D�.+h�������ֱ�f-��>,n�^�9js��D��[K�Q��@%Rk�S+��AEs��_k}���(��|�����5<�'+_a�F�y�������T��k&`;.�)����o��W��(`U2}�Ŵ�.�q�������G��y��T[��l&���}�4Q۪0��L*"�$X�t�q��\b�i��J��JgZG,E.���N[�B�r��b�rZ���\���.��%5{������{U��E} �6��z��X��:��J�� W�4q�?aL��/�ݖLSKIz/�;�4H9�o������ڔ2�E��t���:��6 k*b�g�v��n0z8N;l�i�кa"��$���}��[�O���L2O�H��p}E���U�h!�w��F �(ɳ�������VHa�e�snDD� ��C��GĦ�o��N�j9>I2���8�s�O�� �a�*�D&��� n�����R�@f(~�rɞ%ljj�h�����-��R=��P��]"��֕A��F�u�0�68uz�WX�����Ku1E���[��D�#E�r"M�����L"������¿����ATW2��7����,p)�I��G��⚍X�q �Eۙ �M��I��\��S��F�ٗڏ�5�m��e�Q?G虃�K ���2���ܞ��� �m��j��)&FW����8L���'P�9�c K7j�����������(���=�|b��n ��ݮ/\��2�v�E�0�t-�d��7��#*����H�K�s`�x����f� p�Tb-j����{�Կ?iP�y�����ŌM�,�s���sX��z��sZ�l*$�����T?O}PkL{�JP�~�����A[���� �\��E�W�d�������(-}}��ʰ�p��2%�=KS=��{-e��5w�w��7����W��FA�x��=N�Q��Y_{��R�4�3)8����! �x�5�\�'���m�CR����]ۼ4�'�w�YG�P&,���M�;*@�AQ�^3�}��X�)n��8g����ѮZ�w8,~"�Ka���<:H/�CY���c��I�Q��(��h����=N=��j��suS6i��O=�*}l�n$Ke���߰-�p�D��kXn����g\m�&�ĝ����8e�<=��Dʫƹm�uY�f5�͊o�Jw���ۼ��ͦ@q����ui�4�)��t���u�����+3��Ic����r�fC������%�7ŷ|�Me���ux��s�s�yH� ����<Pi�{ƃz����oyA���p� ���� N�2&���i T:�8����d"�LX �铚|��~1K]�-NJ]�'ωߠ��!�$$FV�Q����+"b�p �Ԍ�"���`v?��_�!���S���J�1���Q� ���g��Dq8$a͕�YdH����T^m[��u�;"\Lkl�*ޞZ��������>7��f��l���=���������=^)��T�����V��?��F�Utr H�/l+��hLt��@^ H�u�G���=��b��1t =3�V��אf�ػF�r�@�� g��R�,����Oby<��8�^����V�Z��d�Sd�Xn���\ZA }�[gJ��p�0q�pT����˿�NPm�b�)B���@��#9>��q͙ٵu�`0��v��'�q��Z*N4�1GR(K>Ǭ8��`s�~��WO'9�)!)�'�jR��A��ټ ���{�|cMⰰ�Ucj풺)���(������&�#ҳ/���i�a����y�_Tg~������5.�HU�晷;�p��0u�ݷ���TRc�������'��&�e����x�� ㉰�Y��>i������|�Yz��`ݘ&���;� 4�8@a|9��R��"a(���<+O&������O�W�J������m�gش��Uj�ˤ�W����0ׄ�4���9���5Eƕv�b:���9f<Eb�������un�:��/>�%��N$��j�_?���?�Z���$?�M��F �ASo95��L{�ɦ���X�^x^J��m� �~���yU'F��H�ds��{��2 ��:�m�E-���2�|O6�pfE��/���ۍ?����"y�,��D��ox�J�3��,�����=Z�y��I�\������� V � �cM�A���чVPe�57�(o�.x�&�����ʮ��ɫ����Ҳ�~� ��y������G#���~i�~~S���g�v�GI���)Ç��]y7m�U���wH�k 4��{|�FxҮ������P-�7|a�љ��3G�8��ӝ�\��D�G�p��x�+A���(��г��<���̰m�d���!�����{��~�Lc��!�-�y�]�-2g�*uC�w+��t$$�d7-ޜ8��ɥ�6�A�{2���!T&y;�1̜�8<��� _q �����h��P�R@ ������Z�|�{ut�5<����H@���C���j�P3q��;9\+d+��{/� R��0A��/�CUc1hF���i6�{��6LjϾ#z" }V���v�V���/�|��Z�$��L�1�+V\Az�ㆵ>Na�Ρ��Xh�)��c첏+O��F��j��!����(:G�m�]ɇ��W���Yv|�.�/Y� ��ʨ���G�λ�i�1.�Y �`df��'Ia�B�����p9~�:N�Ih���,�Hja������" �t�0����{P$����TA�:c��q�.1D�G���o�}��N�yp`uTT���������Xф���� 3R���AB�s��Ö�p;S #�r ���1lt�@�2�ݽ�u���T�\�Q���K'A��SD�Q�.��R �Hđ�SH-�ٵ(5?ץ���?����K�,� �� ��7a�L�.��{�`q{+I�&g��I�������ᖫ�$?|$��"W� W�k�7iO'�?m/]���M��J'*�P릖N�����|)�;I��4�� 'FJԽ�������k#9t� �C����J_��d2^'������"�_mߠiv[ȇ)S��,��@68K@'��Q�@XN*&�.�"�?�X8PG �Ym�I��G])�����X'�s�U�y�9��|J��)��RB\�� �YD.D�6�q��v�2@��/4����]�w� ��PY@�Y�W&�Ƹ�&M82(�na-��&/�8�/��-g])�)�0f���zr٦���ga�f�v��]�:���#�n�vM��*�%��'��o;כ�-ը����1П�J�=��MB*��� ��3�B|g��7��%��aI���tb{AM��10���Z�p �F,�^T�5����`>R��zǵ�S>{I��يG-Q����v4�]�t%֨�;�Υ{)H�[%IJf�N�W&��TvnO�7O%ClnP��!��pnB`?L����B����I���^m �=�E"��S�z�R-��Av��2P �S��TM��/R��z��\D�W��aX!х4!J��qd���>�QZ�����B2�����Z�MP��8�n<�)t V23/�#A����yߚΕ���J���l� 6��7�����ϐe�R��gc��M���ˇ�{j �k`#Z��v�J;� ڡ��FǞ���1���^�%Kp�ϖ�Da�7����hZ+�C���M�5�9Ո�s��{�iN������cMi�}� �W'$r�\��uJ��˦�zȻ��#JN�M۾諗����26'�飠�(7�A����3k+
Static task
static1
Behavioral task
behavioral1
Sample
d81a4a8069199cb989351fb3053f47dd97027446886cb2b0044fef773749a81b.exe
Resource
win7-20240705-en
General
-
Target
d81a4a8069199cb989351fb3053f47dd97027446886cb2b0044fef773749a81b
-
Size
2.4MB
-
MD5
064e974ce49d5244b3ff3722f5f3c27c
-
SHA1
32e71c4cc3bf1fdc09e20ca38b9354cc0e71d102
-
SHA256
d81a4a8069199cb989351fb3053f47dd97027446886cb2b0044fef773749a81b
-
SHA512
d6c619ee0b85e6fa0840830662595a3c1f18ee03c972a21cbaebc5db423a3dd2c2f8dd981f7e18ee97b0d7826734f49d13a95da4e3b9b7fb8049aae19a05cc4c
-
SSDEEP
49152:1jVC8nkD0S3zwrsXr6YkGpbAH/FwhuvBscwidRkTfRl6lir:1jODwrsXrNVAlwPTS4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d81a4a8069199cb989351fb3053f47dd97027446886cb2b0044fef773749a81b
Files
-
d81a4a8069199cb989351fb3053f47dd97027446886cb2b0044fef773749a81b.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 41KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 17KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE