KK���_�L=e�Э�d�}�P �z��.���1�A��:) 퇋~qM|�z�l�^\ ��[���Z��j�6����Ɣݶ��a�/=]��t1۬> ��=�6K*{�����Y=�faQ��ʮ��~���c2$h)�������ׯv�J��3���61w$�[�O-$A�6/7"�O��@ � /5>��4 �jYQ%!"Lw�� �� 횙���Sn@A��KB&�}D�+�"�]�#?F&F�pmp��u���F�ȱ�\ґ��Am;=�Q ����c��'�h,�%�$�FJ�M�~#��r1�f�]��#��[w�Omg�DS��Vܢ���2�f�(S����4�`��g�a�������yԕ>v�Z~�m�Et�;c_ h�b/��e��Ѓo���k���C�_�0DfT�nca�S�����r�8��?�����N�Co>@o>!�^������tw^�$~s 3�����$g�Xw��YE?P ��^�|�tx/� I���M8���aM&�`h�ѭc����%f�������,�>A��/�R@Q�v���Ri}Q`1Q�Y�ʶ�JυQp�_I%������]��Zŀ����|��R��LU��ƀ���6I,X*&��I)�f�R�1����ۼ= �V������F@���[K�nm��%B�r����4��H���ĖUMlC��N������FV�J��2O�Ջ%6?�V�k�5z�rP�8�� ��� �?
Static task
static1
Behavioral task
behavioral1
Sample
e4725ec14fd7c7d20a53e85e49301255caf470080352dab75856cb6c046de37d.exe
Resource
win7-20240708-en
General
-
Target
6a61be101e96b2a7fc073079ece444ed.bin
-
Size
2.4MB
-
MD5
ec075ebfa9ac4fe0af43fc33948f055e
-
SHA1
bfd789232a886f185e56a6dd8aed378eb501b1e6
-
SHA256
762ced1becc0869204a0d18bff3e297e8b9359cdefb5633169627bade80844da
-
SHA512
f36e74c27f479ee9e452ac5dcadaf74017bec06a3d4a85a363599ca20b65fc9bb37a4820d6cbd7168237c35066bc165195399ad2ae1c2d3cac1ddaa6126fc796
-
SSDEEP
49152:FmcnRRBPQ1VGqxGWSF3vTOVcTaRJSVP9lZ0JZjCVq9gxPqHGG9pQewllrTL:FmsvpK95u3vTgfSx9lZicqg89p2P
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/e4725ec14fd7c7d20a53e85e49301255caf470080352dab75856cb6c046de37d.exe
Files
-
6a61be101e96b2a7fc073079ece444ed.bin.zip
Password: infected
-
e4725ec14fd7c7d20a53e85e49301255caf470080352dab75856cb6c046de37d.exe.exe windows:5 windows x86 arch:x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 41KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE