���:������r|��_�ic����U��a$4�0c�q �zf.,��r&�b��RRo$l�̵���b]��\J�i��Wq|�C !t�,n[���*������ssu��Mu�1���[U~��� �P=ӹ����D�°C��45U�/�,"vh7�)ۘ'���C���q��d���ڞ�Wu�"7ߗ��H�,t��� D�ǣ���k5��i�ۥ^��xk�}j���'���N&�وe���f���aN�ɏ�(KU��]�"$>�fWah�b���I?����U���ZV)jPĪg�=� �M�8��5�gpBx���g�ۡz��ɪޞW���ҫ�)��x��=�a*.�����G����ձ-����e�Đ��"P��=4�^5mi�`A�0�m����a�.ħ�`pyW��V����qd0�~(���ZD �19���ȱ~� �� �U�H�WJNC~���~)� �x�2��4�D�K���hp���Єt]��J�M���5���~^�|D;f��1�a�\$����љY) �ݳ6dM�!UBA;�"[��h��@�s�EDW<���d��mA\����G�ˆ��R���T^a7%ӈ�5� ��ʵ_���G�Y�c�p������<q�~����L5=L3-�L,��)w�9����Z�#JḈ��o�Y��T`¨�I[{өf(���[�:=�wk'(����b��(��/m�(5Go)2��N�uDmp�5h���&֬Wa��3�ۦ#�{x� 9Y,jm�HR�Ro������v�o�j /��>)%��kN�G�t���D��������c�ցH���j{R���G�<#�qTsVF�0U��;�|ܑ�i��Q,��೬�]�S�>�reT�dԵ6l�#����M�ч�q�a�*4���?U��sn��7=��J"�ί�$Q�b͔ᗱ{N*��`�8m݄��� �H}{y�����&a<�c8�9덇���vw����R�uL�$o�C�r������� ���"��7�f[�ph -��K�aW}-��!�p]�����u :-�� /��� C�2�fRy�~��(�;F�S�a,�i�z���|��s�"� ,ՙ���Ϲ%X/��Z �*��g awd��g��ŀ�e��q�q��������G\� ���uGV��@oaf�U�Q4R��G˥��&H3���C9*�Q%����^amrd��UP-#; �t��Z4�x-��e�CV����Ѫ�e�\�t;����k-0":�MmBd�9�Y��_s���U8����ܤ]I�VgQ�W�*3� �@��۱��C�a��*J~��ژ�U꤆�X�b� ��G��}����R��͝�Zӈ١��-��h�V_8�_�>��T��v7�ڞ���bI�)@4ϐ�_�UE��'�� ����u`� !���Z�]"l!d�Y�srg �/^g����b�N����I1�t˫��J�bA�֛P�~|*�P����e"�� T�iʸw 4e�ظg����g�A��S�M\#����ق��]���ESk��nMp��c�Ǽ���\�ČT�x��:�G��������<K��ȏOOQ��0���rP���g��D�}'Ӯ�|u�@,e� �Y�/ڵ`e�Pw�^��̙}mw�q��:睖%��Y6fی�$� L�|��:*F}���`�*�������d[�I~�)��Tv�?Č���^���P�_!��FC>�p+�Bi���$����`U0�3���r��-���@C-�����P�o��87���Fn�Z��d~��c����KF�x����� Y��GM�i#��܈.�y~�ӵ�(�kx�H����ȡ��|��&����U-I��2o}��Ʊ�'�{�>j��O�t����(��wn,M��t;X��C��q=��x*fZ�L� zm�]q;���l0����h�L��Fg@~C�r���R`���S���"�$�1 7� ��\,HOx�_F$�'��u�l���s��ĩ������!sd��#�FA�h9h(b�r�]Ն-��[�X7b1�yRiF\��w�>Y~%n:h�� �ľ�NM\&�6UC�?MV�+DcZxz��Kw�]ŘW�/҉�άa< -Dļˆ��Bd!{���gB���H`���z��\�n5���HQEb�.�7����7�� ���>�"��hA|��m�u%��!!�`�����u"���,+�úM�А}zK�r`0�g��do��-��,o[zc����On��Z�lMa��{�F'z�����82�@b$�c�x�ok�`����m&sC���V�����Zb_����IX��b(�BY�J02#�3�=*_@���Å��-�7;����ә��F���(ع�+x&�U�(Un2�NxIg��q�Ƞ��(Z:=gU1F SeW� ���/ ��&\w��$�0{T5�D���""�D�^orZ~P<�(O(���t1k��[�,;����\�����h���.�#�G@^ �|W�o^�"7�f����x���(#ۢy�|��Ti�ɕ�S��� ��������A���(��|��,Rbn{�k$�l���a>x ����χ��7���F��<P�=;��o��f`Qj� .���=y�6�>�>���Q����;�Z���2�����=mF���2�����Z�m%TF<��,��7��Ќ���y<���N'�ͳD���w�S,� rq�Ǻ��ђ�y�dP�b;<Op�oh1=n�}����"]=g����G+$LM=G�u�G���nE�����IY��Z�z�<�"FLF�����D; ~�c�9O���%�]%�����n�ueQ��ͫv����%K�/�[o�W�~��G?�D ���V$��6�!�cH��%g�R��G-;l&�zY��g�3�-�"מ���Fe_�ԟ1��6\b"v�N�d1X6mk�s����rM���Cd���(֍)�=� �O<̜[ha*j��(�� �TеߦJUK��~����e<��*bG?|�m��#!��6���#�v��t�٥F&�anp3�˚�ٕB�n�8�����z����CW�e��!-��x���C���e�g�ԥk��d [�ɯ�����Q:BwC����7�`��ϡ���3a݄�h:_:��(��i�sDs|i>�Y�C���f��Vf�2Um;ӂޤ���y=�ٓ\��cWhr`^W�� tjZ�_�����I����L(6U�B?e��Lh��T�=*(������S�ר���73�'`|'o��� �-D�V���t��|p��5$g��8�J"K���$-�&��$g��/S�Ĺ����]�Yu���͉?�?7O2!%1����pu0�� �ô���ư��j�g ,��mX��{ f��>�R*��W�l�� �Hx��Xk�6���J\�� y�巠^�M�#�f���V�� �M��� zH��X$���������\����7 �
Static task
static1
Behavioral task
behavioral1
Sample
4a432e0b9cdcb56cefd15195329b1b6f6c6e8aaa4b146f9ce71adf6bc9fc397e.exe
Resource
win10v2004-20240730-en
Behavioral task
behavioral2
Sample
4a432e0b9cdcb56cefd15195329b1b6f6c6e8aaa4b146f9ce71adf6bc9fc397e.exe
Resource
win11-20240730-en
General
-
Target
4a432e0b9cdcb56cefd15195329b1b6f6c6e8aaa4b146f9ce71adf6bc9fc397e
-
Size
3.1MB
-
MD5
dce7e87691566ecc490576e0b0bf25a8
-
SHA1
9befac32774c50ed9e1240a73519a80605fa6e41
-
SHA256
4a432e0b9cdcb56cefd15195329b1b6f6c6e8aaa4b146f9ce71adf6bc9fc397e
-
SHA512
6f6eadd69038bb8bfbc64a2d009076aaad7609e1483fec15740662f6d03bc7841465920bb0d14b1c41893a9c91614ec31ae5812fa6e6955794240216394a19d0
-
SSDEEP
98304:zjArN6CA9paopwcx3fuax5n3Wiis1r6C:eNFA9pLtxvHzn3Wns
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4a432e0b9cdcb56cefd15195329b1b6f6c6e8aaa4b146f9ce71adf6bc9fc397e
Files
-
4a432e0b9cdcb56cefd15195329b1b6f6c6e8aaa4b146f9ce71adf6bc9fc397e.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE