M{��'@��T�8$�l�J�Y^�� -W� �����c�k��P0`�af�6�f�,8��� wT�M"0|��v�!��c5m����2����3��IJ�i���_H𰇔��.n(Y 6MH2� ��`��# ��ɒ�`J�<&ě�w��A:�:E��Z�������]���Nv����B��j}�h=��lIJcgFebB�X�T&��!d7b;.�����٘��w.^��|Qȇ�}�]�/x��5���JA�� +��Y.u-iW�Օ�^�FX�mه6��H��k|/|>���b�X���!{n\�emn�m)�3^����T@HR�b�DO��#2Շ�_�P��'��8�-��ߝ4�7�ߣBYef��t�6�u B��^/��/k�\������� ��XѼ���bX����� �����:����tf nd�\<�~��� \DF]�/h�'k9"=X��ʱ5�?&/������j=�#?#Q��Bo#b7].���$�V�s�v�o����Uj�+��k��q*�~uD�����VچZNA�g��`j��Dž��9�9�P������M����S�lŸ/��Z�Tpn3j5Q�~�ǚ��jGe&AH�{��|��ޡk�Vm+؝2��:��W:���*_(���f;�Ֆr�K�3 x�k�G�h0��xV�%�.R2�j�ʴ�VL ��i�X�:��7�ov����wX��'��U��R7/�y3��G�S6rE������zL,�\��+u,lg�tŮ����e����/�Pb~�R�O�@~�Q�����#Ϳ|N�����=�0Vb���Mm���$}��v�"�21��3Q#İ0��}���W�eO2�L����H��x�,{u��|���0�r��� �+{RW�S��`G՟f��\�~/r4�����6/��S�n��7��oO��i���l��<Sp����!��*��F �?�yw"}���0�{�+�����K��;�)� '�c�P-���,�Gt8�d�n2ѼQ��Q�Y��-�o�s]�%%�v-��X����P�$,{�^t|�y���SPu6ޖj�؞c��kT�E<�3mNEq��A���.��]�g.T�&̟�\�Ti|a5�*���a�8=���� �$��M�^t��:�5}et°���e bC�_��X�����]���S^2���;9���mP5��O��r�����~n����N=祥%�i'�5F��PR�Gg�U"��G���p����{s��ؽ�3��H+Om{K:)���a����������ƿV*Nvh Q�u.�(�������Q���c�e����� ��b��e%F�L�HZ���G�%�j�x�d�U�J��8T�����=o��-�ͪD]9EH�G^F��Vï\���N@�I��1�j��vca���N��\-���k,�З�QycC�я�c"�qZ�A�ʊ�r��l�!ƞ��B;L�1l�ѩX��vQ���M����{�A�.f�$�x�������R��,�X� �JE�(�oN����ӸF /&"sԏ��Z��� ��!�>_��!�i�1�-��㏱T^���6-(�����_����Vs&��B���������5_M��T���D�fo*��w�����s�G���W�Q_�}����0����oSs[J kɋ��o�)d���(��UV���T���y�*�s���q͊.��*���������H�'����|���?���'��/�zx�U���Bl{m>��̘b4Я����r��m> �P���ul��8�b�������l* "�oH,ڟ���g� G��u#��9Ɨ���YBA��B�)�[�<��=d��~�X0�2Xd��]h�'���#=��^����q� �U9Մ^���ߕ������:&�Ʉ����`==��a���>�(�2����:x;�0W3�,�*M6��@o���^҇�I��rR0sƗK1b]�����m���B�LS�P(hl���a���m� �C��Cf��{����0�-�:^k|̾k �a�I5h{<i��.9K�e�5�r��@ݠC>]�F�od" S@y��kO��2F���7�>y�d�E�ŮA!4[o��z���c�x���KB���U��.�R�48��Jap��� ���u�i�e��u��Q��#zpQ�����O��a��Qf��I�z�l��P�����]+l��x-�4��,�- %ptdQA���^k�N�a�� #�����#{��ux{�JR���+�O#"oO- OF29���?% �I��ǟ�dOY#�w}���r�� i�V@� Kζ #k��`i�J�^,�/PW��~�9�� ���o&����-A ��18�����|/(`x><�2vYp��@�Ꮪ��ؖra�������ٛ\�q�$��(�{h�����wc�fNP _��#��~��z��4z��D\��<1NX�h$�KWm�P wm ��=���}�TN �-�������g$@�����*V4ɭf����[z�E�{��㲠�g��ڌz6��@n\ �M��|-�-�����7X����Q��?��i��<ߓQ���Q)�H��]�> :q6~n���a��|h���\@�Qpg�E��@��r�Zbʕ��#�EUУ[G~�IbL��q7��zA>X@��6�Ē���,��5T��%��l�t���0��!d Y ���J��W�Ï��N܌�;,s�]���Ly;0�[��yL ��!�ʣ���z��.���1�����T�[�� �ns�:����X�DDN��S�K��Z{�t��P��K�N���r�&�|Q2���;���54ۀ�1� X�x�O��'�9�G\'���yd:���o�b�h�F"�U�����Tx����+?��&���-�]Ma|�7�T?��� 7�Y������ @�n���)Ս\n߅��@_+�b��2��l����41}M�3�,8˜���(�&����`�0D�(�s~bs<U�<_ �6��^q;c��i�{L�M��$ź�H=��k��Hy�S�������2�0B����ߚa�3a6��� ��'�g N{�e ק`������ ��v�в���(j��al�ߺΐʰ���t�k�����!{�X��V�`�s)4x-1�z�ڵ��,����Ka>I��tJ'�k�� f^M�p:O�[^6�Ȓ��, ��[x�W�i����i��5�ʗ�
Static task
static1
Behavioral task
behavioral1
Sample
29dc3485dbd41b710e2792a1d1ea70b10f53aba4411a83749b025b580da5752e.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
29dc3485dbd41b710e2792a1d1ea70b10f53aba4411a83749b025b580da5752e.exe
Resource
win11-20240802-en
General
-
Target
29dc3485dbd41b710e2792a1d1ea70b10f53aba4411a83749b025b580da5752e
-
Size
3.1MB
-
MD5
09ba30263bf11c788a780c2ed9f82936
-
SHA1
937daac503b0dace992fd267b74687e5d2f7107d
-
SHA256
29dc3485dbd41b710e2792a1d1ea70b10f53aba4411a83749b025b580da5752e
-
SHA512
e531063e9ec9d5e694bb3e0bcf3568160af714d594f1ece61f82a292721eff623c9538c04dc92141b771ed9c440f2d83d980f12292b0aeb69712b83e05c431d4
-
SSDEEP
98304:OPZ9Yy40A4ScU78y+YUAI3epq0ggdF1TX2Qv:OPwp0YcUnUAFplggdbd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 29dc3485dbd41b710e2792a1d1ea70b10f53aba4411a83749b025b580da5752e
Files
-
29dc3485dbd41b710e2792a1d1ea70b10f53aba4411a83749b025b580da5752e.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE