ݩnf;����2�r�ůg�7�{Nyp���z�\{�֓�^;,<�K�\,?�%,���n�B�[�gyV7��\�M%�Q�j�(mZ����n+�E�cX����)�&�:����<X�K�[�ҋ��H� �Enj��`�X�`i���y�.�:w���x�!E���{��8����G��R��K�l��&�>\���;�0�Zg6���x�BI��ӕ����R�٘o^ҝh9`�;*!�Y7�x� $�)2&і���i��ZN a٪?&[��QT�q�Dy��[�{�I�ψZ*c�������w�v�������i ۜ]ӺFg(�'�:�ш���R�2�� ����0˒��%� l�5����)$� ��E@ �xJ�'�Aˡ(�j̑x�7MХ�1z�و���u�hJ�0|�ݐ��7'�1���>�FV�.��U�A,@���DRX���H�UV�F�I��Y�XO�G����G��G�E�p��5�ǥ � ��x7>�%��Um+v��b�!�����:n�Qd,Zƙk/ ӱl��@�d�{e�>K<<M��xEQd�5�7Am��L���_w��T�k1�[[�ދw��8�[��� �����*����`Gۿ�:SȆB��ǭWD����.���,�}M{<T9fLu%�����F�z��y���ʭ�:�;.�q��V�*���?_&��^��'7IR�ݩ�t�~����$���V,���N''Q{K�6�����'i(�Q("�el���u�� � >͍�W������,�ܫ�'����i��96u��ݞ>y�-�%;�iy�kchh��kW��|E�q@�iX�2q�� ����Ŏ���.5r4����|����m�B90;���m������M�DCx d ����^���^U�T��?�S`s}��.7|�A�� �4Au���#Ǻ4wE�·ӧ��weR^�W3����^�������_;l����*�{l���D]�5���5��k��O�w��GA�8�f��PP�yɸ o��"e� }<!���I�V�E���dc��ҤEp�aDr�T�+�fk~��@�:� #� ���-D.��b���"{s�Ub.q��~�����,rk \>W� ��q��*�Ua�n���1��љ�d;�����9���qq�|�j6c沍�f(������(�g�r):�<�^��A�R�|�I�hGW�~8��3`|�3����6�ӎP� {��v�,b�r!�>�G��4�{�����|�FE���f 7��{�C�j�)8���GX����g#�(]�k����N��}8�`��J�>�zO�� ����E^b"q�k�ȩ��"�>�3v����i�� ���0 ����be���%_���A�%�/�;��S��k)��'K�W6��Y��{}ll�h�[��V��6F)�CY��:��F��)&u��̮{�)��K�v�g��$?���[ �_^�%)W�����5���G��/{w6}h~?�;��QF"Zt�$%��ڛ�=�S!��WZ�`KX.�=�]1.�Tpw����e_�K{P[~'������,�e��N����đ��q�#�G��"����tx7��!I�iJ<j<$8dD�aGS3M c%��I !�ш�{1�����Jڣ��1�'3N��iy8���U�K��)!��5��;�h��@�N�I��3�<�Vװ:��Ĕ�7�}1�Ǹ����F��%���]Zi�����J�[��W��e?����_i�a���kꚭC.˩�̂�歄�ե�Cp��c�^�:��iڔ���*l����k���n����`I�yN�������F���}��ǜ��:Zv�8b&!�犥�}����r�AB8h�Np�t 6��c�zܚ���o� 59���������P�#�B�����s咤F.�Z�`�$�F���tzFy�L9> ��rbʣ�#<�J�, ����������*HH�z�� �Kw\�����Y�؍_زj=��m;NN�r`��}�����ħz��^]ޙ�^6��k���-�?���Q,���^��^�ū}������LR@N�GY[��V�R�>RX��), ~ Z�3߆ p���)hr$ul�{�w��K�bp���S�/��۴����ߘ��T���-S2�|��M+&�N��k5DmJ�9%�_3��`��x%�N½�Ôi� $��(A��\�N-� �C$\��|p�V�� +�R¿��v0f��I���3��Ű� �� 8靾��[��!Q�{v(�FBP��̬�u����_G�h�¨�U��}; a�,�/Ut���_Sk�/Ł� �zF<#�����c��K)�L4մnP�2}܄��n�����%P���Y( �^�6��ێ�dw�y� �D��,w'?ڐ0�Z���Ir;~��ʏwFwҜ��\F��kj)�B�.�Nj�J�>�"���.S� *Ӆ�Fv�ru�g�� \�X��g�M��M+)�9T�{4���}����<�$�*Z�~��(q��FYA����s{D�X �D����%r)�����tyW���ޭ{w�{s�O9��;{l�.ш����X}�����"7�UW��ʄBol�����h�� �\��%���l�~f~�fʳ[>$A����&�����1�T��y�.����(�1��>�ڝjAv�̭�M�Q3�����ö��l�]ϥ��#gf�����u9��W^2�|tB����r�6?�T���A��� �����zN�ݞoގs}�) ��?�G&�(����ѯu�)���ķ��bh��ɿ��ڍC�:��~�n��(�KvD쎐,����m�O���z3�����Y{�����;����AG�ܩK�!���A��֛�����7;�� �ͅ��ݍh(@�9�@2��m�bt�{x�� F&�ҿ�!��Օ� �����5�����9�7�� ��,)��P]�;\@�rp����b�si ���y����q2�lGT�[�>�U']�C����]�D%e������j�`=�G�.yB0���P���U�s-��n\�C�X��0�S#�D�Z����d��If��W|�Cy+"Ν�Z�&�>�7'&���0����6�bv!���tjd���XLoY���Z��C��g�-_�;N��4��'Ӈ���m�D�7��S���URc2?��5�:QRϧ�K</k�a��"��Ǖ)��k�c�E���6���l����NM��o�V��f�=�8��key܃,�8݈�4���wK8D!|��J ���w��N �1$��~}�I�zi�g��=�����f���$n��7�g��e��\�M1��vt�I�S�hzϋ'�2b1Qˈ�>�M���p�,�6M8�����/��l��y����Ů�`/�bN����N�Z��P<%4�YW$ln5�e��̬�-}���z��q��t9����m�A�6�]~6���C.�7�(��� ����6'hO�Xs��:�
Static task
static1
Behavioral task
behavioral1
Sample
60285015f8b5e32f20411d30b7c64d8748827409275f5a42053b307bc2ff17de.exe
Resource
win7-20240705-en
General
-
Target
60285015f8b5e32f20411d30b7c64d8748827409275f5a42053b307bc2ff17de.exe
-
Size
3.0MB
-
MD5
ee50f2db274c7abdbae3713a14020c24
-
SHA1
312af659d98d04b23c6ab5f5324604fd04a96777
-
SHA256
60285015f8b5e32f20411d30b7c64d8748827409275f5a42053b307bc2ff17de
-
SHA512
bbacd094942f9493d58367d19bf5573331d40c7cd96a2b0d4a787de215e9c3c509c1f2f168b2e632c55686b41ae72713abbe9214c04c889f8d3f18ecda9b6b11
-
SSDEEP
49152:27lf5RZ4Q9FDCjZtjBJBMndpCqYiCZG5uvmmAwYU9fF4nbGs/cSqyVU5jX:27lf5RWxfaHCqhCZ3dAwY+fFGqnX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 60285015f8b5e32f20411d30b7c64d8748827409275f5a42053b307bc2ff17de.exe
Files
-
60285015f8b5e32f20411d30b7c64d8748827409275f5a42053b307bc2ff17de.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pL~�u� Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE