(x�n�L��E�>���"e@�t��4���"�$KONev����MXY�6q4+���s���F�e`���k�˦�㬱�VzK�����.y�Mӱ���B��*�|�n)1鳎�)'k�`rs ��Ԏ�n;�����\��\��C�2*#��R���y�9�GAb��>����]���9x�}q�D�Z��e��Hk���c��o���2'�0�w����&x�#ԥ^��ݷ\�6r'��^�?o�l,�����A�),����:�?g^ŊQB�ktNQ��p����#��JM0IӾe~��+!x�ju7��2��gV������-�E'�?�������%�E���WS����,��K��@��T#-q�U噤F�ͦ�ӗwc�eӋ%�p����5Ӂ�iȘ�A��d��R(�ʘ��6��sq�`wՍߵ �� |ه�t/"���˨���4��w��9����p�c��;J,�B�29�H��-#N̚�K���:��X:��k�x?�Z��ȵ{(��~o��gC���������dc�Շ(��NV@����a�I���hIg��<� KP�`yŵ�/�.�B�9��Ұ}˧X��|� �͑�G^���հ�_*`�=@�p�p���}����-������"y��"�'�c��8E����H�:��F �#�� Ț�ҽ�a�gټJ.[[���r�%] �^��fbɫ��Kx���#�碦���.�H����K�Am�v��?8�����ǒ����V���?��I�[)��+"������^�bOQ�ܴ�� H)�_Я{=U� ����-��~p~��k�b�.��_�?��ܗV����&��P';�������ܕt��snf#z5����I�m�j���B��I%��Xg�C�` �5��} >KgY���/���"�m�V9J W`3���4��9��6�� ��g�dU����fJOe*�5�NyP��SܺЀ,�,9�?��<��A;/=�t��5P��8{�Q1�×���q��_y��z�Φ0� Ŗ����.�y���x�����O��`7�f�!#�+�zQ[�,��'7HY46W���j˟��-گ�/4��1���c����y��GFYi� ¸����P��`X��!���m(���݊[�o��(�}����m0ެ�R�e����s0�qׁV��Q�˒�A� ���'��X��%�:Pv^Z�L����ԫ��q�'�:�B��nNMV�'a�~��pn9�}�Ep5�,���x�cN���4#�)�`�� T��O�x*�%r͖�_3����WB�@P���e'wj�)�� �Xy�|x���=k�����bd��Ͽ%t��z���Jg��!�lR(B-͑ЮG5� wJu�2��B��$���i�ɱ��fwF��"F���9�0[&��\0���+MK��_u��at�Ea�3l�aM����� h��:�~Xu[��I�������l�����4�����#���� �k (�����E��"MH4��E��\+���Z�ʭ�h��!E�r����,du��y���ݓ+���k��� ���jp�9q�qA��q����,�:�ve�¥��4���E&\V�����- 9g������L�PD�`� �հ�4pn���Iټ�U���/������4�X��,5�T��������)QG+���bcO=���ҮlF!�u{���F�2���JK�m��S�$u[}N��;/>����ۊ�V�����ζg*��ZȬ��`G�{j�ׄ�%�N���_f��gH���KӪ����2��CT�yJE�Ϥ��Y��1���QeQn��q��B���!�LJ��H��G������ğNK�&��@A�[� �8�����sV�-�խu5���i�����#J��<��G�aR1��/5(�"(�c��V/�v [>�6�K�S\��Ͽ��#zu�� i���g�KE^%}�L�JOp# �y�Q��0F���Ӓn��JSC���D_�*~�c2*�D�p3:�����S;����tƼ�����1Q��ײ�]\�{ (��>O��Z*B�̔VoE�}^p%������ |�������1��7�����h�C+j)�52В7wN��N<��3wY�G��;���Dd_6<�?���h�D��+�V���'��T����`!����"�(�z����C�1�$e{7��Ht"�mZS}v�0��l�V�������$n�̓ps����j�-�17 � �����I絥�����z��h�o� ��rWY���s����;�-Υ��:e����g���Sv�N���Dj�%��.H �vK^a3�<QA��a�E�<+��p�!$h���ȹ��,'h�Z�<��r�}{�� \���lr1mvj'\_+ë��[L.�p��j�;��GAJ�����ĺ��,q��@�&�HFF̛��u�3vo�)�飬�"I�jD*;=��LH����B�0'�?#������ ����A,�%@$x���/��z��!B�_n��� ��xe7��@c���,ja�˷��n����!F&��oo��%0-��땬)�v#�Ok�c��fh.h(&���W�1����Q�x9g���*p�?�,�o ��܌O��K�� �KPv���6�y�n����1�1^]`�{���W/� q����1�i�-3G�����`���Rd�79Ff鉧DR��?�� ,[�O*4F���b���H������X��h���f�{�sN�MK� �q�휖O���ņq��Q�ʻ�'6�ƓE���m�VYg�d�r�A��-0X�}�~ _d�ݾS�I�|'c*ܺ؞nHkhn�dL(������s>&3�I�x���)�穅�����0B�KX�C}���lѵe�e�_N�,����=�[�b�(d�{s�K8q�� W:����R8������7��,���� g2I-���B�?C�</�N��qe-�܃w��7��}�x�z6:��R����U��@�b��@�lp\�����o�*!�~5�?۲y�������Lp,�VqP�ǎ�Z��ܨq��<�Ѷ����I�j�R�Y�ZTߔ��zj.iؙv���d8�D�V��Ϝ4���9)��a $b������r"}bɟ��������R�aD���uL�6ܩ��;<��,Qy��T"�a ��oq����\K;;��3F��m��^7�"+L$�W�}�[���^Kq��'4g�|P�.�&���j.��F;��6)p��C:]�b����bKJ*�$�Fw�@}�v�]Qm'�j#��ߩ�8�r'��Ћy�ws?J��#|�̀Ua_�0��]�r[|s��J{�)I����t?3��y��sb�^�/�a��������!?L9���O!�����\DB泶DJ���6u�^$����PO���t�&w�E�I���B~=�)wU�br&��s�U<��Qb����v� @Z`Jb��XPk8�xŽ� ��Iϖ���T��4�3^�i ��r�;���Ɉ� X���.D�KC7uz�@�C����)��M�.�`�����o�
Static task
static1
Behavioral task
behavioral1
Sample
28661d8a840f756fce1e50713b94b4d0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
28661d8a840f756fce1e50713b94b4d0N.exe
Resource
win10v2004-20240802-en
General
-
Target
28661d8a840f756fce1e50713b94b4d0N.exe
-
Size
3.1MB
-
MD5
28661d8a840f756fce1e50713b94b4d0
-
SHA1
099f1ecd92d47c0b24099c06fdfcc203a767e6be
-
SHA256
7aafcde2226638b90444930cc84259526b8e4055a4d05b3a67e29fc28e071ac4
-
SHA512
79850d82702e3d78ed7699603ddf44abc5759267e6ddf51b9f4ef9112ebd13b16d4093ce1a0d220652ed11aee2dcc83aaa8103b08189c866e9e8bcd1db360372
-
SSDEEP
98304:14x9oOsNvCVcZoI5uLJGNBRo524lVsLA1:m96C2oiNBRo526VsLA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 28661d8a840f756fce1e50713b94b4d0N.exe
Files
-
28661d8a840f756fce1e50713b94b4d0N.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE