9��vY����7�cY�qV$���:��bW�~q���ڽ���ωQ�G�>E�N��-�/��{�˕�h���݆��_�O��"3(A{ 4{�Yn�w엽�o��V����z�6}J�l3l���@�V*d�^&y�(��H ���֝{��D�^<���5�Z橏�̑;�b�3�7/� Z����U���8�8�kR�����ȕ�JG�}��������T�TD0��3�ƢWW���=�`$I5wtb�ypw�+�O}㾠����]���3�wZΓ�k�K�5�Lj�������S����Zw<����O������+�^?,sG�8˶+�"�R���n�>_�a�f�WqS��e("���P2���d� (����r"*��d��1f�K��������n��= nG��;�v�������g���_b��1�����Z���R������Z�[&�|qe�A��o.a��`����D�y,T�S��>��k�|���xO�4�<�~ ��(��]M��vQ�Ѿ������:�NU8ֱ�ABԓU�@$~[�Ӷ��/�F����d2:Ʈog�Wq<����.�G#� |j�a��`"3�&m�04�6�+�}�߭,�R 80悁� ��#���:���z#����c?gcK��� �� ���;(y4Q����TTT��pj�R N��³X*��kE��z��W��{@xC��z�}�Պ��M5�W;Otv�qks�~<�$�i��m�$z>Q�{Q3�%D*����$�Vf���y�G�j�EFJ���s�͚��ޙ��Z�i��|tl�E�!yVb��?��@��5�=�o�#�k��?�� v��L/8O�S����Zi��4��x|���?����-!&���DB�m/;��ԯ�O�y�8{��c�R�����ίY�;/%S`�G\(ǯ����@ؙ�h�=c��I�O�a�֨3L���Ҳ�|h3Lj#�0]���>mgN+�y"+G�W������S�����+)�x�����G�L��Jm�m��^˨�,)b� �/y���G�nVWf��W��.�»�oG���WI�~� uwYfF�ڗ�W�b"�I����|��7�j�~�t-���ܺ4�����m;�0"yA�y387ܱ�C�|<��~�ņ�dYc0�P�:����s Gb�����k���0u#�g��+!�-���Tj@s<<��O)Ȭ1�� ���� ��̒Ck��h!O/�N���9�ܜ�,�]6g�v�!0N���$�3<� ���|�0\cQ]�ś� �����#�RVX{���W�2�|z1[jp(���~�swĆA9]�_C���C�*RVYS<��d)��0K˩gr_�WQ� ��F���k�d"j�JO�pϞv_"�~�p��K��T��c_�iW-� �t���iʌ7$�Z��n�:��tЗ�! '_%I=ݰqZ�sE�[uY:t��P2�;�f��ʼq����>��O���z�*Eul< �l=UD���>�f��<oe/k�|u>* ��\�(���*LAM�@��H���G:ψ�-��������9����ZMs>sZ^�I>w���}�~ ���a��H��*"��"<ud�p���O��#\%.�X��@���,����}���7>l;OG��r�4��%��=�G��i���>/,<�� ��� ���K9u˒d����y&ȐQ�����G:�P�i�!����4e�2րN\QM�+K����X4�E� �0���J������F''`�p� ���q��=��\�L��w`ѥ:-�b���Q���^yi���b�I�Yq�&:�j��������V4|�̔�H���EI����t�4���B!ub��O|R�"w��K�|��ж"T�h�ΔDe��eS+Z<Fߧ%v>go��ߓ ]2�@dp=xe��@��bK�o?�Ȧ�w �sek��jϘHs�~JfՉ$Z��b�3篘:+��?�Q�g���f<�Le{G����S�X��N��|�2��{����<:��R^{�r��m�m,��c#���ua��j?ӝt�^%�c�[jj� �D���Ʀ����5�b~��:ڏ;�arM,봟)*UR?#.����Mp<�4i)�6���/r(�gK�+k��Ct�ٓ y��.>���r���^��ʌg��(a�%��k��)��Ī;�B��N��Q���(�w@+Ic���M��C�6}s����@<����g�L�h˻%ὲSp���-�E��0[�56���;��5ǵ���5��57�tk��֒~S=I�fӭ�W]���]��b$��P��]I'*�s!m'������\{��u�GŊ�!kOD���Ss��v�����$o�L�=���Z7V���(��:WԲ���đ*�Y�;O���Ln��TD�`b�ʍsw�!)�(g�<��Av�8���J�^?�x�M���0�t3R7y�m�T����\�����8=�� ̰��'��DB����4� x�!I�\_Z�u���i��(!�ra��k(�N�(�����Q1����RhZnaW��<��:��V��Tp�h�#��K�?��Ԇ�?te2%l���e��2rF3T�����}�qA��1i �r ���;�0�w���������Y�A[6�FĘ�������)M���we�l��pr>�M �f��Ľ��V�~$rT| T�mu�T F�溴��9J���}#`;���9̚<��T�le�S����X���S�@h���i57|���A�)���n7R��,�oQ��^��A0�3Ɛ�h�qr���$bW_�{yR-��օ�۴B�~����(�갑����Ā�����žHz6��rǦ��j�)��X��S�����qkQuG���\[sݫ��F���r�0�b�"0ܥ �lu�z�6t�� Nv6/5�rC��_(f)%��;�8�,��y����(��c��}w���4��T��@h3Ťr��G6��"����xG3)x3;_�82��삄�Xe_К� ��,A��VMږ��K�a��8 Tuq�ɥ��:9�/4 �#������Z��ā�9Q��p����\I~��C������pK���>@|�u��V�� �fH0��\i����X�kc�*VΊ.�YZ/� 2�j�����@m����2��l����Y�]��]a�v;�Qt0H|�&��|V[F�t9���Pg蹺�!z��t��\����� ��.�v�f�a^��H4i�z��J�l�Q��;/�(��L��{�H�K��N�3��L�nn�0���Ƶ�E��cB��o[ǻ�G�ܽ���� ���@�Ɡ̚2 �Bh%"�:f#����Z͗>S�^���(!zq��|� �u��%e�������x1���FL�����a�E��������t�nSb��av�0ѥK0s���զ QU��[�d(b֛��Z��E��8<� ?[�M�r\�SY:7-}�o�RP��m���.k�8��u�=U(n�/�<���LI�X�C��I5�DO�N������U���}��a/݂�A51X�Cܞ����Y�*����b��[�"R�A���BR�M�2J���uw����P���2�$������
Static task
static1
Behavioral task
behavioral1
Sample
6dc1a78e11c65dc90c3302c2d352330710d6eceac54765f05487218a0dfabc48.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6dc1a78e11c65dc90c3302c2d352330710d6eceac54765f05487218a0dfabc48.exe
Resource
win10v2004-20240709-en
General
-
Target
6dc1a78e11c65dc90c3302c2d352330710d6eceac54765f05487218a0dfabc48
-
Size
9.3MB
-
MD5
ac2ee47c7088c1b6cc7a1e03551e528c
-
SHA1
52cd37c400e8085a1317e54dd2c69c5f8511981e
-
SHA256
6dc1a78e11c65dc90c3302c2d352330710d6eceac54765f05487218a0dfabc48
-
SHA512
8900288dcf0dc403f3b69dbe140a232b2f6ec40b54b4e5be887cd90b26b5f2eefe55db733432c2632044c50ffbe01d0654b8b2ebcf675d20cbe5f53d306d1cd7
-
SSDEEP
196608:Xvfqc0w6y6lpo4LuU1judWoUqvQGWvkXnBA9/l6snIoBubpC:XvZ6y1UelvQGWvwnBA9/l6snIVF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6dc1a78e11c65dc90c3302c2d352330710d6eceac54765f05487218a0dfabc48
Files
-
6dc1a78e11c65dc90c3302c2d352330710d6eceac54765f05487218a0dfabc48.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 544KB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 28KB - Virtual size: 332KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE