�¤5�_�!W�pAn(B�!�HZ�\���C �l��܌�]���d�Uv����ΰmp�gU�3rHQ�fԒ����U,/��NO0�r�F�FR�F�JX�� �r��<�9���S��`�6f=0=u�Fs8���h%=Q�up�Ǖ��4,�N���| ~d?��lj�`}f���Ф���݃��хV��|��.��M�{w?p^n����~!P�NiW_O�����C-�H�'����Lr�4�)ۥ/6�����|�B���Ro�m�p_�'�Tt)��W�_��F�L�7A�ퟗ+�L�"A�|C��ϣ@�f>���hHpF�;^�U+Ab��Mt_w�,�9�pؚMP�^�(�WS,2QҘ�k#v�pN�Mt���q"1�v�����.�N'������zl�4���0!p�{~BK,�R�-.�5Y�9����k�ȓ������[֒pe3'՛�0eZ���E;خ YH|"�y���EZ �^S��=̅�"4��\cu�j��릉�$�~��."���������]5��UH�41�����%K)8�=��WS-އ��1BhmC>���H��BTeE���}NS��& �ᖒb6�����]3����H$�q�*5bF�{A��'�YY9�������ugȄ7�_� 0��uyڥ�a�!����_1�^ 6��x���.�;8�/8j�X��X$�viåˊ����y���Y���a��8Gu�{��R5,Vl`���@=`"i�3>��q�[m�!�u��?~s�U�,c�!�60����OJ���4W�u�X-*��J7�[����$�J�V����P>-���u$�\K�^�/:j��:i�[;��8��Y �M��W0H��9��Ȧ� z7Y�ԋU����>���XєX��'��};���ex���UI�5�L3��M�p}��:͒��9�針ހ}nono~=ZoFG���o�F�b�+��/������,��(d���`0Y��|EG��qh�2��Ca��T��?p�؞>}��uؓ&�6�j� �������|���cV�����h#)�H����o�"�i��� ����?�߇���|}�F����'��Hr��Q�xQ��M�����V����j∐�4U� �UtR�%��8����s'^f�D2���h��&�a+_`5��V��,l����H����w��@�i�K���Tч�/��h�`.�(�{����S����xe����붬[I�Ƙ������c<�&����R�&r�L�*��}@�K;�w^�[G�M��n7��w$��lA��-z�E0F�$ s�aQXPV�^�������%0���i�ҕa�r���]���J��R��Y�ԯ����*�K�:N�߄dږ��-S��i>�")�|Q��ʞ̗�b�oae�J��!qd'�,������2 ���D}[;v��6|Z���ƞ� �y��O�*B�1���d�N�д X֍���W�ƿ7�F�ϸB�O�?�����Okؒg������[�����p��IR|��0���ۀh.$`�y�\�����Bj��8��Y|tyMqE�4�.�KE��q�W1�B_����u��z�}�:�eHj�k.��>[�a� M�I̖nhց�(@������Nfk�䥿�a��4�!r��I����^�ٞ�W� B�4��장�9�J)FL�!*���a�������*I742)�(�AN����q�iz�Gf9��>�1q)�ec}�`��t~}�D;�(��- �թ���KJB��U��I�u�/�0��NABF04-��n� گ��0�m���N��anJo/����֚ݟM1�R�ꢁ�L�^S�Hw�'�.�����))v����t�h@K��`��nY$b��#6�k��Od��%l�oFR75O���v՛W�dc/]X�{����f�x��tBc���kI�+���H|��h4�����U���D.˙���i�L�[���W��w��&�j�D>C�d�+���fg��4 T�����>;�� z�+ť^ġ1����R�g��K�9�F�}�d��<�p*](^����^A�_q�@6 �� '����?�Xs�Al�˟��8z��PLk��ȫD�c!�x��T�w�;�a{o{_��P&NP����Mt '����w�'$�p(4�C���d�����y���<����W�g��e�.���"� 6��`L�+SH��ϵ�zr��Ι"���Q'�X�Go͐�����Uܢ�/��O^V�0�Kz�UK��{D1M+��H�If��E��1�[���)`-�$�":�P���0qs��$o�Y������Z*E&;.��L<��?��o�&~���c;7����qTg � +�*<�q�xL���A>lN�TW�a3��{�.���Io�f�R��2�S�^g�� z����EȻ�蒡kp� ĭ��r9D�-b�����X"��xq��=G~�7%�>D/���O���P�/0�X�����P���ma0��n�Vu��������wjrm��5!���W������{�?,�����,�2"v�@����T*�NӢVl�:�t�!�_�m ���U�p�D�3�x���ˡ���=vh|�XceN�� ���5߷�SR������;�0���=�]�˲ T�9�A�M����PZZ��+�����U����`�q�5����Ġ��g~,������I?|���d�S�WO�k��z�R��U��|?]u�2�T9I�j��g&�|��i����['f�B��hY.��Y�CY�?�T���5����&B?W��r�՟����V���u&Q��j.��}g��f���!6���͠�F�|F����`Tz�Dzx=]��^ ܁5�\���n �n0�P�ߏY�<��6TB���BU�3�~��~�"$E�N�P��Sm����#�y�,� ���$�c/�4�s��E��Џa&�FE�"��K���C��V�p�_�����X��a���E���|�����!���M@7���N��*q�϶./5�������nB\��o���>D��/��E�Z���T� b�3��itߕLN��hbl��}2b�<� � D���Hd{.:����D����EzsW���H`�ѯ fȹ�5��|b?M�r�S{�AL�s�(�xC�;�Y$����^���O�R>ml=��VA%���lD�ijʑ�:�>��t���sk������)fv$G�����%D�*V�L-p�%�%<D�Pe���Pb���3���5*�����/�h���D��`���p�����LK���y���İ@�%'J�Zv���.o9�(�( h��":7�[~����Y*���܄:X�?�a�t�_{�Ê��mO��[�±��[�;�C ����1��
Static task
static1
Behavioral task
behavioral1
Sample
5570b74ec949bf3a29ec5d5d393cc7475330d54e86d9aab20528f5a4d63b4bb5.exe
Resource
win10v2004-20240730-en
Behavioral task
behavioral2
Sample
5570b74ec949bf3a29ec5d5d393cc7475330d54e86d9aab20528f5a4d63b4bb5.exe
Resource
win11-20240730-en
General
-
Target
5570b74ec949bf3a29ec5d5d393cc7475330d54e86d9aab20528f5a4d63b4bb5
-
Size
3.1MB
-
MD5
ba2e8d1504950ded4eaca7d7c2ec1e23
-
SHA1
7f40e1f849ffab81068d70ca1accc904755cb2a1
-
SHA256
5570b74ec949bf3a29ec5d5d393cc7475330d54e86d9aab20528f5a4d63b4bb5
-
SHA512
d3386e78fdd14f34540d6b725b9536bac3610cf0096957d10606f9bb4b2e24b88acc96e05988e83863287d52c0711ac9b9974dabfaaab5d7bc61e8badb5b2f62
-
SSDEEP
49152:v+wYL0jGJpdknpq/hO+EYu3xABFhkcMIlsWfGHOLN4XbxRBrRrJpVa86:NYL08p+HLYumBQIlmuLN4X7B9V16
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5570b74ec949bf3a29ec5d5d393cc7475330d54e86d9aab20528f5a4d63b4bb5
Files
-
5570b74ec949bf3a29ec5d5d393cc7475330d54e86d9aab20528f5a4d63b4bb5.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE