4X+�x�/�%Q �F�S}���&tqZ��¡���E�w���f���x��M��aRf}��٦T;w�܌Uz�F���� {W�xy?�8.q��-¸�2BC��1N�q�Jx8� -kK���+p���,xC/&�r_�����C��� OKdl�lG�R�M]�j�DJ�Q�"������Q�a�8�s����1�F��H�YG����<yF�#T�,,�D�8� ���r�!o5�UM%���H"��u�jxx���G�H�R{�e�������5���)?��j�MR�HN-<s��{PDZ�/c�@>���h��c�����r��]������}#]iP����Bޕ�0��i\F��o��-�zY��2Ћ�� ��셻�~��c��MrZz���3�'�>k��ф�s�B+J�Emڇ�I�TL� ��4KIu���b]��>��^�q�sr�Ӥ�\Jd�e�P��a��r��m6��������]y��f���S�yShP���Z1uy�6�ԍ H��˘f�_t������:�Ys���6Td�Ӈ���6-�����Ά#R�����A��l����=0��Ώ�-8p��E��CD/ i�AŹfκ�^�b���������zM� 35�y�,��d ��˫C�1B���Pd���j��U�c�Bs�tpѻ_��vaC0�� �f�hԿ�.凑�>?�`��+YFo3���D ��Jyx���C}i������G v2b�M���G����]�I}H:��\�\32齗���4�+�����3�x4Mܝm��|7��-��D��aMܤ;*��_[k,x���4������x�\fK��Lƹ���a�����E�����;�?h��/(��{F�9�y;�_����i+L����?�>�+���ڋxl����Y��S�ӝ���W$����/��KOJ ��?g��@_���\U0s�t�X���}}���;��f ۅo,�^�uexY��8w(Q�Ө�ft�8>�Ԣ3K�X�������2���6�BT6#��=Z�b���1��3����}�ԟ���r�|m"�)Eҭ�N�J-�<$�������St���PS� =�ŋ3!|��:y&䁑����.�g����%'m��!h�X��ݧ�CT2%%��(V�W�V����2 amb����c�����F9m+/�������o:\�jPe~6³E��jb��?������i�����p:�"�(k �֥�\>��<��q�����lgV�3��'?�-��T5��Q�Y����ZBc�מ��ZɿbGY?�2Q�*q����8fm����5<�� Lv4��,�������e&�Ť�=���9SR�LJ8ë|'_�N|� �|*Y�T��,�Z�U�r�b4�������4/��#�^�@�5���F�آ�Z�*�r˩J���˶���p��0T�& !!J'������"�d�[A�m!?�8�A����j��ʑe�CZ�4v(AZ�D\G^g��x�AA����Z-�i�BY��V ��^��,�WY�E]g��H4�0~��v�Fy3��Q�M�C�B���A7�ڂ��r[-O ���u�F`�HwI��Ԝ����~y�C���e7Xj�|��߾4�U jf$6����jL]��9UWk���Õ�|oA\��yf[~�ƫ���gPM���]��]��|��+�GO�t3�z��Fe�f����`�C��x_N��Ye�^ ��f��ncs�U:_\��0SI�\3�m�����$Q���[���d�t�g����� Dd����G�y��8Q�D�Q���3GAA ��߀�<�����RФ3.� w�e��&:�8����Nd*���k�����0{K_�u�9$�d_&l)[�{�Q]p������HC�h�2x�?b��i��2�:����f|�+;�u!�� �1J8j1��~ܓ_"=�O`!�`�G4<D}��� ��3Y���`:%��뵂Fn#YNJU�/�냺�v@42+�ɴL��J���������{1��mB����\K���� �5I����u��LW�)a����/���/T�2���y��Y�����D��E[l/�T=���r�������9I�{�c�o��,�Z��4Ċ����,�0tQ���/�wadZ3�]��1�d���fH�.�=����'k�j�ɳ��!����}������;��r�-U{t�����n�σ;��^�>tS���r}l6���K�����;�Rbip̭���L�����{%��U�tHN���>���zf�)c�d��`u���9�/�F@n�GK]-�pc▴F�o�1;�*����7�\q�Di�ubh�F����$�y��η��Rԥ�*���b?�rf�:Ug\/�12��)1o�����۔��`b����,w��sf�:�����M�( �!�Ӵ]�� �˰��f�������YO@�)Rq�0}���Җ�?�fr%�DpVc�D�ԑ������\�*�� `�U�,�7��37�#��8��y�8j@����܁�����NI��0(�O[�am��QƬ_%�{�Ad�;�(��mixt=ư�Mdk<T� �+Q�l �=R�[�����Xe����������@��^����dO6;:�h/��J)�I,�N��)���Z�C#�ųY�|=��)����-�nbг�0�<��i��q��غF��Z�Is3G�+�Y���v�o��������m�U?^�G�v���2ئaZ6�1J�=����;O���b\c�"�s�ʌ�ԍ��w$�r��~$i�H羺��/{p#m|P��)���[s "ND�U�[נm�Σ@f6����Y^�3���C2s�<���`���W0^ä@(�<݃^�ba9n��H�E'|��5�{,>����<Ml�Rz0u!�c��C�D����2Q����cإ+^wba8��)�P�U�&U�q2���q�~�ZD�~٦0��ژ���Yn��������݊�>�Qdm��.f�i�5��Bf1m^�ބn�.�����J��u4���/���^4U�sd]\ ɥn��j��4�oՉ�r���ð�l�#�������5t~���feoY14����F�q� �o�-L���"�XR~���9�흗��/��框�8ù�^ň?�nZ���܇���g�Q�zs5��e�����5ly�@�ޜ�_�9��9^�4wdW�7c6H��NY&�!6Z�7�%��-����ǁ����S���j#��G �5�7.7M��g�GH��R*���7�ZC��W�ro�=��v�(����|3y�p�N�[��_J�1~�+�W�p��+:�f�����R��[j��V퀈��z&�"���i���.{f������ +GM���(w'v��;�\�-zb�]�0��v;����Ec�^��J��O<8�.c� ��'�����"ˈ�#��o�3�~�T�����I�?�)��a�$�#pLǽ& �i�GH���8�@X�&�mf�s�%<��"�iN��$�֠���lQ�0�P5����`�!���w\#
Static task
static1
Behavioral task
behavioral1
Sample
2ff7c68bf8a6fb54dd1b703b9850c8bc76cbeb1be92eb490ecc43f40d65badb1.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
2ff7c68bf8a6fb54dd1b703b9850c8bc76cbeb1be92eb490ecc43f40d65badb1.exe
Resource
win11-20240709-en
General
-
Target
2ff7c68bf8a6fb54dd1b703b9850c8bc76cbeb1be92eb490ecc43f40d65badb1
-
Size
3.1MB
-
MD5
c8ece34d0628f8917bb352ce51cb3a01
-
SHA1
0603448ae5dd3eed1f50a7fe04e6c0332bb64db9
-
SHA256
2ff7c68bf8a6fb54dd1b703b9850c8bc76cbeb1be92eb490ecc43f40d65badb1
-
SHA512
b5de2b93df07aa6f5c046708500398b23b90dc1cc44f74c3ade6773eb2b1a9427b9f4c376c4f51408b61e07d459c73685f42949bd6f21f56c80ce461543f0c84
-
SSDEEP
98304:+8lyIC6Ht6kdRzcTlrnVkcv04HPePk3Or:+8IFSDRQnuuGPker
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ff7c68bf8a6fb54dd1b703b9850c8bc76cbeb1be92eb490ecc43f40d65badb1
Files
-
2ff7c68bf8a6fb54dd1b703b9850c8bc76cbeb1be92eb490ecc43f40d65badb1.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE