���I���M�R�}k��-�%qX}��2��[�N����GU@ K�4qHM�s�pL^�-|�����'�d��^�)W�W�x�f����Yc����t�2#�2�w�3~n�� *��S����>x1�ߟ7��.Ra�UP�M��㞡��]�ؘ�l �p�b�w^]��G��3�3���4�C��xL�v��'o���-��$�89�Ƃݴ����@���B�No����{�Ty�&R+�Lt8?B_�ڐ���m�:�B0��e�������N��;�,5C�H���v<:�����tŰ�:�y�2�y���g\�����q4?�gg�o��!�+;�������R��/s0�>^@��i'l���M�d�J<y�1'����J?��G�Y�_�TVu���<4WJ�KV���46����M5E�{�����#��q��c'fl[�����a]ct�/�K�L���t6���Ic��%��,�p9;l��)�xcA�j�ƥ+�je�'0� ���J>�q^�]��9���)��-�< ��pB�̔�I�I,�)?El[%�g1�����BƯ������PYn>HB@���6oҕ}'�أ����2J ����d�ӳ��&fi�5I�Kh\S�`� ����W��X@��$��Yb���a�x�T���y,�w��b�W9 ��ih�w��l* b:�fR~�䙶����:��;�C|0��3�w��O����U��"<�װ�P����a{�l����x;^��L�����Hʺ�n�I�';������`+��s53p��<FY/����Q�C�Xt|��,{6�c��Y�$W4���x|c��+ :~���!�S�+Li�{-��vpQ���u���V̵oy �=\b���+�'��Mw;�_�y���Ov�}��v�R1iߵ�N��iؚ~Ӫ>u�!�oы����/lUj�y �6a��P 句9��\����hG`�6)�ˎ�H �=��Ê϶�7²����O\�I�P/hB�F%Ɠ�48����?��t�c�x,�D�n2;�dY@�*� "��)� w#!+<���C0�\���;x��y�.�����D��c� G�sw�@���?;�����.3��1ito��h���*V{��;�\'��>�~u�]5k�v�+*^;O���F Kl�������əc��d.E5�i{-g٦��I����h}<�i��,X����͘�A<Ӂ#�XUz]�p�l$``��-2qmy�Yv��X��!��rd}���l�.��+g�mUZG�r�s$cZ�P���~4a��6��wͬ�5�����^��0�D���F�ӆ��m�Zj�}+h�S@ �O�RG?:ݟO/���� �ny��f|J�zvX�zC�������@���/3��Q�����t ��k�h�]v8��������e��y�L�s�p����X /����@aL�JEq� �$��K0'k)��R��JY�Ҵ��a(axܒm�{P��.�T����p2�ޏ&403;t5������Y����A%��]k�z7L���KV|~��\�M���lj��_��ƙ���oZ~�:ϩ�3T{��|����D�i��퓢�!g�����+�/�%5�6�f,�������(E�.n����c5���1>�m��Ѽ7z ��r�U��Q�U^�ݩj|���\�-f"��u$�i�#����� ߬i�R���P��n'�{n`ӕ�K}�q�^��}9��q�%8�T�u��e'�-���e�kY`���u�DAh�ɟ�]�>KE/�5��8���%b�����O𡕞/���!V��(�%���1(�S��Xn� S�,����2�9.?����zX����b�%��43%�iin�� \��AG ���Y���<^���4�fV��mm�ج��צ�x���%0l����j�v�q�A*�V�t�g�® �h*l��~�������Y��{��4�߅o�6$|Ē���Zb"������� �<���j�Q�AJ�YN�f� �`�=K�V��)�[# �A�Q����uZA;��7B8�����+�����&V[��/� �1��\�nݐB�S���-5��',�9{Ă��Q`+�а5�.l#�(8�wb�߀�e�W�������g<|�T'V��/{�PpPC5$������]D��z����H�a���-�p?�w"Vc�+e��o Q� dW�v�Ƀ �q���}j�{��nz�#�u��u�Ԓ�.��LA�H��P�B�0�A���+S# h����D�A-}?��k�2�~쀤�����I�6>a2{�f��yK�Qn-��uZ��i��I� �]�c���'�`E���r��N� �P:�;<�ү��<S� �/=��r�mZ��� #8���Q{�5��#��K�4[�GS�G�ϸz;�⩷LN�����SԆ����`��g���&��{quv�gWWjg�ڭ+K�=z�1��g�j�6n�{�lS�V���8�Dc�������]LqD���T�БK���U��2�v�� 'l�j�o��)e�@4sb5؇ni��M��f|�~X;�>�u�t ��|��� �8�K��*�[vˎ�A��>���p�1��X��.±x̲���F�����ȩU�d�����)Bg@}�v�X[�|:e,���9-n���Uj:�'����@ɝ���A���$�-�[����1�z��)ʭ�9o�uD�)�ءR��M�RA��5�88 !��� 1L�]{F�?��z�?9<~���h Ӈ�EB�O�M)��ȸ�e��-�e��4��Of՞!��R�11�s1g_Sv�R�^��c��C1�(#��\?��(dN�nR��p�_(������ }�����3k�o�(%�������l[S�B�h��:)��\� j�$ %�24h�% �`�\���i���˵Ę+��-�D�9i�jB3w��Q�����q�1��h�^q � ������T.��}}OI6�`��6x��[�U%�W�P���2 �����p�J/����7�M�킰��秔^?d�y/������,�>|���'� N�����ȫ��%(��hN)�Yy�OQ6��\�m�o0�ǚl��T��[:Ӗ�͢U�|?K�Y���$* ���}�w�?}d��G+��6��,=�Z)E��W�l#�3$ ��BK���˦�x���M�W���R:���J��1Ǡ\�W�@��i��u��3�.�__Ѫ�? `Γ�}X�B� �,n��?������E�85 �y/�g��A^��ݧ<�3c9����`���^_������Ɉ�骏z�� U6!w�𤋮]'���D�/����'9<Ai���Q�te`es��A)ܾ�42�+�q]�����ɛ!6$�H��;.Uޞ���P�`M��E �-N+� -g��}f8�|}EYx(t�h>��XՏ�6�W��Ӯr{�ny��R��E�A�ֹ������ �:���;���G�������\BGڙw�^��v g�z
Static task
static1
Behavioral task
behavioral1
Sample
2810edd1f6141162f03cbcf14677108ec4449cb8c15637a83a51ab9b36e75551.exe
Resource
win7-20240729-en
General
-
Target
2810edd1f6141162f03cbcf14677108ec4449cb8c15637a83a51ab9b36e75551
-
Size
2.5MB
-
MD5
83d776646e204bbdc4e65b2251a17f26
-
SHA1
2d46f42fe5e17f36b4c1a7409c691b0bfb86bd0e
-
SHA256
2810edd1f6141162f03cbcf14677108ec4449cb8c15637a83a51ab9b36e75551
-
SHA512
8c6a10202dd3234b607cd1da4e563b6fc498cfe50f1b8312816a6e04478d6a9c88596813b634fb4cae1f889fcd357fce316decc5d871b6b89db2e3f011aea2f0
-
SSDEEP
49152:exeOAwBApSJdHFtSEXniknCRLmPtwWd/qb9m2TcAC0Xntb:exvAwyp0HFtSEXnfCEPuWdSb9TcrEV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2810edd1f6141162f03cbcf14677108ec4449cb8c15637a83a51ab9b36e75551
Files
-
2810edd1f6141162f03cbcf14677108ec4449cb8c15637a83a51ab9b36e75551.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 131KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE