J�$�?��.{W��5��NI0�o�s����/_%f�6,.t19��c��gI������l�T����[�b�-)��D��bX�x��n�~����&��z��[P�Y�1!8��T^�k��S��Z(�s��/��Ƨ��Zl@I"qb��S�����K���0F�����*���Q.�;��c@�4�x=vǥi���{9G�39Эr�U|�)�Fқ��x�{V�t{���w��Xu=�ܨv�l��o�ې�.1�D�f��z#����r���~� wMr�\^�p�rw�ɱ*�~T�`�v���GD�T^u�$�dS�z�v5��-�R��H�0��p�gm�%���a�g��=sq%�+n :��q�#�s���Zjs�,P����L�v�*w��W���kl_� ]n��Qݑj"]hr��2}���d�����P�M��Oe���B�w�C3ښ�G�cuE����]~T{Ymn.�;���g�5;%�� ��*%��0a\�/+�X�ј"|����e�8���pr�x��"�C�$���;hK��N��mՐ��Ҳ�U~/�༬���y��H��9и��>q؝�Ɋ���V�c�T:��� @�+��*��c��'�����I� s����Ϝk&��n_� r��⬵yM�A���aßՑ8���ﵭ<�8Z ��r�?�ʞ1�����Z��Mδ�.�s ���մts��E�01��?������G�Xc�s�,'�J^uq+ܹ�&wJ[��%o�&��Gj?��rh�Jѷ�zjJ�����>n�D�a�o�R��U8��`i�N0��Q�/`�"���6���A�f�oK�˜�*��m՞=30����~���P�����N���1݇� \�X�kBp�iWO�,�FF���y�۵�� G�q��2 �of��o*A5�EuBU͇�[�1c�ӻ��=�|3��^t��wxլ�n����f�U�t���ۧ~Ŀ�{ Y���]"~րɚC Tr$�������mu�% �^��v��\6��8L�-xV�ΪCpC"hy�����%�q)�<k��Zz��G�b��PV�s� 6(�x�32y���|[����%:��X�n�a�:|2�IB/?��`Z�Շm(�{]��c���v��,<K8��D(|�"V��c`葊j����?�%G��o���v�o�4�Ɵs%YZ��g�*#��`:h�������:�Sy��c a�Y����I��a�㵂�g8wK�x���ZDj�@�{�L�u�@Gl5����1������H9!���v�[���"�� '0����}�L��F~�'m�b���p^ ���hs�#XdR�u�q���v7^Z>�F �X?����y�q�6�7��o��T�*�]�&_u�k�y�z/���!�p1ƭ�w���j+����pz 1�=�0���tj2���"���f��7�=+�x�^�、�=��ȖR���F�\G����@qM��<��� ��]��ҹ�5���s�� �=1_�M�Bk��Ѳ@��dls>��g�5?n�+d������wq������;���&c6�� ��6&��9�ܞ6n��#(;�Q��Nh�L8���g��U#�:� �ۙ�W�����020��동�*P}�C � +���*�>��ij�<�|�kG�텖i�JJn ��d��E�1����6��&3�ќ��n�8����Fu8U�4ԥ7N�۸�{�&�b��Ü8Z;�8w�g����/��<?�ڹ%�E3�z�XU��R�&���.)3��㘏�Ɣk����b��L�4��ѕi�39tB�T���B� �9 �B�����[����rH��c"��^�PQdw��E�?#��|_�k �~��\?]vx���� �S��+5�v�D�i>ZX( G���Ǝ�A�zL����P��rnT*�@b�����87��}�XZ%�Ƭ��`d�{�����H<��l�I���?M���RH\M�5�F@�d�i �A�դ�ΈAZ�U<&���'p�J�h^�1��}����X�V�'��kY1�W�[r8S�q����|3���B~��g��?�7��Y{�$�>�SM0�ׇ����@�����q���������v��ڒ{�92�~�l��`g���@E��Kg��G=��|�2���N����?��x�m�w�r�:�l�%n�2�Q�������v�x�{$����jNR�џ%���"�n��ɟ�A ��X���8u�-�K�9��� ��/���g����x5ho�r��xދ=!q�,%Aɒ�*������_1�<�n�7�2#[0Z��ڲ�1T�.x�b-l����d� $�K�7oR���V��4�"�3A��˓��ǃe�e�I�����W�8+���j�ص2q7�������}i|q ԈHSEO����q� ʼ��sH60p�ALe���"�p0Un�Cr�aS^�J�u��˜z�FN����J�����-�Q�@���{�{�P���������#�0���r?>hb�";�Яx��E1�M'yRq��⺲Y.M��1���k����^QO�k����y�l��@L�~�qz�mt!N��Gc�&k�I��j��2|W�z.-Bo�谳q���?:] ��S,A۳��p��w�%^�4Q�7�SX�oV��g<�K�G�o���� ������ch�i�BP�EAfhY����BK��Ӈ�eI���p�����e{}Qq&6w�m�SW�t�|ў�i���gۛB#!�L�}4�G!r)�"�R_!AZGd�������|��~��������*�<��3��uA�[d���o�J�d�љq,o��,23ހ}4����ʴJ���º�*��'$��ɷ���*R�I4{�~5m�.�"��]Eό�7���`O(e���KKXȦ:.�nݗ�Zx��`��4͓EF���h�cDN��*0��1Q0��Ш����Y-hg���kr�y=_��?�ԋ��x����䐑��zQ�qk��·����ln��!��4B� ;�b�EC�����>.�v����3����%�7�t�u����wi�n�ђANMА�� �FՓ�S�I�C%��s��F:SN�"��G1�%�O�R�:�U`����%�)͒�(����Bd��ِ�����j��s/z��Uj�8}7W��
Static task
static1
Behavioral task
behavioral1
Sample
eb83c917e82348182ee72fbe0633558cb2887f7af126128ff7a6328e41cf26fe.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
eb83c917e82348182ee72fbe0633558cb2887f7af126128ff7a6328e41cf26fe.exe
Resource
win11-20240802-en
General
-
Target
eb83c917e82348182ee72fbe0633558cb2887f7af126128ff7a6328e41cf26fe
-
Size
3.0MB
-
MD5
a66854ecaa847d7b6bbfd4343f874957
-
SHA1
a8c31594faedb1f0ad1d0bd76e3b91f3af746fc2
-
SHA256
eb83c917e82348182ee72fbe0633558cb2887f7af126128ff7a6328e41cf26fe
-
SHA512
503bdf69599bfcae3897fa0eca7ad7772e26680881f430da8d1ee37ec90506a11fddfecdab66f995cbd723bf6137a4b5b3c37c87527dfb3363c9043a99f03bc1
-
SSDEEP
49152:dTWBiXYeuHVxTaapsgrdwngd08Ys2LPhLjzDuFplknpcR/0VJ131hsKoAfaXhLK9:+zPT+aa7ng2rLJfXmV1u131hqKqFKPed
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb83c917e82348182ee72fbe0633558cb2887f7af126128ff7a6328e41cf26fe
Files
-
eb83c917e82348182ee72fbe0633558cb2887f7af126128ff7a6328e41cf26fe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE