�mf�NtBҰNb�o�И�#@�;J��E"����*Qb�/\��#a��g/*��M���msz�5j��C�b�{F�٬��SN�D�O=k����1��'S�X�t�q���$J2��%뵎HH,\�՞���O0�$��\�� �X� ��8lX�Nl�#��C��p�H�]�ç�)`�1�)G;�o(�-m% Ռ\|5O��P��r�y���p�]|@�Nj��]�%�����-z)��)d��^klz��;V�0���J1�(���͍I7)f֞���%�H����B���� ��X����a�"J�r����*��~.��u '<�3G����3�T3�»�51V��<���xC*K��)���,�Cr %N��k���(����d`��i�YЃq�e#S��Ꚍ��hf�B�ּ��6���JkUNR��#��C�؏���~�x����C��t,���Fx ��$[b��/y�ꐫYd�?���Ӑ�5о)��^\�u�:��C���>��+1���`OAj��b�8���>̆*�����;�e4��z���<�e�%2�(NS����)ˊJ��P�6�^+�F2FQ�u+�&�����V�$���~"5��QZh��g ��h�R�8@��_��Đ��ڤ�+�<�d z��'��Y�Lp tuև<��+���6pJ��?T.���S�$U��a��Ƥ�$������\6�Űʑ'�>�A���� �t8��@���w�o�jDu^E���c���_�i1i�i���G7�G�m�m���ޢŋ7I�y�8#^Q=c��7��۟��ޥp���L�ϕT��J����Z�S�Gǝؓ���:���^��5�1��5Y� ��� �t��(>�+t�N��<�P1� |����|��ڛ�9Dȓy�c���A 3ܩf$�?\�R홱�E��l��WIq�\t�c�a�Bœ5�,��*a�9.�%���`!�����{S;�C:;F���AHf��� �Q̠n|�+_B�=�ht��C'N�B~����D�n%�pa��n[n��[_�}j+>%8/U�;�B�C'�i2~��*��E�5��t�-^����ME�r�J���jf�1�#*!˨��,��U1��8�,����>Ώr���� N<�NjM]u���p!�CGϽ��]������P}jAk��d�`�u�{�2~si��ZY�m�+@+�$/��&U�Hu��tA]w�k��a��`�>� �� �C����}A�\�W�r�J� gV�g�o��ÇJ�Jb�E�fLf�ce����Ϋg8p;Օ�@z�,���O0�6�\m����y�%���o��u���e�բ��j�*�ڲsᴞ!'��د�A��)���Ȩx�l ;Jf���'Օ�K����L�й�Pbd(��O���B3��u[�N���[�c�8o�§d��Q���O��,Ù{:�2\���B4��`�*���|4� |��v�ba���i��-�G��[ۖ�HL�F���@!�E»2$�hΟ����:�Z<�r�����hs0{�ji7�/vlV���x���(��5.[��y{%Ro�1������J��βz 1D�w KJ�*�b~>ײx���|nq��U���&�(��3@Ws�\��8�fN��HH����tW�<ɋ*����p#��u��1E�8 �)m�ӻ��2��,i�Q���� �����X���Y,�{bX͊�KD`���f�o@���;�i}s֫Myb��)�/_����@�K@_6�t��j Pu����?��y�^=��`��Y��=U�=m"���ܿ��f~�����x]�ZH�ΧYk�*T�N|��=�=!Ia L��4��'���@Q�Sq������Dq_ⲝ��y���;Lºdn�`]8o�M�rg����`tۅ��(S���)��@͡E+�t?��=����f"�������*�BU3���f"��c��f1D�g��}-���W��_ ��7 ؙ���� qQ3BY�76&�"H=��`����SIM���7k�ƒEm$�F�^��QR���R9�yb(�q'�S��{�N�6�r�0���_�XƁX n��'<����ʐU�K���}���Ƞ� Nmj5��IX��eQ���yB�h���R�Z9v��s�$�#��������%�����^��t5.��W����#e���/��m%��E��b6{���g�|>��c.��͝���X+3o���/�х�A���0,��!b\��q4��u�����6�Qb�>�%�����+�փ�m�������4�ouu?O�G�r�;�KO��O��je7� ލ�\����X���y�l�>���Bn����}�����[���>�>�f����R��7�������dݝD� �g�Jü|�jQ�.��%��%<ed2��$��s�+�J��yw>�kA�$��EO�T�olz,3�,XX���V+����C�'��Rpep}2��s���w$���4���,J&��Ԛ�� �f�4�s-X)�9������iVŏ���'s1�����U�_2x/�3Gr�G�ﰌ�H�kG��d,qΑ��-J�0!9�H��i}�p�ǒ�@֠��2�ԏe>�'����r�8QmU�1�0�14iNJ@����JZ����,��^�q])B�YH+?��/��e�<�5���]�@8?h�Ů���_�Px�nq�4n���[%��l[�tI ��G�T@;Ms����:Q%X6H��Y��`[>D3Oh���?,}����֝�Ʃ���%�L�G�g Ϣ�Z���$�T���p܌��2��!vm�tk�l�шb�)�0��H��US���mZ+R�?i���T�1������aW� ]����Qa]\yք� �ZN��5�J������ױ[�m��KJ�- l*)���C� ��i3C���>:[��MN_��[Ԙ�l������!��>���7潳�����E��ܴ{]��hʽ_�'�i�ZVX;�٫ �����ޥc����:�%:�:�l����[C��;������n���: �;���%�d.�t��<��Ks�^*f�J��<8r�^!���?�4nCKy5���gB�~Hz-�X��5L��݅t�[�$�tȣW��Ll�s��ƚ�Fg�E�(����5%�������jd����D���^�d �P��\䇠�?�F�9�Hl��c2}�d%��ﶾYS�#6�J��q��#?������+�Z�-Y�VT>�d*j%!b F >i�'�GvI�u7�qK�C,�� �Qv�� +�cT�Th,���6g��B�<t���"�7zZv���a�ф�t��/�����]�<48�[~|C�6B �l3PJ�}�^F5��%/<��~J-^w����X��)4�6��#Ah���=[�yEV.�-~+=gq�F7��}�s/RX6?���\��s�h�|BW�������2R�uf{�����-�#��,F-�nK<z���&�1s�+V g;+�5��K���~0�����*lD�A�I�!��I�0���_(����Q���cu���NʍxI�UT`��:k��o�#�9U������ڮz�b���S���
Static task
static1
Behavioral task
behavioral1
Sample
96690ab9676d4ccddbdbfcf607dff24dc9a62a1ee6bf9781e460f3ada4a5e88a.exe
Resource
win10v2004-20240802-en
General
-
Target
96690ab9676d4ccddbdbfcf607dff24dc9a62a1ee6bf9781e460f3ada4a5e88a
-
Size
2.5MB
-
MD5
960ed3f431f3cdd3cbb24d93ce5572d5
-
SHA1
c25a7ae7ca92d3ff63841704cb6e95bce770a770
-
SHA256
96690ab9676d4ccddbdbfcf607dff24dc9a62a1ee6bf9781e460f3ada4a5e88a
-
SHA512
31333575ba5d6ff4dcd959eeeb055a3e91ed40f4274fc676cc7bbad8f111dbdd894796ba279e01adaf08b3aa3eed02bb8c308d18c6ba0801c3f0ac64e2cb804e
-
SSDEEP
49152:pPSws0Pd7nRkaht/IKUS8yWfRE2RM2bwuk2kXTxOw+xJkPQ:c0PdNkER8pfRE2RM20uoXT6xJk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 96690ab9676d4ccddbdbfcf607dff24dc9a62a1ee6bf9781e460f3ada4a5e88a
Files
-
96690ab9676d4ccddbdbfcf607dff24dc9a62a1ee6bf9781e460f3ada4a5e88a.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 131KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE