�ZV%�o��0N՟@^iV^jr����%�)"�LY"�����q Ch'�E+tv��ֱ�"a[V��f#�b�0� m��Oc��L�` �����O�P��_�>2��9{Wq,��"���̯��4�rtR���L�?�A� �=�L�h`!�� �����#f���ĶؼMѲ��g^�x5PX��=��l�4�Y<Z�k7z���%��#)��$a�(�<}��9 M���"|zǶ�ڕ��;M�ʐ�<�dఘ*���_S��l6�1c��w-;���biȯ��$�������W[�H�";�X+���q�JNJ8������ffU�!ڃ94�O��'@iW]�>z�v���+�J�������7L�:2�̜�|�ʎ��e}�LLR6iP��͠�f~������U2O!���LpI���)��7Y蕙f;y��\L�W4���E�>���r��5 ��[o����.'e����tũ�B;�@P�NQHò.ԯ�nQGo�E'���?��Γ��O��;<�fS2[��__oBF�2G�W���������\�����n�Ǚ���uE�e���Q�M����6�b�䯇%���hA $��sJ}� p�*>x'����L^���j�y���' �0���6\N%?�d�T�Jc���|�+Gv[��ee�.��=���z�`K�ր��2�'XȺ�/�g�e�S�!�t���@vE%i�Cp�`�\���=�TA����Rв"� BX����a�>��G�p��y�^��O����b��%Q2Z��w␁9�Տ��4^(�1�I ���|Y�E�c��RW�s�i��HO/ ��>���A ���+a,�XW������ȯ���1���@Rq���ݼ>�|����@�c��Cx橃�vZ6����uK�ŧ�����j�U�]u��'�f ���<�T?IӜ���v�LWlW8�����9+�_H�><L 0��4Y�0�V��X��G���x�q ��;�i��L=��̾r���%�CVYj}�}���$�h�r�����Y��x����������M�l���P4̋� |g�.I�v��Z1�'J,�ke��H�Ow�!�lf<ŀ�-H���c�OR��wͫ�':/e4i�����&���e�h9��3��%9�H`��䟻��X�<s�Ҳ*��b�l\�Ϥg�N�}A:ʾ�y2���6s��k*����oDŽ�H�,��D��'�d�57u�[(��c ��U�� �D�=Uxp�"u�k��nAk� �c"����W��~����ĠvA��v�v�Ǯ��y��Vm3`��w���~�|�Hic���n�D�(&%x/N��Yd��:)JI^QЋ�MI��.#��mk� �;�b��Um]�A���~��}�3�dR�'��}�Lt��p8�C?�!���Q�+Ҟ"3�^'۽I��Nߖ{�mJv��9��7��P���b�~ȩ.�r��i��V��a��̌2:�}���k�[��sm41��V�B �k�n�R����a��N-�ܭW㎺�#3�x����*��_��q]��d�M�M!���[/}����D&�oni�LnRV`�v�!�C.���>u��p�ftP��E�#�l6��Э#-���?�S���n��߿���>pj���0�];��`��s�L��m�%(��þ}��pMV��Y.v��NI�<y>�i_�`8߶m�2�vS�x1�9��+q�u�d�H��?2I���i5X������ �ۃ��R ��YDЮ��1�7���8%H�HMMp�vd0 ��x{"+�k$��ni�i�NW꩔9�۩F�w��EiÙ��B%�-���OA����(��XX�q�82`}%��~<"��/�c��mQ�fK�R���m8Y���`��w�h�ۘU(���Q��D�Q���?��k�Y>� �ty=����a���UZ�j����N�Id+��D��m�pw�A�;��Մ�:4��Ogk�a.�v`!������hU=x��D9ׇ�-�;A�-�e�'y���/������t����Qh)܋���#C6Sg��q#a�M �ʕ `�F �5bL{�2D���q�ΖN/����i�N�e���o����#��|���`��� `�8�� ѳ�bZ�<��7�A3���ʀ���}� ��z�~�������������W���+w��{Λ~!6X�ѣ�?�K'?K�����$�v��\:��+Ĕ��-J&�cߛϟv�>�T���o(��S���: �#�e�s�����4C��)VF$�1��䈳��㳁���"»!ڴ���ج�ْ�9�(x3+�����H���ŧ�oz!i��3I���0�A���{̋������_����jа���V}���I�%!��������e����Ν\\��9SY��F��q�X��"��:��!+���������W� +���G�8.�v8�g63��&=�9��K�44C1S�!IG���e�M=�Q��&�!:�utʍ�W�_^�z4��x��7̛��C}��"�˲ R�沛$����O�d��� ��:��{2�Z���y�η��d6��� JC#�+n�tg{fP�Y3`\7����� �g� �9 �J<ri��� e���׳��e�9P��h�.R�T 頻��J#%ی��a��Տ�����n���ݾ8�k������H W.x��J/�K�v�1^*$��]b�Mʩ݃�-ON��|�d8^�����/S��7�� c�,Fo�`��W�ƻ��Ƽ�l��;T�A(���`/QB��h_Ǫ�'p�k����p��V;��� ��Q�Y��K{�P%��Vա��P��o�̼����H=%JN7l8�������g�H��JiQ�0r�U��Z�j�A�x|SO˾�r�oxDT���S�g���iʑ6���y��T�����%g@�,-��|`wo���n�ƀ���]uV(6���� Q��2� 4YؘEt��e�@|gk>����p6�7 �5s��+��D-m�=h�ڗ�1i�`��G�oJ.,�Ra�c��.���N���Z�6��4X�g!���(W����S�(� J�ɯ8(f���m:Ş���Ѫ��AR���0=�CeT���T˔V"��.��<�媥��C��3��>�w�8�ý�;.����L\v���%���㍙����Y�Ww���84�"���L���h擙n]m� ���T V�a6Z��h�KD8�f��b�p �ܛ����z����m�04]����:ɀH���Jn��8!�������f^�_ o�dR�I}k�Ab��5�2^ ���n��q"���@��Ӧ�����s�V�E�"�9T4��7n�z���Mmܤ����L?��O�,�vh�˞�{*�N��Q��.3~��o���q��\*eҴ����b�k��Ӧ��)^p7��#���;+liv��?�~@-Xc@@p���kk祁��W$�aG�x�c�t&kwm���5��7ߔC�5ؖΈ��B���F]������12p,d��� [l���Ҙb�1q���3�Z~��]�����,��f������<q�6�]B(�-df�34�5�a���8�>�� �Fp����Gc@�1k���P3��K�旧���'w��Ƞ�R���͵�V�<^N���(�f��A�g`E�G��0Xv���i~��\�ұ�0%���.��U�ؚ��ѐǢ=�R��
Static task
static1
Behavioral task
behavioral1
Sample
827ef384e4497c52730545df28bb9c4696f8c258b713d4ae9f17154e7b85df17.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
827ef384e4497c52730545df28bb9c4696f8c258b713d4ae9f17154e7b85df17.exe
Resource
win11-20240709-en
General
-
Target
827ef384e4497c52730545df28bb9c4696f8c258b713d4ae9f17154e7b85df17
-
Size
3.1MB
-
MD5
d036679c784b931a08f3b5aa3279e59d
-
SHA1
6e35802e4cf8960c37458aab4922b2cb244c1517
-
SHA256
827ef384e4497c52730545df28bb9c4696f8c258b713d4ae9f17154e7b85df17
-
SHA512
e7010d7b986763729b9115ea1f44429fe86e3d7a2a78f53f89aa433a8b4fb2ea3a8c98ad26b663c05b58485135ccbc942a64f375e726a8dea27a61f4ac705112
-
SSDEEP
98304:s2zAIL0BPby7z7yEQnFF2f8tmAvf8+O64nMr:s2kna77sFnmAcb2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 827ef384e4497c52730545df28bb9c4696f8c258b713d4ae9f17154e7b85df17
Files
-
827ef384e4497c52730545df28bb9c4696f8c258b713d4ae9f17154e7b85df17.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE