Y�B����x {!�x���ɗ�����vM��Cp(B�������L6`E����Mh�o]����v�]�T�U���t��_�+a[.��_A����3e>�v�ƍ-U %�p��S� ֯T/%�7� T���L�W@Z\t�3J�oR�d��.��ب�h|�+���c�m����:/�s믁 b�'I���<�B���1�k�_�-vy[���yw���x���7�y|��\�JQ&x���P�j����m���,i���P�wt�����z�N\������A.m�gT3�" `��0��{���x��ԌUccPp���C:u����Oc���� ��џȐDU�w�ֻ=__,�z��q[����io�,�,��� �Ӏ�}���a��^�O�� c�t���W�ި�o8I��t���R'�� �g� ��dC��JB�9>�s-�HP�3ד�8���k�Z��Qܹ1y�(</O�%�Y���H7'(�}?ƀe0K(�]��S"�7������}�6�Շ���D:�0;ʆ�S��W��5���&��Nq�}>�jB�io�ȒIG�ܙy�[<İ@xa�i5����>ԃ뮰�L;�R4�Qi�Ϫ��E�h��ҝ@st�rC��5C6|-� �X$�Cx���ؾ|kc�f���F2�V�]�إx����Y�X�V�j&?�2��� ���K>^��� �p���.&q��Hz��-��R/�x�*�toa��#V�IFiM����w��z�XY`5CH�l��J�e-���@��r7��Wn��?��Y���s.�'�T� ��1!�xB�Y���/��>�ցdY.����K&����z�YX1 s�R�z�q�){�IK����B0����en�V���&�O�v�So�(�`�Q�����9�s����H~W����̨�o���Y�֨|\(�,a���Ϝ�� p�f��'�� ���d��Y�n����E��=��W,?�M���V�:�_�dY��x�r۟��hQ�G �ͥN�P��j?�=����]�n��������Ȯ:Wlݤ�9���,��o���0ZF��.���? ��%.���i̤xd��G8~���.�O���]��C-���d[é�AF~D0�֫˘9��;�c�]�����>5v4ϴ�����xOWȃ���ӳN�d���q�{��/�ğN���궹{��6��t/kꨒI����J�$Y��2��f����E��%D�����$k}/�3����/�H�A�a���tm����B�Ô��uc��Ӯ���p�0̹"r���G����b�4��e&���f�E�L6��`=��B����Q��k�C�8����E��m�eV#�n�\�o@�u��Y5o�F��N��X������p.(D?}K���5����'����1$�sEdi@;�_���Wު�!�DVգ~�l�[�#H�(��@F�6.� a]�S�%��y���K�@�*�1�.1i��qEl�,� C���];γ��~4Iȴ��ѡc�������V�o��� �+��um�;�؋C�P�:Vu��Pa����z��,��͚x戴��a�`�}f*�O�i��?� '�����lU��G�/$�?D�����I��nz�BWA~ ��;��V��1���,�d�F�#|�� |�s �=G�����3���}l��q����X�X� .ր�H[�oL�uMfY�/����v����p�8��CD�Um���Ҩ����ؖmԋ}[r�}�aZ��P4���ok֖��[;2����$�Xq"�1��3��Ďh-+��i��8�|dt�_���۪��L`i�K�gx�M��)�d����NV�e������8x���'HP��6�*�����Y�K������@���ReL>���,tl��R�o���Ս�!Ȑ�W͌gK�49�sf<}�~��6��<������f�o@<k��"����^�Ƹm�����������EQ�Q���A^e����k$�o��?�x_������_��<*I�Zq+F/}��h���C'�1��� �^Q"k;\_�>ˤ1f} �m0��z�ߨOB�����^��[��./�bo��2r�\��)�kN��U[Mܕ�C; O^yN���^h�!i/����{�y�.4��d��kq��&v@�j+�5ᝃ�(=�tZ+=���}����DS���Y�!���B�@��K���i3����iw�G�oM�5�"�v"b"f���Cq��ʭ�B���g ����^���#Xs����J8Ry����ɼI`;$��D"d7�樎�*�0���/��*�ʠg�S|U�I�E���ڠ9,��R��g�J�M��_K`���*$v6Ky mSm�x��&��)Hgw�Ę#�G�����ju�&��3��.��-�ixϤD�nӈF"��i�}u�x.������J�b��a � ��䘙����Ȩ搏���h�U#&��D��a��B!���̓i���%�E�d ���4�=�^��s����yX|�` �8���B�b��"cC��_B�D^���u�P&m�ZV;E�yԾ���i�$�Aم%'�wh��u D��R�Z�����{�-#���оl�R�홁�F��|�ڶ�� R��_���i(��#*���§�b���tĝ!�_�i]�HwuN��7����6�2Yju ��aV��)�7|��+�<�48&�{�a~���������W��3ɋ/�- ��]�Wv8�¦r�CwrY���G����}�2���#��`�1.N�p��!����[5o����%�,�4l�x����~��/�!�N�p���c�'�4�.Q�z��C��\�d 5�O�f5��XؗW���XT��g}�a�"�#\��E�^�� ��>7�?���������w����� *D+_��H�$٨7�'�b� "��ȧT�)�kj��;o�o�&��I�9v�[��m�Ż7K�wB�w��H�����"TÀ��okus <dH��q����;'vL�ĎWҴw��|�9�����8{��B�ŭ�W]Ӡ�*��)�G�����m�v8dp�jh7�U� ����U���g߲�ސEo0e�"��JaŀA��w9\�n���sj��;|VwrC �x�p^M�����!�Rd���K���S8�a ʹyK����g����h���[I�?dk���3H� �^��$����l2��nm*Y���;X*��8XI�Μr�ڙM&��&V u��T��ۿ����X�%�����K)%��k������y��a�M��� 公߀n"����`���j��vx��������{��� R��ȧo�����ZxK���.L����Ya�K(��CvS��q3�2�� �{�\���~��.�>f%��p)���X��?�z\s���#c�n����A���2�9ø@�$A�z�=j�����j8# T^N3oQ��z���d4�z���z!'5(s�GQR?:�I�-y��Й�Ww���� ì�,��i�b�cS����~�V����v��@ ���{AfG���C�I����g`�9 ��a:5H�Pk� ���Z����$g4�d,c銆�"Yq�+?7�����o��A4P�a���5�GR�����YE�C.f�w�n����C�(��ow
Static task
static1
Behavioral task
behavioral1
Sample
2be22a49faee0720a478b1a3bc1cd28190dd4922cf4cfe10f00fcd8791f39481.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
2be22a49faee0720a478b1a3bc1cd28190dd4922cf4cfe10f00fcd8791f39481.exe
Resource
win11-20240802-en
General
-
Target
2be22a49faee0720a478b1a3bc1cd28190dd4922cf4cfe10f00fcd8791f39481
-
Size
3.1MB
-
MD5
ff46a5dd2ec0b367ffe5da740efb00cf
-
SHA1
f9aae8ec1507e7c34591cdec4ed7f3fdfa11b699
-
SHA256
2be22a49faee0720a478b1a3bc1cd28190dd4922cf4cfe10f00fcd8791f39481
-
SHA512
44f4b3fdcc27b0aa7b4e9d4f9a0aa17f60c8e6e039f0a1b4283c224ab93d411a9eae3a19e78dd75db44aa880c1de43721628e9fc7f7d1b0e2fb9b1976c5d7922
-
SSDEEP
98304:7VOkg+Pfd0tESCjUWMqCnksoCQFklZue:8kg4mPuUWfCkhX+lZf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2be22a49faee0720a478b1a3bc1cd28190dd4922cf4cfe10f00fcd8791f39481
Files
-
2be22a49faee0720a478b1a3bc1cd28190dd4922cf4cfe10f00fcd8791f39481.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE