W1up� �a�"�m�d<�U��p�3Y%��M���H���%�0e�9�6ݣ'R����(B�S�H�L�6�/���.�г<�Ĭ�<� T��b�q��������/bx�(�ȆB�*�HJ�3�a��o�h���7I�����3���PnJ@��B�-�1��y����ܧ0�㴱�.��K+4��n�ۆ��;i�VW��o��_M�d�|�q���<��pp�C�,C���"��j���=*���ҁ�vE���䉣02F��Y�p���MI<zV�R�7W�L"�$�����#0�E۱�rxC[S+=����3r�^y5'�9�Iְn�{A/��Ys��籬�l�y'��L�*Sc��Zlɋ� -�?7T���~����p��< &2�=,_.%�� �C�1��\@Z�d��7�ء%&h�\2;)�u�.��j���K�ԫ�FF�V�D�����E���J�Ka%��V����E�<S4�,����� A�v�+'-ǝN.��ٱ S�j���G�5�4���J��<����;�n~��4�m�_)F4�/�����{�{j��X9�������c�C�N�q�E4)�|��p��N�,Bzۊi.�7�5�:'�l8Zf8o�-��B�Ƹ��$\� _�<bS=�$��I�$��������KVP��1sa���L�,Vvm)�Xe����*�������!��'��%�+�O���U`gh��j�E�� iSϾ��$P��9�z��4:[�|a�nN��DM�?����wR����W�ΤԿ��w.ں*���[kk��l���Ac=n��A����ɄK;&?r�����ТW_�]ڋ�v_����v�K�lF�O�j��P��%RR'Cޡ��#�=��3v ������4��[Q=��ಠ�g%���]%ոo#&�s�s���'[ ����?��y�G�3�\� Ă��D��N�}��C1�4ܖqz��!��>'�G���d�_L��{f�Q0U����w�����N��P;��|�P�y���PX1��1�ymq(˝�-���#�r�sߢü�Ɯ�偽�� �����++_9@��|6�,,R�3����Ip�Rll4��Q�}h*M����Ji[{a,�� y;z��j&��ɨ�*��;��3D�$qz��Nj�-��ʦGnm�@)4A%Yz{�#7f�?�i�vD�9Y!`��~fH������~�ט�JD&�Ȧ]�8�!k��+���~B��e|��,��?�1H�{b��DT�(�����;_��T�BA� ��p����uW�1��OGaR�ZW�((�d�BȜB�A��R�e@Ƽ�>���n��SNf]�_��4�&��'%���f��>���"�^Z��@�>� �v���*J�T��d�](�!������.��dZ��j�i�H��=�a�~Ve>@��>�*�������y��xA����f�lKۦ�9V��ΰ�u����b1w��/�����;�S���r����A�|!Hw�r&���]����0��(<P7��"U� ��N:� ��x9���b��[ߒ�*B�r�+�`��ߏ�8D��w9�h=�%����nU�A�ٗ��I̿�Fi� �?��T6"Q�'�8�kMĽ�-�;;R5cu,���b�ٓ���U3t�5 RR l�bޯCz���oJ��4ś|:=�3�B5��oaS�|����0K���M9�X�h��g��O��h��ω~�V��d����2܇�S���[�|�&��|~�D��yp�_�b�+���܅EAM��8�H�|��KYC�R��\� ̹7�zs�!�o�h��U4������ᩘ1?p�/�%[4����K�T� o%3��xN�9�+��VF&���R5 ?r9Y���t���4���%T�S5�@Z�S�@��JT|�#�' �|t<>��H!|s�̆�HjE��A���Dz��yo�ZbY���_�y:������������3@ �a��t��Hyܞ�|7<��Z�*��r�4(�#�* ���Q�=\[���f5��r���\�!�o�yS9�l�Ȇ��� F���~��/�Km\դnY$�qGF���h�u��-��l�Y��W�?�}8�����v�J�W=ŷ��e���R�bZK��9g�'�a�#�ٳ{jOg�\�JV]Ӊ$�*w���.����S=����j�&d/g����Kk�)5����L����oP���0�%,��p�Q���ÿ�}�x�&��D��9����y-�a�ݓƘ~Nn2���@>�.{�L��?�������H@����t�߰s������=�� ��� ��wiS��=v�]�`��_�D �B���1�1��z�FP��I=U�q��{�*$�jl�k�yJ������5J�x� �c�����n�G��]�Ie���yȩ���9_���ԕ�u� z���2t���u�ڞ���%���c�����h�Hc����fe��jPbE^`F��#Gg��QJo����o�C�� ,N�⹙��q y���J6��6�O�����?�Q���PG�{_�(��=��u�6�s�Nϖ�W�������.�c�K�)�ݱ['"�m%��ۓ����6N��=�4�5���"��4�G��^=t�?���~ICn��f[�cS���v(������2��7Y=R���+~Τ����Tׇ�^+P��ݹ�F�' �ɻpx|�u#�q���1���������HK������;�����R��Wބ�$&"������7�w��^���o��6�so��DN'���c���M�1v�5t��sz"e��(���V|1E��7�}#��a�V&˜]` Λ {� |�IS�Pay�29��>?(�b(L5��۹�L���{x��9ŎW*j�����F�4wV[��Rȳ�n#d��Ȱ���k��mp��� >5����FV]�&)iUR�(�h�������tU�P��r�����%��w��%�����X>*a��&���b�P������G�lC�����ސ)��Nu>��DlK���G�]�-L�G�Y�eSh��JF��N4K(�ۏ{���T��9��[�e��}�H��(yxI�2����=�o
Static task
static1
Behavioral task
behavioral1
Sample
0a25a2aa101bd1fa19572cc5c52aab50N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0a25a2aa101bd1fa19572cc5c52aab50N.exe
Resource
win10v2004-20240709-en
General
-
Target
0a25a2aa101bd1fa19572cc5c52aab50N.exe
-
Size
769KB
-
MD5
0a25a2aa101bd1fa19572cc5c52aab50
-
SHA1
394ee764ab5490c46db24cb7962a2cb0d5a6d0bc
-
SHA256
d28ddb516f2c96823f7f3546564f5f289559950c0c01838536155a15a3828915
-
SHA512
db357f0a933ee205eb899e3b44e59972d30d98d3152ddf6817eb7fdd781abead90a6fc3b8877d0a2408dcf61260a0022aea69934251c12d3a0b4f04513522560
-
SSDEEP
12288:dbaWNbKHV6bHjMujxWbq/5LhH0PMU8fhJXjPg9jm9mPPnQHyQ5toJXOYGq20:d+WNbKoPMeey5LNfTGl3nQSQ5kOY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a25a2aa101bd1fa19572cc5c52aab50N.exe
Files
-
0a25a2aa101bd1fa19572cc5c52aab50N.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 187KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SAN0 Size: - Virtual size: 797KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SAN1 Size: - Virtual size: 862KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hhh0 Size: - Virtual size: 591KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hhh1 Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ