m`����w�HN�O�S;s�� @T� Wi%85��`����h?L���FW*7 /����p'5\�� y��r�`�/C�z!p�0�O tD?ݧ��%ˢK�~�������V�V���3 S��,�K������FZU�_��en!�Ղ���+�2q�F�R�k`���ŅQ��]�NA5��cyW�����(�ņ`o��V�o�$ �� �8`%;l�kS�_��V��@iy��F�ϓ�/F���(r�f��w��À���9�rv��{��%Y���W����ſ����Q{ 9QP=X�����X<������/����1�X��_�I����SH��Э�N aW�Î�Ϻ\!1��WIX��[�����~��Ⱥ���'�����N��"��nʦ^��ܼu��̆F�'�y���6#��v�ӠX��`��J�8��<!�+S�`����x0���Ѫ��Ԓ-�����-��w���.k��H4��N\_����U��]f�㙞SWa�(L*�Q�2����8��rvw:��!r����9��vގKY�v�]�^�/�F�i��K�vĸL���%+�6�����2O��?y�z���@�%�q�sx�2�ַ�WB��V+��&]s�����2��T@�{`Ƙ8+xX��/�d���i T�$ɯw=n��D�Z"o���aX�c����=�-l�D<���L�� k�S7\T�ʜ@���P���c�Κæݼ� NUA�ڬ�b~R�(���@4�����+5\��P� j��gnͅ?r���|+��DI�G��#u�"��H����A���D�sq} �Y/|��Ƞ�����8�rTo�/�t�_M�,ʻ#f�<}��ĉ��;�U��])��P�YA�xp2[�%�5��!�RA�v�=C'��X��&����=�oi���l'����㈯�*9[�A% q�Ϲ0˖N�R iv����v����1").˾����-.�Il���� �V��i��s+{��Q���b�<�����4cͦ ��N�~���ʥ��6����b(Ď$o%HYY:J��gG ]M�M����F�4yը���gd#a4[hW臠6S��F�/<P��3�Pp�}�b����{����+ճ��4e�U���J,��u�>!A �h����u�&���W(�� �����'i8�����V��cgBH�`�;�/��JaJw���x�'8 6{����/�'y{�I9��S&�d,�z�{�#:���_�m�&V�,�����sUKC�����^��:I�{�CD�%0��Snj�EѵX��_}�2*�µ���BO���ŲowO(�Υ"�^���06N9�����r����/����$ѩa��?�=E,���H�+/���[��ldsi�0�Xg�P��.��q���͎�X��D��; �8p|Y��~)�������ʓ!Wg�ǔ��U�aQ<���~�9,J�<������T����<�^�4i�7�E1��V����$�0R;Lҳ�t-U�L� �K��6�?=W26�� 1:RJɲ��G0���zԐ���ߐ�7jÂC�����������4���å�A:/��z?&Am/$<�/�ϔ3�,;�a&2ԛR�����_��Mv��>�Q+ ��ye��ћ��\|���M����a+��aj��������� Ѡ����4�3p���#�W��f��Pc��U1F��rBH���6����3�T�b�K����O�l ���v\o1�]7�1m4RI�F8�ޘ�Qq��s\o�ggӭ�L�^G�IiF~~�3���!;�i1���E��CD�� `�D�"g���O��Xߩʉ�4;}����!��,����\��`�<o�ZaT��(lI�s�y\5[j�!Y�#��)�h%�)�c$T(އcr|M��h�%�;p�vY�~�L������d$�pY�RL�9�}��7�tx�b�-7�f�q����۶Ѡ��j�_���r��� SB>MD��b��<��H�=#A�؊����m��G���/���֢X�{�2`� .63q�����Ac00U��������/���=}�����tay�s��=��e4Jt�V���" ه�h��u)����ŷ+{��e7�3i���;E����5>Y���-W�!�b&�����a�ϭ%P�7���\$��W:��wF)[�k�Q��(m�fV�I�PS�wb�[*�h�����gBN8�[�hiT�O@�Kw��ߡ�h}���9��u�*��,�YI�ޝS{��f��A�Q���(M����@ �N�gf�l����Y��e�A��dF �e�M��gt��� ���1J�>��y����K�⁍�v�b��%Dz���]U��{�fIf� ��Y#���N �cy����)�@0�sE��=Y�n)�P��8���Z��)�'�W��w��5m7}m�E�m8!�UB��O�y� ��:}o'�r��)�}�H4ZX�}�D- �qoDWp���v{�]����vG�������V����M|0��z��t2�c�&� >8�F��Y���l��̠�=g�S������O�=�7���^h�Z�����Fu��&:�Dn��>0'�Q7e��6���S�=Ux��W��tρ�b[6�cz'y��u)��t��>�Ė���=fJTD2�)���z�`%q���.� �Vq�D�X�@�S��d �FG�s�z�Z4f4l~�z"� ;� 6B����O��kҊ3,hu�C$�&��?��0%]p�y����N����^�U�u>AMn���z���\qc����fɯ� fU���`��{�'�� ��j24��ʃ��I �|�-V̝��t-`ֹ3�|`>�t�ð��'etW/���EQZ7{N���P+b~���\h`�F������4�H��-��A� ������m$v��Fi/����?Q>dEW@��#3�]%���8�v<�+~�T��;t� ��<ds�߇�����}�\�B�z|�]���t#0���˃^��"id�:���-�2��2��0������������:{W�@$}XU4=�q�[��T�SiM�rd*�,8�6TDu�J�Gۅ3*�#(V���XߤJm�l�jq�P&�T�4�TV �UN������%�x���+���e���a�P���g{%�Y�75v�p��es5����˞�� vg������U����Fl������i�|sJ�s����_4%�/K����AN�����%��(�ϝ�ʒ5̲�*� �_�=X7�@��K���鈄�k��Hܥ�W�|�m������6�4۟�8%?�z�����^���K�����E��&��yl�Gى�³\w �h���'Xg�� �����uu@T!����M<���^/�tBN�Uk*����G DL }O_��&k�S�Mr�A4�-Ɛ��ʐ�+�[�Tb3�9��I6��\˝�v��d����]4Vҏ���͢�/�1e���:�|����ϣ���T\������� 9�_�O���WÛ� }�KuC�9j���_(�:8�O7>i�6�с5�;�R���0-"`�"���<q�:5Ḅq��<)
Static task
static1
Behavioral task
behavioral1
Sample
f0e8c18c2bcab05041dd93398bb63c0cd782e203f9e58421e7f935e68a129924.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f0e8c18c2bcab05041dd93398bb63c0cd782e203f9e58421e7f935e68a129924.exe
Resource
win10v2004-20240709-en
General
-
Target
f0e8c18c2bcab05041dd93398bb63c0cd782e203f9e58421e7f935e68a129924
-
Size
3.4MB
-
MD5
9d5bb6f75b9fd22667cca2697915fb8a
-
SHA1
65a8350630c3c34d2c3bc9596cead9b1fc0c5baf
-
SHA256
f0e8c18c2bcab05041dd93398bb63c0cd782e203f9e58421e7f935e68a129924
-
SHA512
3693f6b44f5f26e872f846264ec4613ffd5809c1f6b7f82056052cbe910cf342a368eec26758009e86f6fe6987229ccf222b7a4291e395ad89e37da6fb302500
-
SSDEEP
98304:7S2kqpIru0Qha2W6v1FmexISs8iS2SzuNeEU0FBU9:7S2zpI7L2W6v6sJKbJN/z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f0e8c18c2bcab05041dd93398bb63c0cd782e203f9e58421e7f935e68a129924
Files
-
f0e8c18c2bcab05041dd93398bb63c0cd782e203f9e58421e7f935e68a129924.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 300KB - Virtual size: 12.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.0MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE