'e�0�rRu]�C���J2۲;����3ޒ���E�h�'���Z�Vx ���1�J%�Jxا���"�ߗY��>��4�2�%�����vbu�7�ycn*�AXٙ�/���Ӆ?��l�Bk�z[���P�VV�%��<^��X�w���?~�giE�������S���y�3˫rR�J���r-���V�,��A����N�rc�K��Y�1����������1�6�;ł�-ݍ�:Hjv|9@�4�z����/��B]l�2����A�$lO8S!��!#�ۻTG�[vq�j�I�|y�G�Ր�U���UK����{�v�����J�lO��Qâ�̣b�����B�JK�C��ӯ���h[:��#H�c2���̴ �P�Noر�%~������[�Q;82跟z�������llyU/�3@#F���Wf��6�(������8�Y�+%o�d�ѯ �c�_�����!�b�任*��0.'n (S�� V����ܭٌpv�K����0b�l㾔xr���2������>j�Y��m��j�[oڂ�/��� �?3�1��l���\���f�~��x�<�(x�J�o��ܓ�����]�J���;1Cj���+y#ʴz�#Ҳ�Ot���a��`+�������ӿ ghIa>��o�;�H�7HRT��� �����>���<2��s.5u8�"�[覙�^�7���q��l5��U����;;�x����Z�� �5��&�ȆI{-eS������ !~##�uu4= �d_]*�G�4����Ɖ8�gJ�ҿh�r��_���h%I\=�R�"�0���{EUw��*5\�а ��ܟ��J(F�f�oU%�>:v�jG�?��9m���3��"ꎫ6��c�A8��]^|W��(�����x=z�3��E�6PdN��� W������q��?�C���H��7R��wv�����oyNƽA�����j3�=٢j�YO�|��Β�ճ�@�;���5�[�~��j w��K3�H���?��� ��o+F����$������̢Tn���ĮP��8�QdNW]���O�G3k�b�3�+��2���EA��\Cp��zX�-��&�� ��i�Y.4e�&��*n�W��^�_������n��̍x�� �X�(�5OXu�fax����oV �!Q!�1�=�����������˧�s�ɬMH����Tk=p�U���d�,���lfR�h��}�����M�9Zn3Z g ї�<���)���9��p̏"*Nx���lr�.���⠲����3]~}%P��'/Fn����r�P�v�ēH�A�1����44��T8�XƄU�o_�ԡ��LRL��n�����F�+(DgWkAku2��E�0�>�����s�$ߎ/�{�D8���{���m�ag��H�f��`�|�W��Qe��$Kb�݊�鹔#]=��47q�nrq�����]����G��YGa��$h�^h�� 3����Ab����i�'��踭��b���l�̖��N��ڐҐ�=��hI_��+�Ș�����M^����5����ĸ�á�jl/��&����3����"�3�ޒ<���E�몊��JI6X�ۿ��Fg�!�������d���4_��������P�aJ��L�C_ՋCj�j�~�0�al��X�-�*�R�,7I�O�Uȏ|�86�� M��� dT����Y�*^F�T�$�F_G�j��,����3�N���Kƻ�g6ϳ1���KF�z��dBJ��pz��[n���mI�J;������t5~:����a\g��k���$moXo������ա�7g�T�Z�R1�Kl���t&3MkZ�s���.���V��L���=�U>����yz��I\H &�� ,� �PI>w��(�#z4��r�h������P.i���Ǐ�Ÿ�6����^\L�n�'(�������`d1D�������U�r)}�0�*�6;��6�K��_� ,��i۰�,O�TRCi�C�������b��c�Y��v��]��|�ܒ���.%������4��5����I/.<T���YH��RU���]C4v{O2W;�Lڀ��+Z� UH��ⳗc�7���L��{-?'P�8�g�-�� ����<'!I�y`�{������8�8�P:!k���$��w�;CȜ� t��7��5(p&���� 2�h�����T�ٻ�-17������u�Wp�Y?�,��m�#��^zɟ�%��z���@���V��p�3�����kGyi�w�����[��r���F�m���������9��(LD�@��F����s7KA��5J�Qw���2�P�4�`��M5�̇�[�лmq�Yڐ7�s�z�yZ�N�Ȑ]Lg�ܜ��w6�E��J�Ȳq�������ѧT9��'�I����c4~"V���"�f���[dx���RӖia �Go��RDҨ���خh����X���������Y�D��q�>m��"η�:N�� U��H��|�N��x�U�����4u�(2B�a��&����w��X�/����T�>y+�O����<^v��2�|��� m��w�t��A*y<8���Leί�&U� �kd���6������GK"��`d���,Dz�w�:�Fn���� W�:�*L,'��K�+���?��1 k��~(�6�*m,���I��2D\�4p ����W��]^���[��¯���ڱ�%Od le2�"eyU���%ф������<ɈKێS��c���3��yPP��ol�t�6���UvG�(�y7C̘gE%�~��ikMSMk���Io�*Y����;�8)�x)kķ�b���٣�����.�A6���n���aa5+��R�0B������)#��q�j߿7���ze��Y���WW�,��)g�i��zTZ����V��R�s� 3���*I��F3?h�v6�NV��WÊ�2��uGw�>�Q�oֳ^��;�:D�����v������?!���:����xbC��,c���k������4F�X�)X��o�,��>�ܟ�T�nn]��#�$��N��k $��?��%I x���|�-�~�A7�w�a&��#jƍ����E�J�`���#����cc[���MI"�}f����)mQ�f���8�����&]��;u3f_�m��)���:�,"3�����CV8~x�46���C���0G̡��|�×"�b�I����R�8��͖�̭���T _�X�0���L���r���c��<��{���\�r�^�|���q�M�p%�U�N��*�Mt�E���FFf6����Z$������_�P���w�a��8OG���[�y�؏��@�z| .=Z��;������k�3P��o�0k��^T`$��Δ�5>^n6���C� �~pb�1֮������n��WOF2�����R�p
Static task
static1
Behavioral task
behavioral1
Sample
eb68faef247ac368d363537b5cf187170d51a5e8353eaf67dddea40a64ab1324.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
eb68faef247ac368d363537b5cf187170d51a5e8353eaf67dddea40a64ab1324.exe
Resource
win10v2004-20240709-en
General
-
Target
eb68faef247ac368d363537b5cf187170d51a5e8353eaf67dddea40a64ab1324
-
Size
12.8MB
-
MD5
cc764742533252b7edab4d4c3f80958c
-
SHA1
6810df8ab1b83e244538a9de7e60fb3f1bd798b0
-
SHA256
eb68faef247ac368d363537b5cf187170d51a5e8353eaf67dddea40a64ab1324
-
SHA512
c4c0b030840918bb778002ce20015377a775cf28b8cc46928a39ad105b184ff18bb81f2391afacf2b9eb5b0482aead48a6446f8a09dbad7b2aeda7a795eac031
-
SSDEEP
393216:oInfaq5vXNpebZNKc3OICivvt3x/sawePVL:nfaAXaIc3OIRntB/saVVL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb68faef247ac368d363537b5cf187170d51a5e8353eaf67dddea40a64ab1324
Files
-
eb68faef247ac368d363537b5cf187170d51a5e8353eaf67dddea40a64ab1324.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 4.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 135KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.5MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.7MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 73KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE