{�q�[����7p�'��/�{��Mq�#�z� ���_�#'=����5J�X�ML:�b �*K�� ��+|_[\�9�rx����4��IN}�G>n�C���s���v�����?��%������6y��3x���Z���eh&�E ����M�<6�a$d�0�1d��q2��{��L�3s��c���¶����E���6g�$�ǾȬ��F���#��\��2}v:����e�oV�UEG�k������x���dqe�����L�QS�<A���k��=n�&/Δ/mb��7�z�l��l<+y�9��F��es���Hr�|?�XP8zw��j��X����t(l�Y!��W��兗o]�����q�Qφ%� 05�0H,l.��9L�����T���Q�h\�\L#�7�N��Qt������sb�����g]��I��Z7�C<�A'8�'D�+�ͬF���0.E���^���*v�o(�+v����jR��C�(\ A #s1:b���s1f���(46IPrD���1eϠ�>H���A��1�>���wG��+)?L;�oհ�"���Mk6�_6K��-EaR^�0Ol7o����!U8ȣ�_�n:;���~�0E��m�'x�z���� �;λ�b��-��WN-�koR;}4���wHJ������]�O�"R�Jׯ>�.?��a�5���|�� �i���"ېR2ѯ#��H����p���V��Gː� �ܸz9fخ�H|����Φ�l?��CȪ�a��?�����Ђ���9���R3��x��]�UyZhD ��M�=�4�'�e�E�Q�z�o���Ol����v u�K�{���P,����%}聛Ǵo����aOͿ����;}i��ѡ2~aLȬ"� |L%K)���{C�3�1�/% o 0��X�1���@#��t��#qp�T���R?R4��u�����k�ڙ�r<&#�]��FC���7��C�TY֍��gY��Td���fZ��M��+�ă��_�.��#K���#w�FF���S�Vw��u�(�p�P�< ���A�ӌ����ҳ����W�7��3�����d�;�%M�RN.�~!�*G�-������U��L�n�Gl�V�/� �;𤝬�8t���&�q�|]u��,<9�,�Q#r(��,(���W�l�����os�TEKjt���Ǻ�EV=[7�}'�� :�t`�)���>Q����Ͻ!�P�~�s� p�k�T���Z���S�3�{�aD��wĻ�o����b�����A�ϔ=�gLS=02���QS {��-J��F�B��b��ocV�ؔ�u�ەB^P�4��W$���ϳd�RMC�u�^|ek9ĸ���������_�sp�5�K�3���١E��#��кe������= ���������t��V�^�P�x�6ߵ�d_Z���~ar�dȔy�Z^�D���#��_n�4v�c=��٣�� bhT@J*��y�Zq'�)�2��!h���S�`}\q]�l�3��������C��⹗=Z��������C���I3G�ތ'���Z�j��j@�~��ڼIONU�F]��y�ᛔ+ �9h1��������gB~d6�[A���Q�X���q����Bc�i���;���Q�YdŦ�9&ҷ�ѧ��#�Y�0ؘH�Ӳ��ʁG5w��ݼ�D|jJ�*�i�z�H�D(�SW��������-nj���Хn|f�o��G=�ݹ"d�~//6���~��d���FU��/C�Ȝ�����$�h�9�\ms���g�d�NJ���,��h)�&��,����Ï*���t7���v�0��ї#MGE�����mͅ�w��b���#��!���>�);x�ϋ7��y�~��|���,>�6�!�7�M����@]3�뜔��1��{�>�U���:5ڎ�*ʛf�0_I���x+l�A���)~���Wr�Cm�����~X�����u�F[ܮ�B�p��fw�&�q�a>+P�����E���|�J�(Z\ۻڏ2���J��р�q�#����p�^1Q��sgN8NJl��B�����7]\R 1by�BC~ˉ���j�d'����&ˑ-��5�9���o&ފ����T����ut4�WdOx�f�0DicD�%L��r�=���U�����LA �#ڽL�Z�����n~���L�*?���7F!3爰��%H��N.ѻ�����4K����Ck��z'�Ps]/�y�b_Z�W������A%�w����`���V�"�*bDm �T߸�W^�O�S�]Fԉ86�������w�fb�c$�f��R]r���Mx�l�$�vGaacHN��`�5D��a#���c���� z*x��p�����r �|�ϫ-TP�Hs��'�S4uF���}�?����0���KΡMV-SO����h �>i�������ɪ����[��E&������������F=d��a�@��۶8��^ڬ�|�(��`��&�9m�ŬK���GZ��Z@����_O5��� \#��&����̇/�<�qIp���m&���H�} =zֳ7�6<E`8;|�!oF���Z�}��쓼�.+�������>kd�?wP����.�BN�-p^�4N�8|��P�1eLh�Ӕ�K_�ή���1Z<�ţKS�Z��ay/J5}J�سN�5����z��̂�:�P�`�WCs�8��%��6n��[�ҲR�o덶�^ ��scP96����nal��?Y�TA5�����G?PG����m�S���/�QH�_���~)��{ڒ�C���%XZ�������K$�18�Ҫle�gE>5c��f����̯�� ��Y��&Y6e�I�g�vz�<z����5�� �X���^L����L1��˻��c�������0�[7��}����ŕT���O{�Xc V�I��T͆��g ����,����̭��U�f�D�VH�d����� �Mc"�x���������y�����A���(x�#�[���a �/8�iݲ���I!}���s�mo�d!�5Öp*~��� ��h��'��Mp��B�%��������*7 �T��/�lqy� �ӎ������X�
Static task
static1
Behavioral task
behavioral1
Sample
2dd7ec7f9b19bfa9e5349bcb235b30c40f680a1669d91570536cbd0c48f0e11c.exe
Resource
win10v2004-20240709-en
General
-
Target
2dd7ec7f9b19bfa9e5349bcb235b30c40f680a1669d91570536cbd0c48f0e11c
-
Size
2.4MB
-
MD5
cde1176d7be1a6d4f23a906bc2aaf337
-
SHA1
c3f342afef07f9fde0d16e30a5e34a2aba25c454
-
SHA256
2dd7ec7f9b19bfa9e5349bcb235b30c40f680a1669d91570536cbd0c48f0e11c
-
SHA512
68fa93a202cf59fc34197c85a7fc3bbdc3211e4c3d7812b697516e473747d8481bb58a9a8a22946f37e299c786e92b498eb5de34877d638981516d5b989c49bf
-
SSDEEP
49152:9lpY+KHqqLPlVNeEVzuH+lsM6Hl9ppPoMCNoCwoM419zsMKQfFLAF8swu:K+0qqLNviJ9ppA7NoCwoM09zsMrFLuwu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2dd7ec7f9b19bfa9e5349bcb235b30c40f680a1669d91570536cbd0c48f0e11c
Files
-
2dd7ec7f9b19bfa9e5349bcb235b30c40f680a1669d91570536cbd0c48f0e11c.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 41KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 17KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE