Ff�}\���9�ˏW&�?���IH���4�j����R�������Q����C@�y^�~���]qm��L���E5�Jk��վ��;l[ ����/���D"2٭:U��<���alrx9n��0k[�ñ5�@���`������2��N�?�j���a�h�}��wQԓk*4֨Z�HpCh ϤŒLJ�o�oH��vc����5��e�2�_�aL߇;�*Ơ��������/V5gͺ�z5�lK|�1Ys��v00ɤ�9Y"��^+�a��QXw�'��R�����_���X�c�V������b�UL�q�MK��e����om��0C"�Yg�_�ػnQ�g�M;Fm�'�t|Z:H?]���K.�mj��f�{_���;��G��:+�0$b�nGw���l Xc��'p�&M#�t=zzK �������=}��[&���:*]���C��ba�%L�Q���������>�c�)_��Q��hN0$�A8�%�v��S\��mR�E��U�8���ՙ[�@��7���RN ������ԍ\n�� �>�̜�Tj��$'K,l�l~p��wH��� ����ą�����<�8�I%}�]w�K���������_=J�p���f�<���Pk�ߗ��m�k��\�Q��DK)����J)Ԃ ot�����S.])���oN��[`^qS��y^��!h�Щ�z�e������n�� � g��u�:@l�u��!;��#�_��� �+t���M�? d�V�hR�K%�)�t����7m�cJK{0h�H�0H�I�j[���'f���[io���#�}�x�,fu/["�O���OT�1�=\�z��zMcM�x �?FțO-z-�W���~L�-ꅈ�L�!��#��Z�����ad�cg���V|=�T���� �[����e�����\�b����G���c���d�iX�>�]%�ú?��̓���F���K8�c���>ܹ��nL�D�b~?u��Ơ����c�u>�-�/�-OS�;��J��ۡ fH��(�(\��e2�$�],�$/�����{���ް"d>�9qut��u�Ê�rT1��I��*�l��V�f <P&�\ �w��mr��ס+�8����?�����<G5-�y~� 9�̰�8&�U�o(n"F2�����~��v����3^�,f�K" ���� ��mގ��2r���<������9���F�6���f#��v[������o��g}�a��$i�l{�i`0 ����ጇq���G���U�.���HՈE�|��b�WB�ˁA`���jZ��(,�=f�%cu %�xd�TD>m�_QW��A�<!��ʃ}h���P�xXA�o�+% �|�;�d��'��9�$M4��Vm I@xx�&��7L-�M�RK��k?T��=>ߢ����Mub�����4�Y�Ã�hFL׀�%�v�M\ld�me��|�+��;6/�q��F�I�:���x�=��h�v��M��^@k�j�*M�?�r�ߏ�I&�7�O�[\��R{Zm�R�$f�U4k��������<&�,��8��3M1~2�Tʸ9/hՖ0?��e�[Av�x���*���M4N"6����s;�G����(9�����������v5e6>��M����R�c����|+O-�[�4�N�@�4��d��a�:f!y�o��8'p��PI�v5 9-X'������ �v����������7��gyx��(��K:�2B�+X���ԃRX�pӘ�Oƿ��������ƚ�[%š��-�H�T�f��!G���Zs�,� H���(Hm=��͝����i��+��5�(��x���i ��C�guN�d�?*o��2�~��~�"���y�!��&s��<f��9�i*ف'��{�r���XO�u�5--�a5���ڠ�E/�ț���._��:6-����N ���{"��I�_eں��K[�ٱ~w�Z�x5���� �<��>�zx�s�e��p�o���|b&�3Y��FD����Q�on9\rZ@�Z� �O �-���v7�@�h7C]c9�f���y�!ϊu�4���jg��� �{�X��u�z%ٰ���ҋU�%�kr����O�31������q��B^�+�/ �S]�o7���)�� ���蚫Ɖ�@��b��� ��, nrݛ��$L�o�I� Zc��=��Ke�pG���~lI���Z��w�>/X����vq���@����K�������<2j����o�#�m�@��@�8���d��Y�������|�]��w�U�� �����&GQ��݉߭��bN��� ����ʨ� ���p�)!�^]��\��&��ELl�>�P!���u:�!���J�zκ� �����^O�B��F�搤8F&�b;���a���z�-\�T]Λ����GT{����32,���w����ɲ�J֮��]`+�z��E� Ȫ=s x�]���~�wƱ�M+D�JƊ�����7�o���q�5<�j�dy���0�l���s�7���y��ٰh��kIuAfl���F&lURH���%�B�����lO�+ f���8A�"� ��xj���A�5r[A���B�4ŃY�GK9,�e��tC�R�"��V�9 �6(mƃ؟�#Rm����5���� t'$e����@�R���,��)��X;��j|e�l%�d�i�Mۃ ���c{Q�� yb���������VB�H���n|�^YJc�ϫ�`p�+{з.�H�M7*�<�p}oa������N)�C����h�A 60H�r�ҭf� ����s�>�q��Z�7U�4��vY�W�V�-�/��hUW���MP뤂|���6v�܆�t��h����B��Aw� ��$qHqV�����L�~�s��D�Y��tD���v=�n��2��\S��u�w�E>-OF,ܽ�r��v���T���~��(;7e�l�"�\cՓf� ����L�=� �5��oݕr��)���V�/��NL��<�4\}�7�����z�b�������|/�ձCg���{�]q I=)�����8<���������PZ�ʧbl@4����t�:4m��sw��(E�d�&lD���+Cg63�Xk�e�ʖ���� ��`�"e���E����>(���xrU*>)lo�`B��ńcҬn�/8���X�{T���J��p>P�ð��Hqhߙ2�G+m"FY�0�4ذ��*�p�ɓ !�}�J�*b�l��V��{/4]4k�E�n��!U�-�;ٞ��9��L������:�$H�����[�K���V`��6~��O�K{c+�)m䃝C�TwЛ�,�����WN��6�����\�f-����w������]*a`V|g�ZO����}x���bO/��u�<ݖ�>2O\yGy��K3��j�&���Ln2Cs_����ϣ8�U�$J�v+�[����^�X����QXۥ�*ȟT�*G��z��)��T���κ}O����@ݠ�y��t�*31�o�}6F*%�(����pL�Q%���'R����%��@�5��U�#�8�<� ��R�"<w�5��6� 2H�
Static task
static1
Behavioral task
behavioral1
Sample
c446a800030db78de7ddfc5b5f1cc4f63af65177a834b5480524646e2c425bf9.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
c446a800030db78de7ddfc5b5f1cc4f63af65177a834b5480524646e2c425bf9.exe
Resource
win11-20240802-en
General
-
Target
c446a800030db78de7ddfc5b5f1cc4f63af65177a834b5480524646e2c425bf9
-
Size
3.1MB
-
MD5
57319decc8c80a6cac26d26939f4caf3
-
SHA1
62dabc03b1882a1c7fa78fe8bd42a5c538df79df
-
SHA256
c446a800030db78de7ddfc5b5f1cc4f63af65177a834b5480524646e2c425bf9
-
SHA512
1231782add3047e4ef14bd5fb559244d41a882617eb74ea01d61da70ec105b5b02cda8b2a3c09eb01495f79059c690626602e8f294b9b93872b59063f3b80975
-
SSDEEP
98304:EU3xDVmrJUAsXneHO99FXVTE0jCwzK2zLhQZ9Y8jd:EWDVmrJ8XnwO9Nlf1hMY8j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c446a800030db78de7ddfc5b5f1cc4f63af65177a834b5480524646e2c425bf9
Files
-
c446a800030db78de7ddfc5b5f1cc4f63af65177a834b5480524646e2c425bf9.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE