���p�ӓ�~���#$O�͕.�wbB�7xwy�{ަf�Gb*�S�ц�X�KV���CC� gNS;=�<��灓���9����O�\��_.D�� �yyS�C��spu%e�Kux����8}j`T�� ���l�j����TL�@��U���g5B��G_S/5�8X������:����fvY�:p������A��atgr/iUװ}�v(a��I�K�mtRq(?�8�Sz�W{�����nKFnV�캲S��*wg���n������-�s��x�s���8|�Fn}|�Z�`KrW�P(9�n�R,��<d��/�N���lT�t�D�B�}��7�l�OSU�Oޒ����)o�{�a� w/ԇ\� �p���� E� J���]Z�}�R=���b'��Ͽ�5qnmś���e�O�άx�e�`uީ.j6��#O�y�[<)+IE�Zd[�O��v�»Nv1�wX<�I�����j[��?�:*��x���[lx�n��!/>F�{�%.ZJS��#��TV����=�k�=}0K�ի_m���Q*;��� o(��1�3Kq�eO�e��Yd��e/�X]������%��nR�M��[X�e�����Y3O��&�ݤ�d 媄¹V��>�M2�m����A�|�fE��5��} 0��?��q�U�ǛR�����w���� �x#0IM�1YO��2�V�������[�cc0��Ԍ4Lν3)A� m�K�e��:�W2< 9r��4͝���,;�g�a�=j�qg���/-/Q��q:����'C���xW����s/�#q1�ǔƣ�Dl��ױu��A�y���{�Hqi�-:��B�j��d#�e��#��b�t�U�d�ci<�nͭ8�}w!��9����;h�bD9�B��E2��#F�+��Z��������$����_�}��&K��5u!�y��x,B��)�d�d <U��b����9�6�\�;���n�/M�b�!�$�s�z�X��l����+�70gp蓱�a�_������S��,��!��2�^~��:�=7�Ŗ9��0э��托H�>�c���j� �&d�7Jjߛ�������pq��EY)������nzE����1ך�ޑY>�E�b/�k�'���D!����x7n9|A7a�)��oo´�����7.���s�1.� 2�$��jT�}����@Q^���FrЀ�����^������1�<��u��MC��¼�U^����,�8�B\���Q��{��aNr*�]�7ϭ��J0��������r,�َ&Rs(ۺ����(���t#��_|ɧ�����+��Iϡ�b^�)d{r��v�%:��V{�)�D!I��k�* �uH"b���IhV��B���8�Z)�� +1>��61�`�G�x�]�q�<j�{x�LU�i�efN�7��8� -�t8z��0��7?��-0i�����b��~销J ,=x9�����.S�(���9?�x�:��qh�y3J�����u�gw.ْ��7�.����`��c:������cYA�i���)e8^R|������}�z .;~�Sv8_L���I�pش����l/�#H�N��.�|^2;�G��2����`�jk�^4�9�x����G��|7Ί6�q�a.�ls��a�H�s�ѳ:��L�ki2�`�%����p�F�K�b�����hN �K|�H������"䞺@�o�>�&A|dxj��/���'��u� ��t�N���ܡ�dG2�����z�iCѭ/q�C���1*""7(&�>��<�`��S��!�f�q�O6��|�c����!�R�3��E��l��LYX��]���?V�K���_�?e���p��`��:V;ZO{_�全W��I�줍�[�Q _� �f|��)D�I9�S�:�t���bX7�m� �8���R�����LCz����n�fm攄�"n�2��L��@�o����֨C�m[�R�t���3U��r��k=7�;ƃq����_͌sJ��۩���j��1��j���CCT��vΤ�cX��/� ��o��(�W�$Z�k������!�Pܻqt�7����L���������r����ͪ;��F3��� ���pB��E��oԉ0����߳�� K�������_ �Ѵ+Ǖ7���r-oϻ��B�a�S�$��;ұ~��͍��@���f &��w�!N�Nv(W�g³����<�e����wC���mg�֝�97�uD:���� �کCdG�� �K�,o���J�Nzy�� �r�s�O��� 27CZd�� ���c���M���S���)8��IzD"3��0��5��> �*�Z+��k���E89�͚dhp�9�e������ �/+���\c4.��h���}�9�N�w�]E�L���RU�� ���4���>����8o�r���ϝA�&$���!Anu�n�嗜�_]!92_Q-O�_~ʾ�0��mdʋ�fLu���Ni�}Y�.t�&i�%�����Ή�n�iɤ���ǣ@�:38Lԑ���G���#���� n0�vBvx}A�����Q��-`��wQ��>^�S�|a:�ěy�Ț�Θ�`�Y`qХ~�����7��ȿ��G;��X� �U��1a)=���>��R�mLnN��4�2�@\�e|Xۋ��I>�t�o9�梅���i\�}i�-�����]�'iu�� � ����b$�5���t}��yo0(���N��B�2M��h�Y���D>�6J��dtv&Z�Q;�O*gGI.��{�[vO��r�\��C��vxO����g������Ԃ<-��9S�Ȓ��{s�1t����fH�0�B�k�����e0��Z?G�]Mh���e��E�L�Yӌ�m�P�b��m8{ ���";�g�1=u�(v��a�J:�җ�8����ؔk�&��|FXu}��(��.���(�r��EK^�D�. k#�*i<����`:;�䅏핂�&kԙ�o� �K�(�e�cҤ]h��\{�Dˢ̶�<L_r��.'2�Z�"�X�k��5�hq�6/ut����}i��׆Ww������5E�gׁ���=�X�v"��<�9��
Static task
static1
Behavioral task
behavioral1
Sample
random.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
random.exe
Resource
win10v2004-20240802-en
General
-
Target
random.exe
-
Size
3.1MB
-
MD5
24710bb2afdf72850a921abbfc35e065
-
SHA1
28adba2c9a6fcd63c651dc1bb0b2c623190077c9
-
SHA256
cc745d334b563aebf3cf1c866df885fdf1cd05864ce61c706b5209b79a03f03f
-
SHA512
3b4300ad1add38ff9aab78753b0b25a7c2bf0febbf6eb53dc7fdafdac8b9128313265dc8f3f199efa012c2059eb7f117c79168d803cc8ae8b13a03efb4778bf8
-
SSDEEP
49152:J7uqUqIgAldFgcTbF1PwVE8ydA1nHdj5gR0CZ7ntviq1DNGv2FwwM:1uqrIpBgcXFVvzW9jDcRiq1RGuawM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource random.exe
Files
-
random.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE