����U����Z�@n��r2�4���8�6�M� ���!�ޑ�e�?�鼤����ط��}�]����+�]HO�$5��i��u_)��~_<���nw�3I<�t 3e�IT)j�)���-wx��}�\(�O�L�m8ʁ'���tmD���zk�s9t[M��(���8s�2Ų�A�s=<\� ��� L�������&����<Wm%��G1�H�:s&2�9B��И�t�ƅ饏�U��� �r���i����4b��2�~H.�Q�n �#��?���@+u�<��'��G�CbdL��zV������%n%;�����ʨ�o3%�Z/��i����- �dY��� � ��]yt+*vX��U�r���(x�J@�Te4p�P � %����M����}�����w~���z\مnCt�<+"��Q�ϐ�k�eAk/s���h��g�Y��8]��`��1��B $Tvi��s�s�������� Lu�I67ڦ|@��穓���kI�\\%QgH�t6������ת��슗0DȾ����p����� �Z1�.&χ�x��k):F�r��k]���Y��OJ_�[J�s��V6@�*�[>!�̴�p�2��!3�o<a�m���7�[�*���;L䔬�}�ꎅ��6G�Vw�I.G����e`=]����t�F͏D)����Juf����.낪8���z�<��Dj]y��-h�w��ٹ�xӔ��Y��@Jݷ/�x�� ^�h�0�[\Qi�������� <E�t���qI�T{K��UsEC����ѵѪ�[;n�-Tv�2|���"H����s�����ɾgna�3����'�c������4�߭�6e^����״�8�i�F;���:�vI��U��},T��D�c:��|ŝg?\����#�:�f�d7,U裷�(�m.ͅE��X�U+E�&��wZ�z �y�?�� L�Q�طak̎��1FY��: �6���W����,�L�����6��^��+�P=�ny2����L �s�.�l!~R�������K0�5규`�������i�L����rLC���^)n����2qP�Ku-�=B7���^�Y�ITA�ւ�L��iڋ��u���SF�ByA��t_m��'ڸ�u����⛐�<Ws�Drq�@�3V^+(}�N���F���N�0�Y.((����L��S+��v����DZ��]����N 0�q2v�G�M��o1��y�����ϋ B/�E��O�T���K$��;���?�v �X8�� � g�Sj�P��0���1e �0m�q�1Xn"��#J�^��&�@4;\L'e�3ƞ��صǗ{��*M�����W��Y�vc�-��P����!f��� �%����� _P�"�Cڿ���A��[\-1KS������ͫˀXC�9�ig0��Y�9���6�Ն\d&$�ݩ^��m��<���F�2����7�j.k�';Y�R >.���&Ӝ�b����5|���|ژ�C��a|�߳e��0��~�J���6�LV��ӄ��, �fowO@���@L�T ��hu��WLK�u� {LR$�:N]� �nH�����gSJ�[�0�����&F���"�RN�G��c0F��I��b�&\�<�6�k#��3 ���S�Ω�U�k�y���U��#ڮ3�|>��;����"m�8�{~����T̺`��)'�+�H&|��uT����D�_�D���L��f'Hs<Y�~�2�{K���n�hm�vԲB�t��0�[��s)�(�s��!L{V�Kԇ>�\S�ͅ(y�gp�3��TB@L|�T�iX�WD�����:vr);����(Gm#C�U�Aa�š�>�4yV�u�5-�KI�(�U65C�t�!._����r��iSp9)i-�X�z�-Q9���ohSW�V�ra*�m�>�їCwW||�IV��c���'� �� D��2���M�uTlW�%g�.ɸ�6*\~ҍژ2�c���}Y���*�C�_��t��i-wZ����::��=x�rf�4W���A�3a����6S�R�W��t��/�|p�<x����X��/�����1��ɉ��Rs҂�b� ��Eoلő�Z;���>E��l&Jq��^�j�� cs�M��9Ù�#��P2ѧ����xS���Dݲ���/w�w^�y����* j(2�M�fz�3#���m�[�ws^�����b������_̕>7d'�X%��qស����s�r�99�6^2N��.e4�[��3��B�f�ag �tQ}�����j��R��km�톒��� ���<��*���"�B�7��&��P� S@����N���_�@#�@ո0�@�H�:n!o�|7���� Ȃ*>Rw!��1w ����p�R-m�����wt��O`|-�b�%g��l,s�(of+9?�h �������z��%KU#~WύlW]8/� 7��)��3��\2��Ix�L.i�py�v��:�?��������nf��9�I�k���$�C�ɮCq5-�4y���v�H�Y���<�]��L�kԫ�~D�^kd��1� �ٗ�!G�$2��w�b.ڀp�ş����a��\����{�6�n�E�g����lTX<q6�]- ��b�-T0پ.om!q�R=Q�Gl~|�ݲ#���$�p�:��>��"�t�LEa*ې_ ~��BZ|��E?1��:'ݰ �ݺ�"&4Ŕgf�_�Ź踴�RhU�yi9�kg��6V�Y7dJ��aiƁ��A��\h���ѭ_�mv�5?��V���L1W���ж�y@ t��m�� ����Q�tj�M� m~��y�g��������U%A�g{�֒�CEzV&�k��'<�|�Q����@K��|����V���{�U���$~M�,�ri&*����xhM�f��94&���� �pG5|�/��-J��V�R�) �0r�$F���*�I�ޝ]���3�A_=��r[��;���\��`�����of �ك&__�ia����ǚmL}r�^�p@��@y<E�!:�|�%�JũK~ur&s���P�;G*B�ό#�ܦpm<�u8��>|,�{1�'�*���� �����t ?�.Cmm��sΰס��f�a7�/ì���4 vh~���j�Ո4aP?"W�2;���my(5x�a�-TR"@������Z��M H�"�D��"�"�R�B�ԉx��Ӑќ�K��gX��C�rBcl��ÕQKa་���`5���:�QS��Y������8KC}��~�b�9�6�N��!C��ə���ڲaD2K�|# xyVk �}c�����p��,��bsh>AƯ�t[�� �X�G�"�?�Vg�0̛�Ղ�[�O����w�G��t5+e��$����"�Lw����*�yr�$u�QAQ��?|YS����C��{ߦ������l'>V|:v���ߺ�-��1�XVxF��6-|�I>
Static task
static1
Behavioral task
behavioral1
Sample
1ee6943425698f391038a6219dcdd31d7d85beb0a288b3031d1fa4f703712c64.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
1ee6943425698f391038a6219dcdd31d7d85beb0a288b3031d1fa4f703712c64.exe
Resource
win10v2004-20240709-en
General
-
Target
1ee6943425698f391038a6219dcdd31d7d85beb0a288b3031d1fa4f703712c64
-
Size
2.7MB
-
MD5
b286e422bbc2788564e2f57277b246b2
-
SHA1
c27c895fcb96c29c5fd2c6ec221ff17a14396259
-
SHA256
1ee6943425698f391038a6219dcdd31d7d85beb0a288b3031d1fa4f703712c64
-
SHA512
11edd18b53b8ae6fd42e898b0008e27937b614518098a2af41d017eed2f3a7d46473146c7512fe5d9c5f80d3ed91ad5709c79b8dda0acdf7fee969f8763e8222
-
SSDEEP
49152:sFJy9WW100nP2FE8sCqr7M8SYBrFlf4KUi2lAhKIMoSOw2frlQB:sFU9WGDP2yDB05Qf4BAhKhmlQB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1ee6943425698f391038a6219dcdd31d7d85beb0a288b3031d1fa4f703712c64
Files
-
1ee6943425698f391038a6219dcdd31d7d85beb0a288b3031d1fa4f703712c64.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 11KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 22KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE