�O������B�֢R���;�[Q���7չ�7���ۃ�Ŝ���9�w�+�>��Π#���p/4������� ��R��WE~�P���ҽ��{q9ګ��Y�+�� yT�Y�xo�N��8����tX2D��8T��#���&m2���>j�S��y'����'Oz~� -�^���i�9}z-s�{� ���S V�����W֮{���t���Be���Y���Y��� �u��52h�E`�-M��i�������5�����@��0������V\'ԭ�p(Ҝ;-�g{��L��r���g�d>H�(DI�,���g�Kׁ뜟lE�4����%/�<��)�� <�jޞ��>`��Wߥ�!P3�)�����u��������b\���]c��;F� @���[�U+����8�=�~�S\���o����|����珓r��,�!��7f��o^}��1��C,���d+�hF��>o�\��zPe���VX�_�,l}{C��W�*����A?-�M��`��cc�����e� 39˯,��^Dpw?i!"�'�֢��J�ƻ[�N9�a��-�#�J�.sw(�Y�����tC��k���C~�E�jg��5��6���oV����R-/�S���4��nz���Ӝ�Z��R #�L����,���Ť������\ђ�P��Sk��$^w$D��T�҄�" a�z�Ƽ���(ʒY[5����o���^��<�W��q����/�y[Cb�R����3�[4j`���1���<7&ܖ�kf3���7�n�dG$�9��L��^�uC��D��Js����i�ݝ��'���/�Bm9v��d�i��0!�{���N�F�-v�r��hr̉ XP���m#� Řۅ���_G��8U�9���J��S9 Ѯ� _z�̨}��|���I�+�g���w�e.�p����p��Z�h��&g i�7C�5���ZS��HT�����\�a�Cͥc�[3���1P[��oX-�|O����L�jh�&�\;�^�����S6�tb֘_O��;���5��}�l����M$eEJ@�A^� G\�����ػ4����������'����ˌ,��1(w\fw/�G1�����t 6CA�D�/`a�к�s�����ш͌�̱x���O/2� 3�;h�a���x��F�� ���S��F = )���2��g��/A�l�F�E��`s�ܢ2���aY����)�S*~���h���B��ˤ��K���X�~��v����e��`����|�SG��S7dC�1i��"G��̺���3%���a���I`5�?7`����r�����M���VFu�i7�f=m��̢.|�.J�7Q����R��1��Zb�ӂk�s��CK @�7XM��}�<Q�3Q���2��������e������#�D��p��S�&#Ӽ�'� &nKĮ�7�W�s�%i�ʺ� eW�A��mz�0�Iu'��� F�����^:L�������Z���y���} D�}c��#_��SE2�͈��D������ Bt O;�j�gZP�F���MHL���W�����9��^=�zp/O�̃q�FT_�va�.Ŵof%&J�A=���_����ۧ��hi�'9��'��Z���_�ՁI�>e-1L Em�~yq�]3��&��8D��6eLVir֍H���̇�v�Ӝi^����Q�{���*k�����`j.������p��[��G��`2t���H��~v���q�Ggn��Fkx1�0��Kh����B�%3�6�C��ao6�L�J�`����4/�>�@��.�yt��x���v��ȁ�`N��Q߹��~ןFF��u���f������`"Q>^���۷�d�/��Uc�7)������~�3k��f��7�2 C3�5 �z�����f��./;*2ٔ�PA�a˚L�yg���ck.� vj�N�G�cZ&�:g���E�=�Ga �(��J���D�*�&lX[��4�p�]ef�<尅d|�H���@���YT��hƲY#�.h�����)1����'���t]���ң��٤껩ܓ�:C� &3U`� *fFH�E�O�$�4m���� ܳ�u�k\�:���N��%-�` =?�#�+�(����*�(�x��=�*N�c�^6�+��f�ʩ~���kT~:ᒿ���ֱ��Ɖ��"�w �p37�y}^{����G���Û!x��3+��ǧ�f��7@��E\�h�7�KΜd�V�;�?=H�d�+M���U9��=ec@�&�ؑG`{����!p(r�,h��ҳ�u�;z�Y�yQV���UiI�_/G�&e�J�3o3̃ �&�N��U��A!��P'���Y�R�jms ���)�?h���`Jd+J��.m;������@j�������B�A��R�?�K���&n��4�:�?��Xp��E���Q^(P�TN� �`5���I��� ��ՅM��dk�v��v~(�o�[~�����N>�����% v��V�n;b߰k�AzcMx����K3�.�9���}���v�����7ۨ���/�GV��'G�]wpә����D3�sE�����2bp2�˩��,p���vj����;#�z��P{���jM����ӗo���o��)g���P.-;�n�h�Ai䘅_��V?��'mF'���w~y�:e2��|�"�Eϱ2�. ;�?hR��g�~��\�a,�� 0��� ��ܒ @{�';���u<�S���&������t��V��YKzR��Rd\��Q�f��ЗA�-�6~l�IE�.l���=Qnb��F�MrSGsE̓����Na��OM��.�o7�:5����[(=o���gI��@j�� 2;���,���>�E��y�bܧ�p�����b b�ȱ���?��|�"�{G3t"����T��k��5+���Rm����|���pQ.`ǹ��L��bE�8�M~IX�L�� ��#�J��qw g��(����?���n��h��"qr56���c}��Z�sq���0_��%�K��ܧ��o�6ڟL���_�J{gL��ɭ����gey�%��t$o�Ū���&����G������<њ'�"�+.�����Xgv D4��5��Q����<�P�v3��̛'�D�.�!|4�}�㲶D�<�����̊R�T��5�Ê�=â�1�_�Q.F�pG���R�>�lm!��^��T;2X�# MK��}?X �:��Ng�D퍚����T���/H ��%�������8'���\���;:f�^u�i����w�(�2���ܐ��=���eKQj�]B(?H�!/ �`!~�fˎ�ĬӰ᪶"���h�e��ugP�E ��7�nEz �̬J�7? �:CA2s��rw)SN}Ţ����V��|]���&�:��IY��6]��`�������%h�ؕ�,oL�=ֱc^�����l��GHl`�;$��ҔMWgф�}�H��-�]mޗ�K��`�������GnR��t��9��Q@MB�����'�#� Ԁ�XJg??��Ԫ�ܨ tf������E\n8��^i���
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240709-en
General
-
Target
file.exe
-
Size
3.1MB
-
MD5
a6b9ba406e557a924fbff7546c9b8386
-
SHA1
cd4056df2d7b011e8f1e4d9683d122405a88835f
-
SHA256
b2ffd93569c7eec760892eaa4e6fd1c2e783db89f550153d1123ac69c63483e7
-
SHA512
215f58bcd44202a5a044b5c45da45095361cc13960b174b22df9c7805b4e1e609ddfb6c1f0b1db07891c6c79391aa8b2e2b64a48a8955cc81875c125cddf5c21
-
SSDEEP
49152:sFQWGTL4ZoT1gmH23VPEy0bFbbFcUYba1/hMi7Nc3MDUe0svL0CA/CKjsCI5J:sFjA1gmHmOv8a1Gi7NvvLfwsC+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file.exe
Files
-
file.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE