� ��~y@ F�=N�������+�5�[=Dp���_��`b�~Ja_�֜�ɲe��@]��[x}��"�נ'8�1��t���l�r#IJ|ۍ5�f�p��8�K��lA_��L�\oS���k�Ԫ��,cK�w��J�]5�ܜf����xE�(z/���"./ �Ƀ�1>1�M�b��m^p�0�}[F�����V��\Dle�x��ײ�x6 "�O5)�1�v7�N�w'��L鉚.�8F��],;��QG�~Sv� ������p*hPH�z�`�����$���d��O v����P���R��ɖ:0>�0`�g±w�U"����� �uF�l��c^�2,�c;Q�c��W���7��������$������k���?����t7���R'C�+�!,>?�[o�Њ��xK ��kICg�y������MDIR��B����r��p��/�c��;���xX�����"�W9�Km||��Nw���l� �Xv����Jcl�p�(~)�#��Ǵ�ͪp�:�mi\t�ʾ���}gF�v����f�vN�̫k�t�S�yo�6�Anu}}���1�$�/Pg)���[���ҙO�s�~e�|?L'fr��窄`�pۮ�ٲ%{(���3��loXi8֤ ^�b}Z#ZR��g��a[@7�#�˴�WF� Q��U� c�f�L��F���z+l��W2�'��}��Y��$�<��3��Z�?��WzN�mh-t�X��h�Pz fYF��� ��3��)��_۲tX�uT�u�(�"�<UI{��ݍ���k(H�0��U���y[0�0EU�/���܆=43!�����Lw���E�M�7D))'ޖ�2�ux��3��U���9��yM2-_����+!La~\ѩ-��Ø�0 �'T8��5�:r�Q�!}&�;��khC�����E��W���˻Ǥ��P����ˠz�R=k G!�}!��u��e�o��h}�z2�^`w���Ԟ�%���2�`� t�t}2�YjY9:�CjM!i�$3�w�{7���P���(�cS(��%����g� Q�͓�Fii�ܻ}�7m�]���,x�����p��P�u ���!����;�]3��Ħ�ifQO�,N�{��.�V9U��5��������a-����2 <���uqɴ��Y��dZ`�'q��Wr��|`2L�7�'cy�*���1zL�ছ"�_uk�AR#> ����t^����S��S�,��63�p\�*a��Ǵɢ�$��^�p=��Ȩdɣi���-�i�!h,\�i����^�I2�'I�n#�1VX�i�7�uׄ�R~�CvV���.�$����Go�O�O���8vll���H�\ ��t����+ȿ�Y�|��g�n�3Ƨ��Dƙ$ٽP2��dr#t�*�����V��z�ި&4�$�r �M�o�hz��cL�|1C�[J��fҘ���m_�~ ��4�"�S<AѮ48[�� �Ed.cx���ݧ��H�_��Ê� l ����E-�dV��T� �|M�9W��f�?5�<�@+)v{�yfY����'�:��jV혇2H�a�Dv�&��x0apִM���$��V�����Q��5�s��g�ն�`�g�&ڃp��^hv8t�]B���ӓ��ybE��-g�H�����O�K����2��N]��<�J�����YeZ� �e��/X�Y'��H�=��1 �Z蔦f.1�A��6ݞ���3i`�%�ς�h? �.6�)R���� `�(�BY��<��J��/�C�b^g�y{�����N`A4��z�~��h�j9Ljg�0(�����S��M�\�K���q���S}�@���=}(23MYo�ӜrQ����D�F� O)����b�d�CL�������R7������X�6cN �m��!.l:T;|ļ]!��nv��E��څq�����J\El�d�.�Z%}��>�����9��{����)����ڶ�����w�E-�������5�d�� n�f�a�a��XIF�D8���ܳH{�yX��r\B���Q"Ve?v�'�l��-�4hX�8��vYX|Z.�AP�����$W�n}1��l�`��m2h�Q����P��B�2��{���㓛����H$���&e4z� [3Mv;X�m��4�/���n�]x���A_��9&'������Ǥ���= +s���^���ᡸ[[#c�b��$5��4+p�����C8�59����hw:��O!��1*q�;A��-J"AM���lN�w�-��l�|s�:�AUõo� C.DL]9��t"�a+w�)�ػ�k{rt|�n�~�TO}%��4�_ޫ!C��$'�[�� �ք �hLP��n�'���Op~"��7�GӴ��e����5�E�dw�������=U�H�91'v�K�_@�u���%l2��Pi�x���q\�N"�mZL���_�H�ZI�r � F���L��� �J���.�����S�27��� ��ۀ���9L+*֦��uS�EXOi��ФP��H�f��C��b%�spJ_���N��3uC;C�[���Ȉ�@!�{���,�3�h�u�9]HS���, '���ڈ�En�~w}�ޛEqr�Nq��A�P7W�~��k˱�-�f��9�A B��I5�?����0��mC�:��T>�&L[���<@H��ε?F��F%y��[�xb.��.�پ��@� �@�h������Mx^�����ƺi��&]E��~�����Ã�5'D��e�/.���[�#��5FG�c]/�eSG����4 ��E��r�d�̠Zv-�f����qBdF��~�\��CY,"� ��ԥZ_�)?]א�� �4^��T�m.^,�C��q?V����ά�:1|��U��a¨��r���t�YɥW2�����1�����0xu�"��ȶ�� �Ù���Ry3�'�T�a����W�3�~LE�q��D3�%�j�Y�9�mkY�V�zM�F�=YǞe���F9|�����>M�z�5�4�.��g� y��0�ۿl�r��2�Z��B�6�M !�*qЄ;��0����$�k��Q�#1ˇ H]�a�Z�p���<����
Static task
static1
Behavioral task
behavioral1
Sample
c1eee95c5445b41dc3d6e108f75de7392dd2cfa62018a4803fffac91fc8c7513.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
c1eee95c5445b41dc3d6e108f75de7392dd2cfa62018a4803fffac91fc8c7513.exe
Resource
win11-20240709-en
General
-
Target
c1eee95c5445b41dc3d6e108f75de7392dd2cfa62018a4803fffac91fc8c7513
-
Size
3.1MB
-
MD5
36b342f94a766072edbf0841d4923e2e
-
SHA1
3c9b321a6ffe759e30b4ebeb06782eb2bdd49679
-
SHA256
c1eee95c5445b41dc3d6e108f75de7392dd2cfa62018a4803fffac91fc8c7513
-
SHA512
5b4192a5a9b19b77c0952d44ea94ffa4d29521f09b4524aef9d76fd1d222c40d6f0fddf0cdfba6b90627995e3d2acd6bf98792a2d2e3fc849de577bb479e7ab6
-
SSDEEP
49152:MaqyiCbMVcnQxLt3y3q8dn8fOf3ASjzpR++k2tzPADAn16Lor/BvUHppk+CXYd:MamCbQJL868KfOHX++kmMcrJvUzJ7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c1eee95c5445b41dc3d6e108f75de7392dd2cfa62018a4803fffac91fc8c7513
Files
-
c1eee95c5445b41dc3d6e108f75de7392dd2cfa62018a4803fffac91fc8c7513.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE