|��0�~)��� P��n�!^����i2��8yi����$K�2�A-���>�����6tt�'����U&~��Q��禳��x��"�b��_���+(��R��$������`.���}�prV��[dK4�@���5(?3��$E��`�<�_��6�x����p�<|�7��˛�\!�9����UFB`���684&�r ��l��a�z�BʬB��� ����O.]|�� g���DG�f5�?�Ӂ}ѐ�{J�n� �y�dgK��/�(|j����U;-{�h��W��?hk��г!U^)�{g��#$�璅��az�ۂ�8�N�ìd�1�ml���`L�;ެc��&ك�����ꨥ$�>f(�� ��;!Z�n���U��~|$��6t����MBa��M�p@M���o/���{真�� Ʉy�ߙH�zǰ�=������s"��Y��{�����l葿ijz95��tڮ��BڈG�)�LF�?̇u>(n�kjS��u�c�7�;�Aξ��gSY�� ��ޒ3�� z^J�ˍ��d�L�� ���_M��J�D ���Y�;SL�Ū�k�)��y��h}�ڱ����"��f�� ���o٩�H���? ?�P�G_J�"�����m�U��,ԥ��7)�ӝ�s4���JN�j>�Ld(�=r���:�W�l���b%g*�Dd���գOW<����{ =��2p��q��E~;��#�(��������쬘'dEuϼ��j$Y�����F���w'ز/�<��H+;k�$��dd-�9YӜ���z2�-��I���4�OC�o����m���W��.ɠ�A����wQݐ����y���\��6��z4.x���.���-YPI�W�3�%f��+����9�'�^-3҇��F�P�鴂�\��~9Oy*V��ɟ�L��ӡ&���M��}grg�H��N�j4峏����B�$[�e�9��[��C��͏9 ��%Bl�(�J�aM��`�.����ߩ�K{9�� *� e�ƕV�f!�,�QQ��/֫j��y�U���"$]2`�ٳ0��Ʉ�3�4�ѱ�/2x4�E=�]�=�9�Rh��B%8�H��{ļ[��������L�R���W�&�.s��9�jt���8Ƕ�Y����<��b��o�z�� lW˯�@�G[@��0�C;������u��:�������e��gL9���\�H��䐞�?�7���B�<���G���V�?���M�D2��~��%����˟�'^�S�>[]�v���z�>"M�v����*! ��~Z�{�.���$�2_�_�Ȱ�����������'U�f�?Բ�� ���&t�x�&���{N���@�n0Է����X�m���5�5H#'�\�o|: �o��~��M-�N���W�xӉ_ a��ԓ��"��N�g�hP� l,�ۀؘt�ҭ-�7����^@��6$ف��*Ce8���#=����Z}Q3S�8E���R�L�!��l0ڮZe���')/�����ka�W�!���E�;7i��;���u:nK:(zN�� *���a�~b�\��g��k��o���o(<�K|~b�\�Fj��+����c���I��'���c�����v�_6iq�_���M�]ِ�y�u�� &�����Z�Ų�{���\/�d|�B{����F@֕�'��P�p�������,�o��B\4�6O �,���e�{_��3�H�����ְ�<�Vp���&Ѹ��� ba�����V��,�0M��5�kD��=W��W+��d)�(;#�(�@��>�ƻdT��sX G���pSv�1��%bt��9`���V��)�kM�uf���~?y2B�A ��-v�b6pq>�tb~����6��i3T9�#vC���':��L01�N�Kԙ�ч����jXY�b.> �F���c ��J���� �CcE�t���\�,�Ly��5�_ؘ?O�%�W�.��3 ���4D m��I��5��K�e�2Y��ƐE^��a��Yˉn>�>�c-�S +��$�Eo5G���� �d�L��uv!��el{5��6~���h���$`��m���/�f�~G��Ά����m�Wt���E=?AV~��<����K"����ai����,%i�1���sÅm��oj�e��o�0>���J���V�� ��j��Ҹ<Q����4��9�נL�A-!��T�v�C#�ԶW(ؤ�r�f ��Յ/;�����m��*�^/�J���(�˺���(oF�UTi<b�] �K�1I����Ց��BB|dm9�=��,�d���H�O�Ѝu��p��oH4&�ͮ�Tܺ�w��k܂��?Eg�yf�L7Ox���켁o�RΖ���������S[��i�J`���22*�թ��hm'�l����PNM߈^W�i#D�i"{���B�܀'3��4��k��@�^-m���8�_�x����*̵��+1���f���d�:��Z;�����LF� K� ������ ���E���s�TW�����a>x -4u_N y >?��C���߲�0�b�� k��颶d��>˦�O�ƛ3+v��eUaش�լ��#��>#��R֖���i��b�AE=b*�D�3`,w����s3pe4�L���X!w�v}�]�)օ�L��uV"t���.H�#A??s�KU�SH0u�df9w� I��h*�](���t2�d=��tK���m���P))+־�4�����D:��g��"J�@�O`�^uG���Y=��������b��.4�0��C���/�@O]~Q��\�ZZ����`Z�T�L� z2�;�S朞�ɇ��C�]�eJ.�X2���R�\"���)%M�7ֆ�C3��+�4�TR���!!:�܍��d������9[^7{���"�W��W�T*�, ��{�|vHz��}'wU5� �T��;k�G��}�u�5(P�_�lg5n!�{1�����梑J�E�k���"V�*}�8���:#B����j*V�T5����@,��P�7aY�� K1A,�Y�� �<g�n�W��>FR����Y�}���$?�d9Ǚi����9���`z��A��R��M@�����G���@�W���.���ĝ)�������O�G�-���?B!�+�4n��������`�s��%պ���R��&��6�(�]�3c;Y�gyBnO����R�`$� f��,�2�b��9]��y����BM��ď�l�+*MZ� �qL�9���QJ�]Ջ|w9Pa�WB)�wO��v ��wg,��o�詚��p�5����|�"���8�� ��͊����%���:���j��ӊ��:(X)�x$�r T,l�I~e"m��wn`�wRA��.4�.��*���=�um�J�[E9�a���9q ��,��t�����-��@̋�G&]7�O�6<d%��)O��|ޜ�����^��!e�� N#�{�"\���.!>����������~p �n�G��� ��m��k��]�~q2���g�,|1�#w0<�Q<Ð�Oe��h�QٓK�����3���.�L�\�u 4�`��ԩʻ���&�c ��6:j�5���k��m���FxY�V�p��~�������N>�Y_�N ����|����+>4��nqN����<ϓ�@$��1�2����ze�(O��~ܧ�r��F�o���m��q9��Im��l�Ѿn�1��I�=���5�4�?�
Static task
static1
Behavioral task
behavioral1
Sample
1ad057f20760236870be5f5a81fe789f0d33184371426bf5d278f64248ae5258.exe
Behavioral task
behavioral2
Sample
1ad057f20760236870be5f5a81fe789f0d33184371426bf5d278f64248ae5258.exe
General
-
Target
1ad057f20760236870be5f5a81fe789f0d33184371426bf5d278f64248ae5258.exe
-
Size
2.3MB
-
MD5
17b03a403438e26df7304a0743fb9fda
-
SHA1
62f08c0b06f78cbedd706234247314556fef6fe8
-
SHA256
1ad057f20760236870be5f5a81fe789f0d33184371426bf5d278f64248ae5258
-
SHA512
23e29edd5c54ada3f2cd6c4cab2ee7c50e9057170174aa61b673f2a37833367e032ac0292f21f96e5255420d4870d619150025ffe1178da7b5a44b231688a171
-
SSDEEP
49152:5JQwTTGhhnFuSWKnhfPp7n4AUsC0W6hh6EZYYWdC0RF+/:MwTi0K5p8JfIfY1g0RI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1ad057f20760236870be5f5a81fe789f0d33184371426bf5d278f64248ae5258.exe
Files
-
1ad057f20760236870be5f5a81fe789f0d33184371426bf5d278f64248ae5258.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 41KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE