����=�/;�:���C c�@�%�SWrl�L���]�K�A�b��*o����z.�-&��x���5�Z �m�n�Ԕ�?���' �[���_m�w'-�wԳ0��f@���x���d � |[����$2���i���� {�-��ɧ �c>����F\�r;�&Xk���7�Q˙͓��kسn��̞�yЉ@�\t.�i(��.�?Zv���2��H`�&{�>l����}��ʫ)w$Ţ1]pG�wqf�w{�����=?/��]vB��Y��,o��伣�a~�i6�T���� � !�R��#�w��U��-H�d�Yz%N%Hޥ~��$���g�W {���G('p-N��˸� 7�j��ě�ΤX$F�NUQ��>�<�����Ƹwr���p�`���"��b�b��[���u"��HoR�k63D& �2�����y�� �mzKܞ�Z */lta(_���6�B`�qK��؊�-�:u�Wֲ1���'O��g����=�dI��T����ǰ a}� :�����C"Sk�6��]!� �gBҲ�o��|3��t��ébw�������_��B���&a-�-���K9�5��Y������r_i/߫}� |S�iv�a;O��kA|�>�7a7���|2��`�M���9r�m�kg��Zd��t*��z��y��L}��ң p��q��*px�o��f�^Q�������ڪ�&1��l��Ùf~#�;̽7����VyK� o���v�.���R�� ���Y4��D�7C��A~K��X<�@L�ͤ�y���ɍ��+��T��Z �۾��J�%�^&++I��2�9���ɻ���lh�]����ꢏ��YN �N6� �R_*V� �,��[���*�7�� "������S���i�Z�9��*EL�)+mH��}'F����'T�֝��{8�_N�����2�ԇeҠ�LWQ1���f�'�`�]�^���FE�6�N�С��os���oul�g��W��������ɰ���|�0-�I�6��� ��qEKISiFE].T/���]��Y��a_P[?کPn��m��\��%զ@fԗ�%���/H2�� ��ڟ/�u��IzW;���K����|��&���L�ɔe=�ί�w�]A|X겭��<�\,��|��0���VH���X�����1���q%�(��4�c��ʂ$��bp��O�Ų_�I��ѝsO˫�\�5��@C�7��/���{ۋ�j�d����d;����Ih��%�}�^��Ip��>�Mh�L�m��7>V��sk}s5/�H���E�i���:��R��݉5ӊ�B)Ɯ�Pɜ< :于�X�\���Ÿ4����Z<P�2����v4;��Z��[����e8�w���Y�t�^iic�����2���"U��>��|%Um��Ddl���민�r�Ҵ��I���}��-n�a����V�i0,0Ӎ����_giz`@G���y�?���ۃ�J�������O?<��XL�0�Wgfb�)�+�K�!�Q�،Q�k���0뤾�eL�}��HE�ȿ����@ { itiߛ���e�þR�d�*w�/~����A��L�4K��Ib��U:P!i��d����[f^�y�,v�_E'm%���n���y�oSA<�o�IK�@n�;�5�1��2��@ZM�3C^��t���>��HɗWJb|�Ë��$�>��$K�JHl_ɤY�:뭯k��f������!��F�1]?)0_��&�L�R�f4]wnP���?9܂Ұݥ����6�� �������:�`�����S���Y�l��F(�6B��4���V�O���.��OV�V*G�K��)u%�LfY�?�JXe-�ƻEۘ�t"�D���GRwA�\�F$MW۸;���;B��,�b8����y�L3�����*�/w�t��ﰱ6X��%�3����j�b�i�w�����{u;���?��BR�-���B��x�ũ9�d�[��x��Z�\o�H�"|��y�C(Ԟ��6��#�xC��?�fhR�^@O`B?Z���0 oP�=W�X��/b�l�����]�3Y~�F�ز�� ��Z~�<�3뚆����A������A#L& (�N�2 7���s�`E(����ea��L)��$�>�ʖ��T�[�c��]��,t\!����M���3� �zEf���i�I���%#�fʴeu#W1(|G�!��0<\R����t���4��M̙ɜxd��<�i�W�ܶ��b���F��l�<�k+D�����JZ���k nY�qKsj�.:�HN���1��Gj�N�^���{����]ܭ�����h����Y�Êe,�;Z��n��PJ�}KƱؠ%P�R�/5��+7Q�霥���c�ß�sf���G��&� �}���Z�k��6����C!��y��Zp���SvF�+!H� ��=Zm�y�Q���s�����+�RI���X�UM?>/}�ŀ����_�A�x�v����G�����>>�����~����X��θ�����J|9n���Z;�� ����%QoV�Ab幤�mT�7�}lI0��RMed�sK��� �?Cw#T�zq��Xt�U�N�d�]�Lb*���PP&�!�~J�V��b�p_�$���6YU|W�Bö́�3Ԛ��>�����"wNu{�J�V��DE�Ƃ�0(+�O��}R��z$������N'v>�Mp�7�k�UL-Y�N.��k��&"��XU�(�t�8r��p�+SIn9�|�I.k��x�F��K�Iʢq<K�y �}�~�U��S��k�<��5H��A��T�)z����KA�P��5(��^ �Yu�g �pk���^��gp>���Fp���AB�td�v%��c{Q�R��w�yv���XŹ�0�BI��ThUt�A�{kíqЉy���O�����:��>pvq��%¦.?�_�t<��X�oA��6Tj,3�i��}�HxͶ0������ 睈3C)��"{e�!���upQ_kY�]�1-fdwB��-C�����9i�t?K��H�e�R�������������g"���_�g�=�'�?ɇ�s���1�������@ʘ#*]<�E>�_��{~�iW2�y�p���&�b��ŀl����k� � Z�>֏ఁ��ne���Ќ�,��y햹6Q<�����QW �$#�Ut��9��(����`:M�$U/&ʄ���U��I�����A[�m, iv����~vw`�'�>Ӑ�hj e�P���"j �tS�I���|�(��O q*�r��{�m��b����2&�yB����C�5Q�,\�n`A�c(x*�Ns,����dcp��dGE��"�o��� ����u�E��q��g>�[+z�f=yG�2:Q�4ü���:D��ڼ'�"�W�[,�JQ�n���r�2d���6���z"C�\ _[�0�V6 �,��.[}�i���H�Ɂ �X?=����z��Z��~����3"5%B�?R�9����+��1��az.���{�7f�cȄ5��|2�7�6���R�F���.����h�?����>f�
Static task
static1
Behavioral task
behavioral1
Sample
1cffa63ac6e875c75b6fad6f110d77860b23f96a41283845b477fd3fda349176.exe
Resource
win7-20240704-en
General
-
Target
1cffa63ac6e875c75b6fad6f110d77860b23f96a41283845b477fd3fda349176
-
Size
2.5MB
-
MD5
5b82b61104953ce087a22813915c10a2
-
SHA1
953892ed733c7f25bed30a3464ca45a88afd33e6
-
SHA256
1cffa63ac6e875c75b6fad6f110d77860b23f96a41283845b477fd3fda349176
-
SHA512
93128a47ebe498f69a2a2051a43086ef68ed2817de3a499033064bf3bb9aab756ea947475380cb613498db9c7c37155b09cb4c1bdcbf02857da1131139c301cb
-
SSDEEP
49152:jr6xCIcg1T+dBgH4LFZPfsKglKzeSk+3G8QQcN8JAtppE+tB9uM5dzN8/ooNeugz:i+g1TkeH4ZcKAKeSk+3G8Q18u0+f9uMu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1cffa63ac6e875c75b6fad6f110d77860b23f96a41283845b477fd3fda349176
Files
-
1cffa63ac6e875c75b6fad6f110d77860b23f96a41283845b477fd3fda349176.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 131KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE