X�/��i-��|���A�OV�y%�;��:���0@R�����#�c�)�����n\&Y��3h��q��7�����pJ"��$���t.@ң��<xt�u�iH|���3u��Î�gq�P���K�xi�vJy%�8W~a��r*�G�՞;�VA�@{�~�7�tn9ښ�9&�n�u����D1�jz����h�_��^M��O���L��߈���̉ \< ���|[ 1%�l�$�_+�1�/�N�������0pQL�;�\��lF �٬RڤA6�͝o����+����j�s -�-����,d L���4?�����,����SW��C��m�����D��!���j�}�M���h8Ǥ���^�m4�'Xz�ݱ첇c���MN�;z���ow����B��4�N9l�n��HC�4lBQynP��WR�\R�oΩq�H�^H��?.�����7�b���ZSh��#�L���>�w�Y���"�GK��]|b\�q����ܟ�6��[��k��Op�����I�����oP��֭%".jXr*�T��YgX7������ⶅ5��(;��x�����',�ӆ�5&��N�ͩ;��b�k1T)4��/��\��,��n����Y^ q�,�&M��%�rJA4Fl�"��T %�Zl��=��1v�\=�q��2�ozCaڼd1N㛈z��}�w����{P����u�9rj����?:�A���y�Ce*���������z���3J��s]��\Hur��[�dRc���r`��)q#د�j�����1m�����ml#�0�]�����G�qEb3WA&���"��m��zȿ���:�� rzS��;����*(k Psg.dz����dV����a6��B������3^J�Q뻹�qt�\�=����%x�-�[���pL= �]�% �E(����R��@����㞌��I,� �2U&�TCr�̊���U�#�5���7�UR����S��w���X_l���������,�?� �R�tsU���\Jw;��� �u�x�E3xw��A�n��)�f��<#����D�ќWkc)Vcu[��-����:����4��yg* ���r�5 �z�[8t� \�?n��0���p�r�r����xf���7�θ�J�%�M:�jaL��D[PN� �� M�xq������?U���vU]x��Wi���0����%���X��M�*��d��_X.uL�8w�5�^��m��&=���M3u��D������ob��9���2����G�,�DU� 9���/���1:juѣ\-{|@����j�Tת-��+N �Lg���[��L��H����8�����*ܺ��}�M�Y�� <����}>�1�M �d2����� ��r,��fGHMF��� mNr~$��U��J*$�wD`��$����N��m(F�� }i��)���|�0O)Z����-f��X�vTz�ڸ�7�EgkL�핻�`��[Ԋ����!�1�$Oy�s��K��~���?zm�Z ��p� �La{���A5NC��!�����0V�t&�h� ������1�9G ';�&�'~<a�ߌ�2�a}9a�?y���w?��{��o>4�&�BG�$g#���w���ƚ�i~�y+�2�>�]��X[8�p�0bƴQ��#�Ѿ�ssG���ݾ[6T����_��".�Rd��\Z��*���Q�;�r���5�Dh=|��H�PL��hӼ�cƷ���S�b�_�z��Ra拸����D#m���?}���$�h7�{����E��[�FW��\<��d���q_}��Oc�������n�r"�l1���h[�R6���\�� �^S��oۋ [ĥ-0����ʚ�q$G��<��DJ����E]���]�ć��V|o�/,����1V����I[ݮ��؆45>���v9��y��'�E���v�Ȕ(C*BD�7�<�,��H]�+ `��?9ɮ\�_��$�w�sL09O?���Y��b�(0_�Qj�����B:��3��83,PNmO��u���3���� XL�-��ΰ��*�i�RLj�b��<>6�N(^إ��?pn� ȯ�fe2I��J�!D+d�B�ޖ���$/���N�3��i��p���[��S��a��'�,��f��Ƀ�yjB]�.�[���dE��c�^GK����t�<�ٌ�D��O�q}��jFg����oQ��AH�N�jq-A�f�Q.� e����O�v���C������93<N)m���K�-Nb����:}�9� ��ij Ef��������P�(�1�=XQ�k�m��h�P4���c�Y�X�;�z���DM�c����L|���0Pȩ$wf.�m�ֵ�hh!� tr��!����*1UI��'CO~�d����\�*�B�C*��l������fԱ�K���Džd �?�+�u�<Xb����m�~�6�����=�%-=����L^P�J�����������C:�Z���V������:��I�ʁj��c���`�܉����8�����Xi��Cf^��������4����ْ�J����˔Ӫ�b^�ho`nF`A�����^2�6"�,��ҳ¶�HN��=5��coH������19�U�$��5������ʬ:��d����Ih�V"�e��-��e�3h6��5�PJ����B����z��s*��F���m�ո)ў:O7�@#�O�%mX��p�jFF��{Q��mErr��[PӀ���.��wM���6�[�C�B��%�l���ل4I͜�z�q]�|c��{�v���I���W�#(궯!��F����d�'8�&���i��'��\�iP�'��I|�����4��!F"(�~磟��A�O����� �+��h'�t�5i)t�:�Z��K,����Da?���V���S Na��}���^*i zyX�u��r *�$*2�f����m�Xټ���ɬ�!������S�$�d1q�h��hdC�h�,ޔ��:p��WM��Z`�N�f��)��'&ֵ�"l��f<��x�5VJ�N��e�,�D�D<r�s��� 5��^����aIqّ���ʂ�xlq�����2^Μ����eVw3X�+�j�V�D-R/h� V�#sb��1�dzEϲ��A ͇߭�G�L���oZ ���OU�\���
Static task
static1
Behavioral task
behavioral1
Sample
c8478163cd9fc95f98882a9b98b440e1b314a2af53c754ebba2f7d9a610e3457.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
c8478163cd9fc95f98882a9b98b440e1b314a2af53c754ebba2f7d9a610e3457.exe
Resource
win11-20240709-en
General
-
Target
c8478163cd9fc95f98882a9b98b440e1b314a2af53c754ebba2f7d9a610e3457
-
Size
3.0MB
-
MD5
006edb4eaf262cf21155cf7ed1b80cc6
-
SHA1
7d947ebc6ced151fa69681cc10b7796700403082
-
SHA256
c8478163cd9fc95f98882a9b98b440e1b314a2af53c754ebba2f7d9a610e3457
-
SHA512
1b555f6cf3577efdccde61557a239d0c975c25a7a854010bff26ce184369962959766916cde4b304d3df12d9b99b3130fb24d1ad9df5ad0cb5bb3aa953d1eac1
-
SSDEEP
98304:gISPGifGA7dSknribIi+npnscGHevmyinIk:IPGaGApSkrkElzMevmyiv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c8478163cd9fc95f98882a9b98b440e1b314a2af53c754ebba2f7d9a610e3457
Files
-
c8478163cd9fc95f98882a9b98b440e1b314a2af53c754ebba2f7d9a610e3457.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE