�ڏ[�I����l9���,�#h��O�����)e���ʍV� ���.q���9_V��ɯ���q��xvـ%��t��d���(g�;���R^�2c�* f��y���8���h�nZAŮQQ�{ATrOiX���m��15;!���s`� �ٛ[���M˰ɀgW4��~������m���$�b�T��!_6�:ݜ�+ɟ�M����3�Cv��E>E���ᷖ��vXŁ�� >R��W_����Z�y�R���+?Ƙj@��G���D���jPw���0�9k0����E�jt3��Ǎm�� ��v��X�l,����m_۩�܅��vC��&��G��u��tX_�����3�����>*�*N���̼ Bk�����{| �mc���X��`2�k��K�7�r��u��G�U��� w��q�L���4v�� �jUŧ&�Rzb�Vy�A����n�կi�"0�����.��\a�0[G�"��4d�v�y|����y�I��b��y�Ԋi�jȩ��s�:+,�� �������*����{)�Q�w ���M{�n��ޢ0����JQ4�l�����7����0Lq���= v+t(��L ���t;Yd<���q儦c�y�Y"�%[T���xn��.ע(�h���T��/� u������\�y�6`�����4��c�C�\�@.�y�I�_���y}������Ln���S�6��w��G��x��!�4�ӫ^jM�,�~_H�7>(��8#��e�wtL����Z���� �mPϸ�{NF�?f��ܫ��<��W�b�`͢0h" 鈃 3�ر�TJ�䡾C��6N�=��$��Ղ @'(]�J {�b�6�O?��5���Z���v`�8N��C14�3=s��o�X04�ƽ�=9|s���[*�5��2;�w }٬��Y"�����D�0f��h���S�t�~�����K�py�����}`#��u)hp�����Jr#|�m%Q���,2>(������� `�5��͊w5T��'��)JxB/�D�^�Ξ�(��~�%���jD?�h�i�G��dF�*Y.C|{B?�֕�3u�G�o�k-V�m���1�w��f�[�~2�4����� �ues���b�U�%K�i�tR��ܣ�;s��8��⸣�v�jW�s�4/p��r%�t�/� ��~�Ր�0ao�D���D�˖�w� }7}ٌWq��X�CZ��/��g['��`���F3_���dž͗�b��:�ϙ#-�vbhz�O����B��Յ&Y�q���m��Z�P�\�HT(���S� ��x�h��V��0-��)4�����G�3β���/����]�B���N�Y,�"������%tm�e�G��[d.td{�)��<�.�#,�����#�6�_\�;AX��C܆T�u�|�Q��x9J��LIh���$��Z������f�YY��z��u�,�S�r�<�w=���0u���������r���(>�Mdn�CĤ?_��#lٗ�x��`�m1���-��w�=ϑ�pa�hQ�6"�=��wu��D��O���S�7�Kc��K����Q#T�=���y�}S�j�eDA^ 4n����ݶW�P`E�{&x���Ⱥ����we>���6�%5a\��t-�W�cU�a{Pp��^�d�Y��7�x������O-���)#�v�\S=x�/�i�%r��k����1�ṭ ����:؆Kwo& ��R]�z��"J��i�J5T��,�x�9-?⫆y9:,�m�O���/���B��=$ar*��o#���'���g��b�9b���ִ��݄շ��H_����� ��zb�\P$6�[���76=��p� }_ՠ�!Ҙ�b�gҁ���[ʏ� ��KC�o�0�7�E�t��AT�/�>����j�qO��_~�~Ɔfd�`�� ��b2���� �U��@��y��>] ^���yߎ�Y���[���V^A���G0z��a�1�@���Qw�'�oZ+������.ք�j�s��- �G����!������}����l �|��5;(%��H�h�LA�6�� �)V!��(n$4��KW�v �;���N%RQ�_���s{^�Z��A�nϔD`7��#{y�� �9E;R6���1�w�Ԕ�97����r�ԓFh�f������J�võ��6$SY����+���|�w��,�����H��@S�7����=����}�S�Q]�7o:J�j�m�&���3����c]���'��q����?z�f4I���F�kI���l��p�1+�Q�������h��=�"ʹ��M�G &0�5�z�$��4�C�4�n�m�>��"���0�ml'��~����������1�-�����@���\�?��&�[�f�T�����}2���~=~�ȯ��Mǃ������I����*��Ӻ0R���T��U-=\�koBQX�s �ozj����r��^6H���Q]�Dr��Z���;�X�:��|f 2�X�Y"6[ys�R���xȂ�'s )���UrC�\�Q7�+l�������+MH[�����.���1`~�"�0"dμN[��t+���ê��"� <QІ�\���L�����|��b͈��ªR1�9��$v��,��ݷ�a�2RgYx�Ʒ"��8x�|�;0��X%��\s�z?͡���c��i������.#$ݑ~�R���w��E�Ues���v��e��+��l���-��G,ᯂnLv0b�|���w��;��u��>��.]=�mj[e�8�.3��f���zz��Փ��c7.8�ʜOГ�ѻ�=�έ�~rU�"H_���2ɕUצּ(����z�&�'��-z�N���K���l�4 3�I�%ɻB��?ټ�a�e>(旦�\�� �ǵϢs�!ߵ�ͯ���Yy��*?�i�rڹ<�������8�@�O�y)d,���z'#B�<�yӝ��jĒ7��A��,Y�q��^3��H;ny�-y!8ն�"�����O�'�5�Aem��/0�ڝ�;``�U_f�f��;�/�Yvj����A�,�?=%խ��[5M� 茁ȫO�*���9XQ��_*%o��&~E8��Y�����Å�Rxk\��d�O'�������;�(�FΨћ�<=��,q���z��y~-H,(�`�b3~1k��� �u���[��}�n���E�*B��{A}a������5*=|�K�U���I�#� Aۨ�* ��e���xZUe���n�r*HJ�.�H���mY�b0Z?�G7����ЛW5���I���j`Q:�EIF���9C�T?��ՐtȄoM���wKfܳվ"��^<�N��sH�S��4����&�����.�Y�&F/#e-8�-�[+��)T#��[�e\����r��A7��uu���M���� �_��ٟ4L��'?�9�iy�@l�G\�����ƿ�ᷔ�������'���Xfro�"�.�4��\�J����WM����v��&{����Y+yKRdW/.M��5�j&�����8B=䝘�z�UP�ˌ���L { l�|�8��Q0q"�*L���_���4�&)5l�*����,c���ړ����{�QU�Ѵ���J�afkgsՕ��xQS���C¯+�˷�����D��&�AR�j�Wtz9Ywd+y���,��T-�X`�(g}�>f� 0�ew�Ö�|&����Z���m
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
General
-
Target
file.exe
-
Size
3.1MB
-
MD5
b078d31fc894b91a32e1c40c596fe1ec
-
SHA1
ed490245f51c3b2fad83e2eb22ad48d5260a8ad8
-
SHA256
3188153b52c7148bf97d29e8d0447b1d50ddbde7d0ac56005e2b758dab432030
-
SHA512
a9977635a3fc7484b649b2c4a0bbc7bddfec2cbfaa9c3f70ceb88cb1328fd5b837fd4a312ce21493dfe1b8914e5af60526ad3f17d60961dce84977351971d1bc
-
SSDEEP
49152:d69dZEfDc80QxDi9jKiYTSq8tC9qpYwueEMQNFQ2zPqd0f0l6Fo8JCKk:mdZeZDi9Gi3Yq+WyNFBzPqi8lAzCKk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file.exe
Files
-
file.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE