"KD�T!��ǶJ�^^��fF��'��qV-5�`BQ�#�wP��]`�GņRА�{ˁ;�I�����ɩ���'���;�fMo� _6U�E4�m�fU7�9o�-����C$g�R=����WZ������ц�]/7�=��������a�s��!Uk���ƛ��w��2F������+\Вf0�:��j4>i�����'�:L�hsYֽ��A#J/�/久�b�#IDГf�~��Qu���l��Ez�{���Q�$f�����'�[Z������0'�~ό8ʣ:�ڧ<Ai�����s�L��r:&K# �N8�G�� Wdk���*���;-�c�>�j��&R�B>�ɟI*��� �q���Ph�\��� @@1��@��X�Pɭʲ ;D��ܴ�PV�a���%�86�u�� ���~���0`�^bz��C#�{Q��9��s%{/�)oHx����y��� ,�60���YXЃ��|7�B%�6�',o~{�~��Ձ�k?�8K��W[�a��'��_�a�sX±� �������3�il4��m�c�8�@�Q�����Pٻ\*�_��d�]���>��nU)Ow������w�mw��O&g�4���{_V[�[<L��[=�N���%ƍ�*�ET8m^LڹF������~=ș�a�P.^���\�-���ŐE#�"���B��9��F��IJ7GX���6�����ݔ��1�N�� �H�"��[����"b廢~�y��x4[�4јg7O �na���'^D螓�@�CSv*|]�u(��t�C!��n��;�7W���|����tz�ڽ�ÞJ�{~�u4�Z�ZmW�����S]��h8�/i�@��夏�p���|�H:���LJ����g���fl<����(��[=����Bv́�|�C!^�d<��m s�H�إM�&��D����:��9�%�)DaPHQaƱ/nؑ5�!`J��jtК�j��^��W �x"P�����S�2�-P���<�ğCdt��蚻��0�歱���������_�����/2�s�eXwC���/��}��^n�ca�?�M}���0c��XlY���p@�7��gM_�B�����:*J�,��S#uƺy���*r���h5%5`{��9�Qj\�k�/���a!�����@�lm�v qB��)����t�v����,z���J�M ���/���2�'���pK��~���l]�ϟa�V�� y[l�Fř���s�;��կt�n<![�/1 ���Ρ�lMUC���������(ض�c���Q�ZvB߭��kYfw���Ve���BP0z\��bv�� �$�8�v%k���a�rf�w$v��C���:yQ�(��0�40�����{��?��*���7��Gϸ�l^�>~���z]s?O��6�P��W�A?���#[%5�������$w"�LW�M}��쬹n+mB�g}�|�2���9V���R}�>%�sv�`L������U�)]�>h��A�����d,�dm6�=-�m�G9�'m$�q ���kP��S�&��C˹F�~���bԘ+��.���'`_r���n�ut��P��1eA3W���wb�?�a�_��ԙsO!T�����Xi�W|#�Ƌ/g�vD���vp�4��f�y�g&�wS�~����z���V����8(�!��a�@�U�ʗL�s���}y��I_���(p̫�f���*���ܸVn�u�yM��ͬ�L|��a��zu�q,���$p����)��Q�0�ef���J/�,�6���XBء��8���' V�J������3� �x���9��D!�"�ꡁ �u5����s]�3�|L�:���S�yz���C�O�4p=�Ns���it %a����[�q)%�������0]3��d[<,n�p��>#���[G�.]kOiIM�3ր9�Y���ء�c���:>`�F<HU��LH�5\i���t0��^"���4hۇv#l�1�b ��<��� !9��IK��J�(1p�?|Ox#� �k�q1�����ӏ�S-�]s@q.�lx�@2�ɤBnNi��i#iP��|��,���Rˍۄf���fa�Q戳��Z��|G,�=��;��&K��u���R�>u�jdK�?��(���b���fgR�&�tL���'�V�E��U�;D��IN�T5i���P%�M��{j���^�ЍV�o�S#>��o�Cq��Ï�L�x��'�W�w�|o�@�V��&��v�v�^#���A��H����郻���&$���~{0۰���Lѩl�������ٌSϣ���6M����;HI��ژ���I�㈦�Y< ��eTI��j�]�|,$AG�j��D�}`'~郼�(�E�s�xCCu�J\^��0�j���~�S~�Ag2��=FT߶LV����A�_�)��f�_o�=*Z���7hBJ4���P�X����h�p�2u[��b��:��������� (���b��9,�8|�l�i�)kZ�9����b����E�Έ��>�殢�|�4uR��5hCaU��H}��w���Xh� � E0�'�":T�E�U���0�]�`��~D���[��1����5���>C&8�&�L�8�1E�r��e�f�!�3�Z��7����In�R��%�Jă]{�#�=�0�b���;���x����Wme����ԑ����vl�JN�����}�͈ &��y�<�Ն�d�؈skE���WKc9m�Y��p���Q�~5����rE���8�{�y���!8����p�T��*��v�����M FA6�n���P'��z��@��U�o�r$撙��#��K�v�[�<>KeC9��r��n�OD��I�a;� 㯕�K(����*[g��}/mM�^��m�n)��[���!,�/9��/s�^��1NjuP��5U���(�$�Q��9����mK�l��mY�����\�$4����"�ͫ4�lG�� ���Iy��#"3tUwN�A T���t�����QB D~0e�L��\|�� r�N�~p��T��ܫ��{30�@4��y4��y��o�0��v�r�t�EF�.1�;wJ�A�8@S�X�4�J3���*�צ"@6r�]]\�f�nFSd�Q��w��ƲmN~����&Uz�Ɲ�����qI�d):�4 ��v;ű���~��RJ�V���� �A'�\%<�W&\����b��}N��_VLj�y =N]����E����� �|�!�4ɒ��'ēr�����x��0�an3l9Wwe*��rb�����)Z�t�m�X�Kof��|V1��ȗsĆ�x%d��^f��#��^ds&�����k�����j��S����ө C�WbN{�&�v�k8V[Q&6��$r'r���C@�Eȶ�M�W�' ��E�k��%^ʑϭt��U�s(��y��P�)Cy�:x����&d�����&n^LJO�� Ԗ�"}C�l���ټ��[1N�/ ��\�_v²�g��׀�=��"y���v�&��t�?4�*ж��K3�s�i��1bϮ��
Static task
static1
Behavioral task
behavioral1
Sample
f2d7eaa7a96fb3b123e0ed89891eb466edadaa53d7f8a198f622e4d5895290f0.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
f2d7eaa7a96fb3b123e0ed89891eb466edadaa53d7f8a198f622e4d5895290f0.exe
Resource
win10v2004-20240730-en
General
-
Target
f2d7eaa7a96fb3b123e0ed89891eb466edadaa53d7f8a198f622e4d5895290f0
-
Size
3.4MB
-
MD5
88d3f5cef0796d8eda0d2c292cd876d3
-
SHA1
25c2fb9cb59599aba3104a8830553a9a005f99e8
-
SHA256
f2d7eaa7a96fb3b123e0ed89891eb466edadaa53d7f8a198f622e4d5895290f0
-
SHA512
1f4c3d71b6a8726baa8f0b56aabfb87cdd279f41818b9cd60f7598068ef8362ad634e588863a5e45b2015a7defe5a441148a8890da1a842273b0f0b4d65309d6
-
SSDEEP
98304:2WeH1LpnNVeBNdBnpogwliowVs6RfsV70PVk:2W614jdJpoXiok0ak
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f2d7eaa7a96fb3b123e0ed89891eb466edadaa53d7f8a198f622e4d5895290f0
Files
-
f2d7eaa7a96fb3b123e0ed89891eb466edadaa53d7f8a198f622e4d5895290f0.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 749KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 50KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 51KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 281KB - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1024B - Virtual size: 8.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE