�ܿ��Z���;��~�j"���Vxݝ#Mfi�� ��p��O����m9{�K\=����B9�a�'�{4�ߐ*��U��J�:ƾL$��+���F9 cB�I�9���n���1q�˕�ԃ��ľ���9%n�.�e��ښ7�cBf����(��w�;�3�.ǔI��ަ�{)eX_�h��4�m>y��Y�d֪^+�\����nMZзgʹ�-��Pw( ����c���Sӫ�u|�V���M�;�Ǧ)|��% Q;�J�B2�83�����F�EO�x�����NU��c�w˖���{zvq}����;����5�ZD�6�|�������!��)J�{{i颯�'����z(������HK���h�u�rao��r��#8j�(�H")����`n�p&��;�w��z��� |�11T_<AYú��0Yvi�jmG�����t��HWa���g�Ըp�ةj��y�j�Ǹ_���!Td���u�������CCi��¿��ݵmPW��J`Ÿ8e,u)a���qv7xM%�D0+�:���03�>�+���SRu�^^;eP��`���OZz�����7��꠲ޡ�H����a�-�V*�"x��T��$s2Ż?��J�ۋ�{:NddPR^��B;GF��*e'�$i���I�� ���G��S0��}�A�(�l��[��Z�85���!�,����'�#����i�c��4�`��B�_�t��8�@�W�/�6�u!�P��w��%=��T�.N�dn�mt�[�X��kT"y���N�ߋ�П�凩!dh84���O�u��\V��`@r������$E��}"���e<�Q�ө�����m�R�z��2V�]}M 6W��< �aD����6C"�Yi��h,.�}��I�.�n#��GP1�%j�qPV�ϰ����Ԙ���R�'77����{����roi��fЂN�y��G��3ވ��}��@��-��U�Y�2���5��:ذ$nWVP~�%�7Ō1���٣��)1u'�`�.Q�\X=V\j����<]�q1�NF��sn��t"S��k�3�wp:$���{���|'q$�v1n��w��Sc��-�xa���e;�D2��^�;�h���MP v˩� �/�ʆ�n�W7e����K����L�|)kg�����*(����B?}w�"��|�M��1��q�р�����X����R�����n��54P�k~�\����e��� E�=�#��c�����K#��j�H2"�� O��א��v��<eL��{��J�3�d8e��N�o~����;D��E`����U`��F��A47�S�fe��1�Ӟb�<4,���֊����X�3�8�过.V�EJM���)+��Ţ~����C�I I�'�n# >4�0h%�h��+��"�e�ĵԃ�a9�9^�E���<7��T��ij��p��N��'�_ԧbgX$I ���.�l����J�[8&���D�^�V�D���0@)�QI �v��Lw"(�x��7*���l �n����8��[��!���=ueDY��T�jbT�X<�j����] Q��S#=�:,LQ5�|4����n�s~�:���ؒi�5���Ҷ@�3QSD�tB��j.�G���+�VH�=N����/���MamN?G���]��z�� �$�Q�=U2�T���dq�9Dc"�J�|l��k�7����~�ˡ��������*}'1:#��"�~�{P|�8�s�f�w���o��(�/��虸8&��2yXhh��/�{'��酵6���b�p�����>L\�}�D�1C��xs�'�0ƃ�q��s��X����]y�,�ه*���oNA/2����� � �Q*�6+.�TMonR���t���|s��`v�TG�dK/�JP��`����p��i0���')�����cW]b5nj&��r+�4��y�`���2����hB�As~�h�\�O��흫iF�_�}T X�ح:5�pKTc�i����d�YDܧ(�(E�T�i'�<�<e;�%���5�l�z�U����� ���o ��0�vj�ْ��RA�?�D�4}����U���+��h�5�Hh���|�� Ȯ�H�����BF�c!�jRH!E'�at���]�����5��N�*�)��<�|cʺW(�8r�rdtl��sVn�>V�cK�{&��w6���)��g��hO���F����n<`��*�Rg]�6�@��o��v��� =�����i5��m�#�;Fߥ~�h.<�_UA�ۺ+�G�,Ԕű���'e��G sh�wK��d�¯U����w��>Y��v�p�t�k�2�z���N�\���H��ba���l' �N�>���@����-���i��O���ޣ4�=��Ԕ�4��1G2���o�[�V� �rz�x6K��?>�ۣu�n�E&�e266�(�Y�jꆅ������Z��m�nMJm0P�X<�\q)9|��)�w�������u���i��^�#��d���q�#��Ú�ӈ�Jp�k粧��R�F=�(�����e.[v9�s̆��w<���3��}ן����:� �B�P~�������11���Ja���E���7���� �G�M�������������v�[ ��R��W�hPWD�4)�@�d�e���r�K��� �韫[2n��~��p��q�x���HE�ڄ���V���~ի˩e_����T�T�I@�{��$F )�]\��P�}�;�|2�Ʉ���2fpu?���آ���a�)f��k*l���`j_V�V��$�BF�B|�H�^ߺ㚰>)��X��y-M�����±E}h�g��z��������nr�l�6@��t��q����,?��V�(�`0�`�vS5��4�/�2�i��D���R�����N��a�'�;Z��R�gx��Ktx�tx*�(4Gi��A�Ă�����(��㹙�"�&���R����[L��b���V�_ANjP;E�u�Dž�ia���5�ܭ��7ZԮ4�#g!�d��p�q�$u�q�ө��gJ�δ��JV���Y#��������Fm;˅Y���nUߦ��{��1D3,xּ>ȤKV�^�To����������W��FNd��e˯�j��w�!ĕ�J̮A6�s�P�x������WΦP$1j�J�v�Uo��0���nuV���+nQ"�&�>���];�ʭ� ���R\Ѳ�����7���D��J5��|GpE^�͐��+a',H�1�]�9fw��K����c����ق�a�߆Fb�7Y�щܑ�3����xx�n��{�D3a��tkj�xQ���]ˮ6%o%:X�@��Ͳ=r/�q�ˍ��?��v��V�&��G�Y�Ԣt�An;����__�Zܺ�=j�8*���\z�TCo>s���6�a~��J6�g���݊?)<a^�/ԝp�z���qC��-��v���!A7��Cᾗ �#�ݲl����r)��^��!��?2Z5O:��ě����̓n��&�cc��9� �����Rz4�o�mZ�����
Static task
static1
Behavioral task
behavioral1
Sample
5646771bfd6b38053bd4da441517b084d1176d5cd2f6c9fad78710746e5d2c64.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5646771bfd6b38053bd4da441517b084d1176d5cd2f6c9fad78710746e5d2c64.exe
Resource
win10v2004-20240709-en
General
-
Target
5646771bfd6b38053bd4da441517b084d1176d5cd2f6c9fad78710746e5d2c64
-
Size
2.8MB
-
MD5
d48e54bdc46719d0a343aed2e08b7893
-
SHA1
e2fe3a9e64edd6dc40acdd720fa2a1bebdfdb908
-
SHA256
5646771bfd6b38053bd4da441517b084d1176d5cd2f6c9fad78710746e5d2c64
-
SHA512
2d6d74f79261d84c1a2a782869d775d9acc88ff7e2ee173b9c4400e5a5308d6b42d0ba5bd4173f13ccccb23a33edc03f2ae3c11d92681727630e178f9687457b
-
SSDEEP
49152:akYxZ1GPFR0UmWpN47oLbDNMHeQ0b6pDPnNOWVCZ7t6HXS2FksuOYbJ3Dl7hpVh6:D+fGPFR08No8fbcnMWEZB6C2F5YBDl7q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5646771bfd6b38053bd4da441517b084d1176d5cd2f6c9fad78710746e5d2c64
Files
-
5646771bfd6b38053bd4da441517b084d1176d5cd2f6c9fad78710746e5d2c64.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 312KB - Virtual size: 660KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 28KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 32KB - Virtual size: 308KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 208KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE