QV��;���T�(��<ݟ�� 1"���D�Sf{�[eo����d���=�N ;}���1�˜ x^nh!'�i~��?���]S�@H��@�V9lR�B#�#�U[D��q���~���X@����rE= ���3[x����j��iu�%�KXQj��9]����2���tڑV���HG��T�����E�Ĭ\�0|���!�B�7�|@g/� �&���c6� �=����9)0o�@�(��&Q ���H����+rbL�>�����3�`yf.%���v���W�ڏ��������+d�H����H�s!Y�x����Dq>��D[�UZ���g���TPY��<��Wz��<�e�(�+7�>�������X ��뷦�x��2��s �{ܘ�b����_$*�����%��{�5���+��to�:$�cc�] ȃ�i�92�.��)��4�Rƚ�]j�it�� E��z���&� �.W3��� �ܙ�e�୴`�1.DW;(5��>�@>�옯V��w��¤�e�w�`�Da�r;�~P�|($�;�\|hsw����qU��|zrO �"�\7�,�UD�j���,�,*M\�pR��ȻT���C�V�Y�U�E1E-��(-PyuW� �� -����/�^*B>����,�0lqp�O?}t�z�X ��,lk��=L��mYȣ�'x:���DjS�*� ~bq�������^BV� ^��� M1w)�kǃ���G� Х��%��<L3�S�����zm�l�i/)*'���,0������D �2^�]��&���Z.���DB�=�F�{k����9���Bv��h[2ٍ�:+ �!�9�r�'Z��A�:�l6SSƱ?V.�$B��a5VB��!aP�o~�@�6�[�AA=��,{��n. �c�/�>L�zA����G���1I�M����4�<�Җ>���K����E�,+�c"�9N� ۇa���ny���������N��T_����Od�̬_E�ǚO����d��&�;熸�*��@���g�B�[]�Gmd`�/+SF����L�xb#�<t��5Xd�.���4��� e U0���n��@[ɴ��d��Á�G��2w�/�}Q��Z��ġ�|�iQ������� %NJ�9� �̹����k�m�\S�䭚ާ����eMT��A��.r��yT9ӝ����B7���Z��Jƾ� ϰ�^S����Y�G��re#1lXN��~����,�r��z>ݕr��Ǽ|Ymc.W9Kf�ɸ0cFmx�(��r�^�2������ #+����\@U���N��d���Ș3��4����E�";�5eoĭ-8�SV�Ը:%5-ى��e06�eQq_�@o}*x��\Q(��N�cr����$���m~ �� i�� -m�J�ߊm�K��4�:�Ӕv���h�<x���U���%Ue�/$z8F��$���^���/�_}��ϑQ��"5B�N�T���~�Uup�������՟F5j�٥�:6� x�]3�۽�pH�����Ap<~7L�=|@�[�۬�����\��ۖ]QA/-�ޖl���Pu[�����\�0����y���0C-�W����j��{��Gy�P���Ś拧�m��cD �����SP�1�>!�B�����f��m����"\��4� u��^3@�S�X����C_�*.�y1p�4p�����x�j�P{h$�e�d�Ԑ��mǔmn��ep� �+M0��G�n^9��O�4e�T��w��S��z�3�j�a�3S���6&��(#�قKMv���.//� 2x�����!w��j�9*��$�Z�!�����3��>(�'��o���K 7�Q� �WZ����pw&�����k��U��X��3�`,��"��Mӊ g�3�R�6'���I=K�3^u����������jMfS�5�5ҏ��G�e9{c���i�a �؎��t���OG�K�M���0����dM�� �8�7��$��$�po��֕gZ@,�/��z@5�ף+�UV�JOd�'&�x�|{�[aE3���'�:]P�qƒ�8������҄i)�� ^����h�){�5i�s4�b���y^,zW�/��J�})hz����u&�B���w���?�ê C,��+%V��8���&B#�ٹ��<I�-�p0O�}�{뱲F4� ��'��'���9�i/��IQA���� dCc�`!p��;1h:f���`;S,F���H�J���h|-��� ��<t?iO�#T���#hi�b8Gqɑ�G*,�SV�Kgy��²w7��Dž�3���ξ����,�K�����r�Q�0�ݯ��þ"ͦ�����Cb�\�jۻi��x�a��NPA�.�b��*�B�ف����S~�8!~y�8B�9[a�|�`�[�q0�����<|�Ӡ���] ��p�2��]�g��v��g�0u�Vx�l�G�m�T��C��=|�fd�5X[5�[JVJ�պ�CEB=�� ��Z�raљh�040��>�q���F�1K�W�c���u]N��{Z�V���,�p��V�\�Jڙ�u�4�]�c�a(7���� ovV0HH�������>�Q��+�e�L~��x�T�� Y��CH�����q�Z%�� =;4}���fb%��Y�Y�����k�#$<�٭�����y���N�w%&����e[�ayw���4�,� �����p �"�Thv�ރ`|M��ICРm!|KZ�/=��eo�ú]��Ƭ|�M�/e�Gx��e! !�/ d�;ty�ǎ䒷8_��(��I�Jڶ���+�Ȗ������XIB:�����?�P�;_,�O6��~E^>Qg�q�|}A�����B˄�IM�R"t,�-� Ǝ�긃.�}�ab}3�痪O&�Jf���t$DJ q�r� ����̭�\W�=E�LKÀj<�I `[���$��r|H��S2f���<}C��!����PNFe�Wwpy�)����ō>RD�;C]v$|��g6�ۆgRP 9?�'���b����ۏ��MYEΘz�����J�?���H�ӡ�C"�ueɭ傟�#��8/5�b�M�I�%�}��.��m�&H��A[A�K]ؐR����6�q�6��2�W ǽ4џ����/(j�fi[��*�M�qt$f�Z��iU�$�*e=5 ����_+��L��Ru��P��Y�u�$�`z��O":4\U]���cbbf��B��އ���Ҁ�-^4����<���-w��i��W��� G��ߤ�L]|a�-�+����`�鈀X�2_�(��j5��9E3ߑ��|l�W!�η�'̈́p?n���� ���5���/)�����)��$�#��:0vOɁ v� o�;�j@̊�w"_u�E��"*�X��v����Ȓ���z��� ���ؙU`I����Y"� ��A�Rw��)�J*P{�j��.�z�us� �������� ��1O�'���ώ=�|��{�it�#���V7��ڐ`K6�C���k��X��P����ʜ ��F{�E�UW�;َ�����f1�Sm,�Բ�t���wfM~-d$��¨<&��=��c/��b ��H�6���Ă��
Static task
static1
Behavioral task
behavioral1
Sample
651de3d9c47e59eadb563daea14ee8bda60160cc514d03b00a32ddb29716e8d9.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
651de3d9c47e59eadb563daea14ee8bda60160cc514d03b00a32ddb29716e8d9.exe
Resource
win11-20240802-en
General
-
Target
651de3d9c47e59eadb563daea14ee8bda60160cc514d03b00a32ddb29716e8d9
-
Size
3.1MB
-
MD5
23741c83a3d91e333748af0be9610d53
-
SHA1
fb2488c41945b7d8b37c3f9595939bf0549f9699
-
SHA256
651de3d9c47e59eadb563daea14ee8bda60160cc514d03b00a32ddb29716e8d9
-
SHA512
4450a4b17a762dcdc1b3cb1e32e6ff545f55234f333940c4bb5b158bc0cb9d2f45436bbda61c61d55cee8556f29d6b59b95d5b08120a4be50fe419772c4843cd
-
SSDEEP
98304:jhqRNPJ+L98Qn+mQYQng+dPZ5Zq/wCNaJDF:9Gw98Q9WZR5Zq/waat
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 651de3d9c47e59eadb563daea14ee8bda60160cc514d03b00a32ddb29716e8d9
Files
-
651de3d9c47e59eadb563daea14ee8bda60160cc514d03b00a32ddb29716e8d9.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE