��*� N����C���s�&��̨��YrG L�>���'�t+�7)�T{BGP�q�Y0������/4��S�j��M��D-̔���[��X�/������P�&P0 ��X��� �dzz�!�ٯdަ����Uo`2�6jL�:�Ì�W�9��9#�c���� �f����� R۟��e%��}P���:���d��`4���K��R��HY��R&\��k:�����.h��ջ6 T4:���q��X� �����D�ݟ�����+�����zm�D���k�g��`*�?�|`�J���"~�r0�7ZQ&��˝���~Z��Fv���;CNJ��hsݽ�^<;�]|�_�:���nb�C����V�%�.+Ƅ�+��G���f�����9 k���U���� �lS�E8>�/��^�?g#��D�3�pG�/J�r �X���M�<���Ƣ������&�C�� �*�.{��c�}�YC;D�x�� ������2��5 �dq���ѡ'�B���|�[������Pө�e蝩����R�&�e���]���g�Urp��G2�Qn��6�v�Q`~�w�넻��G��[��B;� ��Xzb�PX����wzg��{!X~��@X[ݜ�#i�˕��C������}��ȵ�� �I�j�"�P�c��;���=�5ǀ��E.7�gҊ8ma�#�l��_Z0��p���1������'��,*� �U�E�/H��>.68��F���e2�tV}���{���_@�������Ě����2m��kr}z���VmF�ۥ/�\tԽaw���cr�i��փ >���� ���r�E]���<$�~;�`ڌ�R�a�b5B�R"*��R(�P����Xk^���eC�t����r~�����1�:����ǧ�`��Ҵ�C�o�����{�fq��h��&���������"ŗ��4/�Q�E=�c> ؑr���N��u}�F~�'�)�n�С���UJF��>/C�$�b_���!а.���A�)l�S�i+�B��L�m��Ya�VSZ���p�t3�� k-W��@����CE�b���BY0�;)���_��8/��;<����I�ei�Qt�����B�`E���p�U��Vj�M�ݬ����:��sR�F�ݴ��!_z3|���f���{=��{�9��L�PCr� c���db�t�!q;�}������[�g_�\��`1}f4���S��7�����d��:�G,�1G���VlC��WC[M���� ;�D�m�^��W�������,�|f�_��uj�ٴ>�W�^�C�c�F�!���q��� )?�����6G��Lh�6�HX����(���xh�����7 � c����y��l�57��&����@B�cQ\����垂��|�FY��������V���s���[��uo~��1�� ����t�,x�!#�f��^RÄ$�W�˭��Sȩa��. y�e���9\��ͤ>��<և}�~vI�3�aͨP�{�ю�9�;����LùW�:b�����c(�B_:˔���Pj���# �\c�t�� RCw/H�|� �р����kN�i�ch������;h�LJ�p˥�/�\� �W��fQ�0e�JU�S4�bc�7~��pp���&54�ņY͈��6�����v��8HN�g X�w�!f_���|�G7h⿂�cJ�BM�h8�2���H�>F* ?�"T%C��]\�(J�8�l'�2������>Ւ�m�|RA���,�Ҁ�<�C`M��@��"�h+��iK��к��3��@v>y15��?_aEd�3�U-�n��Պ����;Y%�i��O]zGJ�_u[��~E�L�VŰu�Z�~P��BÏ%�0A�<��͋z����ë��N2g�3��:.A��a� ����w��MZ{j���ٔ�4�x�]'Da�W��N�17�s��y��~��̔��hp��s������TL��A��x�rM#�d ����ޜ��CLVG�뼊�+ū}�^����Z����<p�x(ڜ�y̅���OiЫ�Sv<e��*��/����,&rx�%�534+�"���W˽|��"=��Q�:�鏌P����)��<1� c� \%�~����ė��]dVB0�b�7��`T/E�6��z�*3w��a� �V��顾�@�\kV�<@ A���)�k;���2&K�0�8�ਢ&8�5ۃ�n�pE��:b$��o-�� ��=�VP{�2�-� �J��P;F���L�f"q�5 \=mB���֮@��U�h�t��i/#��<2} ���9H����h�*��Xvݳ�b��ɑ����b�'&��� F̣-o܇�T�|Q�oex��k3�\5��z�#�@�s�e�BF�Xqa�;OM� �$�,���*����oZB�����B�� 8���W�� �>�4SIpU����줍Ncs#���ڀ�%���A��翊�T��|�)����s�}-k��x$�_@Z{*=S���A�: �[==`ݭ��Ŷ��S�f�dC��]h������4̫�4��0�H� ��¬��{N�r��11�W�̓���v�\T<�Zd��p��W��4�2�aEC�.���cW\��_~� �!Q�W�|��#�v?�N}(�CR+y���KW�D�ZJr����ld��}���z# �G�X�!Xv���+�o�Z�r�&FylڧҠ)C��غ@S��,�[���OW�~���� ���8�7�j8Ћ�,P$_,�<�����|5��`���0ޭ���~-�����J��d��ְ�zb�v�_>i����+/2�o�k`R��9��Y�^d�Z��M2�2K�YW����I'�f�3�R��lWW(ia���X��@������C�m�v�t�w�e7.&�~������䄱g��"���#�n��hՊ���L, �_`(�l.���in_.�k��*�׆/� �cX/�ȼw�`�!,*߱FF{FJ�1�Hu:[7��?!:��|�zV���F��y�U^a��lη7� ��.�h���,s�,�Sb*�+�#5�LQ�Y�ly^�E���I�@]�F�4�er��"vRK�$c���0�6��֎MM��Dz����8uFL�!J�N�Q,�����#�,.����I���^��\���ŦĈ�.3"$�$2%ISvJ�6lj�<.}��c��a}��w�nP�w�����/�ޙk�Y� �Q��m�+ާ(nv�{9�<���<��L�,�eͦC9�6����v�����ڝϿ�nY��7��h5<l�_sۼ��,\ɰ��R��X�_�Z��y,����A�ƔL�_���5~O��`|^W�&�9�_��}�JY���H*��r�V�k���?�&%}F�d�:WW|�З�;)^�K�*Y����k&�>�0��������v�n�Ip���H����� D�(��\��}�ԻŒ��Z�qF0���β�W(R�Y�*1WM��N�/l�S�7s�ǡ�Nժ�y}�\jg�2pD��r�Mۋ�bFM$ (��j�U�^�s�Ȑ1�*�&���o���<p�EL�m��X�4�, ��jx����ʄ�G�0X�f����<��e��}�2�,K^�9�V��eݾ�l!T����B̄ ��։҉�ɺ��r.u�P��4��+Z�:s{�m��3��������+o|4n����t� �ЩNdm�<�� ���
Static task
static1
Behavioral task
behavioral1
Sample
f8d60e6ce8e2ede5d5c3ca1ad4ba3e11672c6acf8314e78125101c2f436f3643.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
f8d60e6ce8e2ede5d5c3ca1ad4ba3e11672c6acf8314e78125101c2f436f3643.exe
Resource
win10v2004-20240709-en
General
-
Target
f8d60e6ce8e2ede5d5c3ca1ad4ba3e11672c6acf8314e78125101c2f436f3643
-
Size
2.8MB
-
MD5
5d12b845b48028753273792d79271b62
-
SHA1
493723c484d1695ea51130e8ea7e7c0ce63da601
-
SHA256
f8d60e6ce8e2ede5d5c3ca1ad4ba3e11672c6acf8314e78125101c2f436f3643
-
SHA512
5b9f312e7018e06448e5114364a3041d8ea246346ceac816dfe1df3b001c95cc4d271a62f2c323b94e24ac6f6dd6d41dbde042c14256792c1a6a94f4b420b0ab
-
SSDEEP
49152:fQ6v8LINmPSJILBihaKgN5AK+K5FkP5oESZZKK3auyZeVYhJco1IWbNb8TCW:fQ7INcWKih7C5AK+KfkRB5KDysVYA1kW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f8d60e6ce8e2ede5d5c3ca1ad4ba3e11672c6acf8314e78125101c2f436f3643
Files
-
f8d60e6ce8e2ede5d5c3ca1ad4ba3e11672c6acf8314e78125101c2f436f3643.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 11.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE