�R�/��W�"��˥4����ܣ߆��\J(�����I����P�v@z��)�\�j����� ����콡�ܩ�M�����/�|���`W�E�mU�}����|u��L*A �8�0c�����t6�:��o������03R���Z��{Lٛg%t}+��{���*�;e1�0U�5�z����C�����H�z��;;�G���|�re{���Hv�_��ڞ�@r�j�^!i���p��N��2F��#���a$�}����GLU���a���ᳫ���U��)�Y�+���<~���"��)OƊ���CN�+��ee��'"�Dh:~��p�>[��͘$D��_ sXR�/�UxC� ��b�i,�!T}�S����Q1c<ʂ�`�Hd��^WZv�7����<�,} �砭? ����D�J�ՕG �S"c+��S9�����{#��(�q��������sG8V,����a�`����b�v��C5 »�r����{�ĶD9a���b&ҧ�~�g� a���H���g��c�b�XG��8��rċ�����U��̗��d�ʌ��I����@�3��kP�3����0`����6���`�%�O%4�A�h�a�����r��q�klHS��|�{f��W^�@t�S�J�������8fjl�R1������䍁�P����5������81�{I�ut�d�l��� �b���G�I�3߁�E���5���#�d.�x�cǕc������#�y�1�A������gh�"����ݧѸ�Qƨ��a��5��2L��f��vHOf,��t����OD|A����P�rL<�N���M���C��i]Ρ�,0ɾ{�Ѐ3ӪQ�w�C�G,z��@��`�c�� ������n��e�as�2�m%Hx���������$1-��(\��*?��5�����`~85�1m�!����`� '��K�^�\W�S����������Y������@I�#Mؐnm�aY��~b��#��f��F�N)v�r�3 �KA$�N��h��"�:yTf���J m������E�;������z6J�n� �{}�7�a|X��(�`�)�v�!�������ƁT���[���_�9��j��9I'�o����t�V���G�֟�zٶ5z�H5�47���r��R&0oAN��=B�gi-J�A��nn��������&��{-k0��ۨ�2ʕx� ��g� [.ry��bJ f1IT������R�ws*h��\e�LŌ���=��8�L$G6n&NG��眗*���M���=A��N�q�Ґ���u���uAf��E�AU��M9!��cw9깒���v��,�K�T��-%J,[��wQ |�j�>ά���S�־#hݭ�38P|��9� �J�ʇ� ��^2�ޑ�TSI$-^ 䵃X�y>���a�A��xٲ���K:�ݯF��Ɂ�����c<��<l�g�@�*��4��5��N!��o����$}j�Jz�Yq����� ��3b=��į�7�=[sئ�V�[���i��nX1��H�D��i\��k~���AR�{�6me���P��ܞKI�v��~�PTX�`��{�J=r�(Y/}��sE_r��=O�T���#Yx�s��jO���C�q�Y[;�/���3��y�0`%#��/�:�XJ��W��c��~�&pK��5�������ꆢ��uN�,n�0q�NA)�N\��QP�<+۬�+k��C�.����J������+��|�qَl̫h�9iD����X�cI7)3yb�F*@��_&�� 1i��z����`�n��ao�S˗��5�4ޢ���#��8dLN~pe�˺�s�Y8�Qv�QB�z�� �g!�}�����ѓ�,N?���Qc�K�CN�k�jn�=��<�rX����M&�O�Y�#���lʉ0N�6St�|���Q G�S�u�<DXL-�Q&6�-����- j[j�t�4��H���i�lN �Y�'+�^�&�wq�^'\ԧ��'�+ްh�u>�Qw��P����������*�?�����|�S� jIV'���(� ���sP�[:Q�՟�m�y}�RU��5�]?�M�nl��'P���q�.^���P�&���U���K;�W��ȩ�%�����ՏCYOd�]|r���w�G��V ��� �>>y֬}�Կ�,���'�b�b��*�?�?�p}�@��܅d��r����o��~S[6ɾ��`Z<�n0g÷$B�_�A��mI�vb,3�xN̦Ύ�<Rݧ�ա��~���vH!d�ܘvO����=����z��wt�\ƿ��Fp���"���Q���ƊD�8p�fNM/�2��g#�u�6(DnI�8�ۑx[DJI�rBu��~:������u�v��f/�% ��=Nȑ9�蕊��5�MK�.���z5��de�{����^�4�#Pd�Q�W}�& �]��Ǹ�`��'���-=��oh̗��k�#�1͉��UwBԔ��?�r���EWo�P��P'$���S���1_�J���Dӓ��ٹ��WTӺ��*w�gGu����,8��o�l�м�ٗ��~t�� ;�;�k{;�$s��y�X<|�C&j͡*E�f����v-�����eI1R���Nv��Z�MY]�z՟�Z���Cw$L� X��08��ےs�c��C�8�V��y(��?�����I�(FY�օ��Kc������7!�i��i��'bF�z�kt���*��:Tr�a���^�r��bmeL �F�Q:�5���v�_]A3x�mH�yUJ�3��&R���5&]�<KԷX_���NN��M��$l�c f����PK�G>� ���=�/�xT2�O�yǎ�4A�Q �����ޛ]�~rK�5�9O�n�z�P���d���Q�xSXHg��@^P���V�"#����V�v�����(�L?ܥؠ����e�`���!C0֟.5'LP�s4�N�Ω�yx>N.���X��H��!Ioe���`f�+���ђOb]�<��W�� cҩ�i�#���s����.&������|o1�F�жI�O���~����-�g�=��҈b�g0�eݾ���d\O�5w0_��ZK0����j���w',^�$�Z�����|�䑱+}��.����Si�É���!��OI.�;���d�N-�U ���)�o*W��\�'a�A ˧�g_�:f��-Tⵏ��荸��4,�5Э𗑝ۼJ2�l��R�ۈ1m_p����|���Ȕ�������}��3�F,5I���|��y2�T˽�pD���s����L��"{Ⱦih����%FF�a���u���f�bpT,�B�������UnM��S��<TD���т� Ɲ&�i�,�"�'\�s=o k��{�i���!8���a�FD"VJ�Uo�GOe�ܔ����r
Static task
static1
Behavioral task
behavioral1
Sample
a2987383f337faf51a3ec119a7b7f7aa51ca11d4e8007d14bbf41d0f27ebed8c.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
a2987383f337faf51a3ec119a7b7f7aa51ca11d4e8007d14bbf41d0f27ebed8c.exe
Resource
win11-20240709-en
General
-
Target
a2987383f337faf51a3ec119a7b7f7aa51ca11d4e8007d14bbf41d0f27ebed8c
-
Size
3.1MB
-
MD5
d5f5b683a3cc5c05e5b2cd1204ca5517
-
SHA1
5c34ec18fbb2475c7155604efa558a7ee647edd5
-
SHA256
a2987383f337faf51a3ec119a7b7f7aa51ca11d4e8007d14bbf41d0f27ebed8c
-
SHA512
4dacb477c0ef76a7c4db39d6f70b2e2176b185b0a20e554598607c698247ab331e84adeddd53f0faa63eeae615f572c7023e1dd7e09dd7899f4b3dbb83f49732
-
SSDEEP
98304:g1hWkNmp1cv6c/i+OYsnQVzrmcojtFXLCyU:g1hWwmHcv6qiyDmcojrXL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a2987383f337faf51a3ec119a7b7f7aa51ca11d4e8007d14bbf41d0f27ebed8c
Files
-
a2987383f337faf51a3ec119a7b7f7aa51ca11d4e8007d14bbf41d0f27ebed8c.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE