J������$�\�I�*�� ��s*K��++�7���r�W�7]z�������ռ��-u*N-*�ô� �̘�H��.��ji��r�?̗���P.cM���.D2�G+y])�4���([+��I�<ntQ7ّ��cTgj��%KhSq��g��Q<%d���-�gnN�M�m�t;s��*�T�TYH�����v����U!(����͉iS6W�üz�iZ#�!��zG�u�f���P��`+��� 7��Aÿ�CG����y�D��o���$�h����#�sǞ��y����t�z��}֯�!G�=T%�cJ��mg����H4�n�5f���H̬ ���}�M���=˛O���;s�3NϘ�kZ6�����cD�]���@�0V� G�m�9i41�����z���ݭ0�g��Y���Wf�kC5�&�lԇV)��窨Რ����Ţ���,�]h�4����.b���#���+��_Q9�⮛2�ካ�Y�k�#<i�x��8�G[����)�X$�zN�F�"��p5���A���~W���2z�Pe`3��r��6��~?Ԍ.�J�� ��}B�� ��ǭ6+�<�P�����Η�љ���N��ݧ��O ��[�"�cul=?��v���������g� �%4�;��r5�E���τar&� w6���6�����/ګ����b,h S��&Y���g�e� ��C�/�mmψ>yF�"����7���LJ�.,���{�*dOІ��d�u;,�G2\�S��2����kt��l~� H������o�ė���d�s ך��;��m5�$\l��l�� ���?ˋU��w������3���Is��赕v0�m�t�b|��{藂�S����I(ʚV5Y�C2 [��6zT�`-��Y����*���DK�7�9:�{��e`��q���d���զ�m��q�|�!�uόvW����r0��f��T�I��\B���A�/}MFM�O�����P����й "6;�a�,(�JsX�+ܬ��oD��0�bVa@@�V)� ���cϳ\�d �~� и���Xp�S�P烏�*�[�r"9�k}4f��ۗ�*� �+О2@ Z� ѹ����?߫Ca<XGۓ�����u���d��#��ꚕ����� +��Gڱ+��,�*��##�Į�$��lt�RV<{�N��qoT�ؤ����}h]ϓ%�ш[D9��W���+�gè�Wa�c�-�v��w ��s����on~F��eSmL�������=���8����3�<U�����rt�����NO��â@���㓨%n�۶���s�j�="8�n{�7�����R`�g�M�2�1�尢��������hv�#������2�.[�P�I�0�h��*�yڛ$aRD+ǖ�@aX�o���?����A����p�x#g�A�$�o��|���}�X�m����"��.GU���߃ ���C0������*/S�bg�i�/J,�m����Jʷk���X*Ҵ]��D@� \"k��-Z2�5��ʭ������]a�k}c-Ƴ���PYȪ)<U��5�����-��d�R 0f���e�o(T��;[������p�'Ix����S �c٘�|I�bw�]4J�FJn8������Myvr��G�]qu-�3ؔOwv{D@//�߯?���E6�sd�gY������Ԗ3p���c)�R^�s��\ �� J\���H���Cs�i��x$p����M.i�s?��8�'UT��+��<xT�> ��y�?{�?����}T)�pz�{���] X��V��,Y}�/ɞ ��k�}��3tqK�\��fG�$dS#^k�)�^��X�\�1���ëk�Z~IL!u�:1][.%;�T|x� �M��� $/��Oݰ@��#ߤ n�?�v�Ј�'Iy��1сnL���T�Z ����T�=,˾W�1�;��D���Rr�{��T���Lx ��c_�����]^3߂s��e��4����-�a~$�r`�(j ����c���3�� %��(�]� x�)�!e� ?��ŷ�/Q�%�v���L,�$Q�X�%G�m���?�L��W������S=�Qeh�[iie`�G6m��h�V�NO)��1�P��pfn���X�ƶ�U�#��C���x053�p,����H�ʪMi8����V�C�5�������,��-%]x�Jq��������cX��(�P��8�25j�H?��<�I�L����{s(k��[#'?1M���Q�a�}�<)k!�����@ʠ9����wX������c0,$�Yߡ �l=���V��@נ�?��M�I����:F���sY5�Yo�-%�8�;>i% ��Y5<�2Y��� wW��O���`���7�0���B@���ճL*75鏉[a�y��T��6���?6�:�������c��h��ӄ�z���s�mC�k���W B�Ss�$���*��H�`�#��d�8��R'��`Z��s�#��}�(}KS���y����rOP#�E �����#(p��w���e3��_�u) �Y���ƸQ� +�y@��� ❣[{)`)� ��w������4sh`��bR��!����~��5J0����������[P����-����+'��Iѡ��c� ��~��O�>�����{@�U���6��^�:{>dBj�P���D} �@��,TϚ�q>�2�37m���,":�P�"0z��q�&z`�\8\G�]�����p#E�;��k%� �ds!�`�T����%�P��Y�?"oc�V�=s$���*zj�� |gb���Z�_B�4[����~�;!��_�sӧ����32X�;d��� l~.1T�( �Ν���ml�\��eOg�q��f��wK�Y��Jxd����q3B�P{��P��A��<���:1��L@j��&xB8;e�9��r,�6/������-�E�W*� c���Q�a����z����1EY �����lj�d��^3�����:�`������mҋ6��V��拗�#W@����2����ۅ�E� �OO���%z��:"�^��{ :�W��j���sZKwp�O�N4��z���7Bُ��."���`��W؆D̅�k����J�02ͦ�+d�\�m ��G��r���\���vի� o$!�|e���}�0%��`�Ȓ�f��i��7�S�%=�wf��ق��鬑����veL
Static task
static1
Behavioral task
behavioral1
Sample
14d7a26c1765ab3ea8c56f05898e9a4e65a9a214ac6671c02afcdec869c89321.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
14d7a26c1765ab3ea8c56f05898e9a4e65a9a214ac6671c02afcdec869c89321.exe
Resource
win10-20240404-en
General
-
Target
14d7a26c1765ab3ea8c56f05898e9a4e65a9a214ac6671c02afcdec869c89321
-
Size
3.1MB
-
MD5
bff8d160043aea0b68452a0fcd453031
-
SHA1
bbe639f208413669e89ad3f5cbe126cbe9fa78f4
-
SHA256
14d7a26c1765ab3ea8c56f05898e9a4e65a9a214ac6671c02afcdec869c89321
-
SHA512
5abf13813a60bec64528f8fb49a350a504084df216ca919010f259ebd1ac0f897dccac18633741533672b9f514987fd4667c33c3ad0a9162ce42bf5b8e57b166
-
SSDEEP
49152:/E9savj+BEqrAgqlAmGnWj7K1fC2rzHHk3Q4FOh0B8cyUwQmOze5ZANQ:M9/NrZAmi1fhHkg45GUwLObNQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 14d7a26c1765ab3ea8c56f05898e9a4e65a9a214ac6671c02afcdec869c89321
Files
-
14d7a26c1765ab3ea8c56f05898e9a4e65a9a214ac6671c02afcdec869c89321.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE