˸���*��H|��W��X�����?K =dW�lB�C�)v�V�I"��C���S�p�����e�&�q�� �xC�-��i���o��D|�@F��ڴ���ک6kP/����6�E:��Tzm0W��$�Ą� o�=֯�4n� ��=o�LV�ǝrxQ\��ه H*��J��q������6���)��wH�!��P�OD $`��!d�ǿ?���l���q��W+J�������i���6�햩 [��@�Z �˾��DD-�����2�e.y�H����&�w�$&!sN���,�Z� rG�s�oe5ڤ�p>�^A2� G@�4L�| ��\]O8��� ��o��R�÷���&�`��M�I&8xWl�P��R�<N[�� �.'~��@�o��Wj㵧C<0��+�c8��9�JiI��QSju� ���]��4gL�"�5��9��d�H����z4��NX��7<ujK 3~�kV���$�sq��J�K����&�'6�FV�^��! ��r=9E0��6�ʙ7:H��A"?(,�&<�#rK�."�1�17PE���{���k���)�R*V�����#KS�q�v��L)b�W��k�e�����Ò*�p)%�&��0�+Q\��9��r�����S�qu�F����ɿ��\gPG�����+9I���=pR0X2w_h�:���v��ѹ �IY���k����5�d���0;�������?ћG4a�b��j��;�]�����V�Jm]��[|�0�c���]i 5*��C�DG����i��x�+q�����}��y��"�gZ�� �O��'%�����X����3h�ǯbW��W��0?�x������w���, L�[�%�"$�\I,��d5GE@㇠�y>w�F��ᱪ9���9=�W�Tdp���X��]�(����"�G��tbCX���W�f�g/�5Іʼ7�,@�!X�ߌ~�T���ͫr������Z+�ojw���*��["g����m�R�tvvz��hOr&t��J��J�])`��*��yX>T%6#h�?�p��f�(�O`�&A����I���%��DH���A�z��ƹ�#g���M�����`Ӫ�P��߽u�-�x�; ܨd�����B���m�l�*�T�`�L���Z�r�R��]�%ۄ�����%�U�y�s��� *}���ƴm��_�n�.=������S|,p-"N%�r�~�ͬ��9��˛����<�pt:�l��&q�L�CD���6�Ď�UE@�UP��;U ��������ܻb�;L}����s��2�@o���}j#���:b��K�p\ �Wr#����ig�Yܛ��D� EO�'��U�gn����\nڜ=9�m������Bրػ���&>��We`q{o�s8!�� ��O�5˿�3����Ql�JrD�D���|*l?J��gQ!������F�=��Po~j`�>`��:��_ݤ� l�k5�*Cɳ��͊��z�a�І��,��h�Yr#��^��o��|(o�N۴��z$��1-�L�&b����l �?�.Nb9�xL�r�h����9TP�����I�+n���=�O��-�ګOѿЍWJjݬb���C&��8)]S�^���d` M�Br0���i�wGJ+�����8^�"�S�E����Xq�V��M����5�6j����\Hx\�(ls�PI=��o��år.��,��G��kl@�{�)�V��^��a���ș� K�n}��O��g.��C�uȇ6�kM�'� G!G�����Ə�'�1qO�t�Ol;;9��G���/n�?����@�b�CC������)�'(����(�89���TaR#�/�Z�w#L����+Z������g�!=�TG9c#%i0�Uַ��s��i1V?�}aѤ���KokҬzbm1G�Bh����^dMz�\��D: �0���_\��g>4]�*x���ˢu1M�S���T��V�qS!ZtS�0�[Y�q_3�+�0���7�^:�#�>'�-��p���[Svo�D1AEz�MX�(�K���ۋP�*�}+��eX^�r�(�c�Z�4Z?l*Y�P�� �1}xڑ��CN�Qݾ>� ��e�����Q��2��<|�"�1�_�T��1��Y������ʴ�X5\8�KHQ;�R|����"<�ht��)�]�S�L֪�M�f�$jd,�j�oa_ms� )"+y�##ȓ�?E��C�'93Pؖ� �iO�Ѽ�}��K⡢78>ZS�^y72+-��Cζ4��E���3���N�������Cy�~& {f�4z垾i���)Z�. z?Aj��>�����o���۩�V[�p( ���r�{�8w$Z}�"y��iSD�R��5sI�˯xF��:&��\�iHJ���&.�O�1�%q\��/��5B���b�SlK{�I����!��"��ft��/XHR� ,�q\'�4o�_�p#c{1iz,[2��2�-' |Ȉc�Z�������i�]�u7�'����}��ǽ�q��\�1"��/R���h���`��u����rJ�h9��p,����4��ǧFW4����q5Z�^�uGŋG�^û��(��nX\*���/ʕ�m���Q���������ϊ;�r�hC42i)ݡ&��MI[I3�O����'BNΑ�+�ڮG o�j��L��Ú^i��P��y�7ߌ=oH�(��b��VhB`�ŃX��G��"��� ���d��&��t ^]o��Ó��d~��՞Cː\��gn�z�&� )VGW)�ӥ/X���G�~u����Z����;h�X�p���KsKV]ş �)�+���A(��g;���*�j��ͷ����q�jbE.��On�Lv��@�DQ����+�����MI��,��u ���8{'�<�bTu���5�S����R:��n�"p h)E�� �i����D��rVU�\�켳R�'Mu�X�M�q`qw��ӸBI�0j�\j15��z(�\�+��(2�T\ޤeه1���]aat� Vl#x���4/k};y�:��5��7j�Ӣ��kӻ�$G>�dw�LM��@�rq.�����Y0_p�ts�+�*�e�4�NtH�3�zI�P^�Ur�����U����y�!��賱� f `k3w틀�F��Ps�r岦�䕤}�$�'�� �)�na���Mp!�,d�t�-�^��g��|B����g!y)!�v$Y.zH�^1�e�h��W1M;W��iBI�o�+� IR3��~�b���q8��и�����-(Gr��l!��xC�@,[7�O>� �WNuR�o0 <�W]lyծ*���x���]�0�����Y�z. ��Dd���W�1V�j�����zH�)��t��;�:W T����|Q��!��R)� x`F �X߳��\ M�.�v��.LwA�[�)M$/ �HYڍ�o�f�<�1���4�!�֚�;3�������}���*1�b'�����Q��`�e�QYܼ��<q� ��S��uWJ.Mw�8�Fs)�����E6�:�ܤ2���L�1��]�{ �bl�}�#�U���B���J�倚7"C��������N��H+�*}p+m�}���x�M�7s7?�P�9.�9�9�e/��b�F�F]5<ց��-6s�!�J�p�֮��u��^��+Q����IO$��49Y�Z��*��V��˺�g�J���3�}���W+ҵ�z���3��Nd�^�k �
Static task
static1
Behavioral task
behavioral1
Sample
e06fde7de3abf0eaf61afe426ed3dec88a2f2945c0837e70308e8bb88da34b61.exe
Resource
win10v2004-20240730-en
Behavioral task
behavioral2
Sample
e06fde7de3abf0eaf61afe426ed3dec88a2f2945c0837e70308e8bb88da34b61.exe
Resource
win11-20240730-en
General
-
Target
e06fde7de3abf0eaf61afe426ed3dec88a2f2945c0837e70308e8bb88da34b61
-
Size
3.1MB
-
MD5
c6af6f81d5e76e45a8cec9bb96505cdc
-
SHA1
6cda1ec3d916b938bb8fc967c7d2aa4ec6a26b6d
-
SHA256
e06fde7de3abf0eaf61afe426ed3dec88a2f2945c0837e70308e8bb88da34b61
-
SHA512
9d6aab875795902ba78e8e8cd4febcfbd25e9bbf24822ad5206d8952f46300bbba4ba8bd1d9763a060a84755e72a86216030db416cb87452f1fd0f63f839969c
-
SSDEEP
49152:4kfdQO9WufQRXIb0CBQ8+fyCCEQjK4gerVkDklWjfX6EzX7weiczzGPs44QH:fQPZE0Vzf1kKNjklWGEzX7we5zG0BQH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e06fde7de3abf0eaf61afe426ed3dec88a2f2945c0837e70308e8bb88da34b61
Files
-
e06fde7de3abf0eaf61afe426ed3dec88a2f2945c0837e70308e8bb88da34b61.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE