h�2Q]�M��n��C13u�p� �(f�zu�P`��{�\IX��l��˲������,���|�A������m�zƿ��StZ��cD���5�`�\L�N�� ـ�l��p�����,o>�k\Y�8�o�oe��q�;� �����OL�M(>�8Q��h%G���JF����,�J'�ZI���Լ��E�ð��=�G�%p�}ʝNqxo2�n��{[*��T6ԺD��RW���_��^���A�w����n/((ڿj�>�{3��fm��JGm]"s�(�_6�3�8�>�mj�7붭0ߓ���0����`����6{*�ij��7�z�����q��h@�)T�TH�h�y8�ݪi<a��L�{��a~Z�,��Qg�=/�` ��x �l?���*�&��: �Io�m��$��{�.������b��=�$��o*i^���!��r���tr��B�%:&�k�d�̹I�F���:�b�O�_��*��OD���OI��a�2����Ir,5v!;qJr��tX&-�#�@��mR�)�ۭ(���s�yf�d���?�l��?�{X6㝂��`�������?�>/��i>F%�ե?�dfޘ�~Ya�}U/�Sس-�Ԟ� ��lƠ�U�&����a�<�M |�,��V�u�j�m����d+��="��Y�w&�����,�ay[�ϛ��E�5�`V�Dw����B^V4n.�P� D���� ��'=�h�p;O���ӌX�����x�P��7.4�)���Գ����*lh_p��v��ˈ�A�@�?�/'��ъ;���`�ܵ�d��S�L�ݫ��������c�1x��_�1 ����;Dhp�$7��d �7wz�~FS�b98GZ�������%��G�[��p���E��DS�o������ &a����n�FH�ir<�#��_���0��Rr&(��uA������x�o"=u�R<����z�?�lr ����&��Y��*�V�;��+@E-&�ns�#�y�+�:d�i���?���b�ID�)��Ob�߯��_�]�&W��q�c��:�)�#�1���c�������G>4�f�)��v���|��u���χ���Z��k]G�R_E�q;� ���ݢ�k��OTp�c�>G'::��p��E[m�Q��0�KYbn'>�x���<n��H���-i�6`���G4Z�w~wa˩h6!���h�aD�cE =>�$7&w�e��@�E�`=���gl�3� �7H�T��6G_<q��&�L<�S�<8G'J)6�>a�y'���r9U�Hc6�q�X�Z�ܠi˫xEr���:.�m<%��JL|�*.�E�F Ջ������yv�sW�I�v�q\ ��P����]�7��6^V���s�*U���uyZ����nY�Sh���\�,MV@2��r�_��ebZRM�:+���=�$��Q���g���""fG�zIl����{����\�DN9c:��ј�e^�3K���+bg�b�m��d���|��DC����"�sf��2e)K%5��krR����Ek�#�e����C4&:\:��#���4ƴ���+u�t�1h �k)1�d��{�gUl�`Q�R,75����E��Y��9��(� ��%s(�(����% a9ʇ^� s��H6�i姖���d����]6����_��������M{�=͎�&�Y�</f<J��.1w��\EֵC�:9�JO���w$����I�����D֢�}�Xj����p��gE�*��z ��^�v��?Mw�5^Md�: I�""L Yu��[�O*�j �id�0���w*E�dubl �N��1�ƠO1�O���[�����:1b�0�V��_Z�ٴ�@!~� g��� �����*�'W�+�>��m�{8!�d�Z4*�Ҏ�� ����=܇�ϜD�������L!&������HWK?A��,7�֙�e~f�[5��_��koQ!��z���<b 갬��^Q��r�P�U����i:������OF7�3Kr��R#)W�ˮ��;�`2�u��*K��y����< 2���`pciw��k�3�̺eŸ7B��6�a�1I����I� ��Ŷ[~8�8�9��5k�uva���n��,���u������e9B���������KJ������5����NX!E2P>��,#�ܲW��o8��e�ɢtb:`�;��{`��W�8E]����Ol5,����Zh�(��[,��B _��K�)i�b�n����(INS٥9�����X>,l�ӦL:��]���Ć�H7�����@��9x4��N�<����"c�����y�� q��� �u�l���E�r������}��N��܄e�WAF�mƇ� 黪� J=�v>Կ4���0�T�[���h�* ��< s;,���Q�\Tr&:Q;2y�C�1@��2J��.*8�I������S�+��f3e}�S��DDUݵ�Cz!�A��缙Ӷ���p `O>���&�T:L]O�D9�p"l.5 _X�k�r/� ���ϐ]��UPu 8�,�� ŏ��=N���R��+8 ����$<ID��5�rq߫K��w���Y���8���]*0� U>!����2��!��W�Z��Y/\��M��愔Wf�Ѽ������u�2]�<}���s#�`�Y@Y����\� ~��n�x�D�B�®~wR�ފ,� �wu&�Sხ�Ah=�[j0��f���W6���9��9���u���J��*N�_���$�����hޫ�=)�Hgo9����Ԑ52��U ��(��=�� _�\��R��g�y�p��?PJe_�D 39뵗>�&���T7���;�j�����WЩhE��3���6�D���֔�!�Սz=7���G�f�\E.)p#6_��V���D�_a`#����!��JM3��"<�Aߐ��~������Z���E&H;��[L-\��4-h���be�����E0��\��&��D�� _�YEߥK�����H-���G10:����È�q��������UdI��`9�+��6p2y�.G�M��x���ߋ��9*&� ��2�����$q�I{�`������7�� �ܽT�OO�%�na��cю�6���a���a�߮����9)["�;b�ck����Q�I<:�!����hn��ّ[\��|H��'��6&Ŭo��%��6��B���� F�u��:�U��Rn�]8�oJ��!F����7=�2�u�! j���A� w�D�4e���FU �LR�}۰z�%b���LP����D�M�����d ����6,8@f�I�B,��#ݕA/�
Static task
static1
Behavioral task
behavioral1
Sample
5353c49ea9165ecc52404556a1150eb9413ad072c6ce9ace7840be92465ee0ec.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
5353c49ea9165ecc52404556a1150eb9413ad072c6ce9ace7840be92465ee0ec.exe
Resource
win11-20240709-en
General
-
Target
5353c49ea9165ecc52404556a1150eb9413ad072c6ce9ace7840be92465ee0ec
-
Size
3.0MB
-
MD5
ed89562ecf478105fe0dab7eb6296170
-
SHA1
df643b7d906041d95acdb7fe344183e1f1722606
-
SHA256
5353c49ea9165ecc52404556a1150eb9413ad072c6ce9ace7840be92465ee0ec
-
SHA512
adcb2f11ae2913ad989950cc192121d6b44f19ef3e82e25f410cf4a04499ee10e458d1d50c02709f492e37f065c7a362a711196ba34888b8edcadaeebe51c963
-
SSDEEP
98304:8NqM6Na6zw5LBVjsP9pjCHDh61jVMfzlhcA3YLMvKsQ:8cMyB6lVjqWF61cJqCTKs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5353c49ea9165ecc52404556a1150eb9413ad072c6ce9ace7840be92465ee0ec
Files
-
5353c49ea9165ecc52404556a1150eb9413ad072c6ce9ace7840be92465ee0ec.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE