D����JfCz�$��I9�ؘbpqϼڐ8&v���������,��#)�Y@�`�p�w�|�W�e�P��W|�L���B̭ڲ��g�U���Ps6�P��.t�����L�.�����a�-+X�K�'�g����˱�Gj��ML� � ��'���}0�i3n����k��.��Si���Bo��A\�d�F��ڳ.n�4=5'�PH���[� ����5Eį�<Re���0@L�Ϻ�Rns�21�b�B_<��-�o@��Y��U&�0�<�o��B�v�"�$d<�粏/%�ر2�:�� �Gu���w����v�a��n:+���8���T>�p��Z�@���}���G!��u`�.� � ,9��3�D<&'��~���q����*��)d�-��#`O)��DT�PVW��_hc�A�]�@�:�N���&���Ms��g`m�N�z���J�U˓H���یW�\��+<�c����.Z#ޗ�����PK7V��{]E=DW�Mxu���u�,KW��%����?�7]�Ŝ)��^k5��E;�ėF�W���\{Cw����M���rbf���J��(��ry3���q�� b���"hmv,�6��I�8Kb�@G�)�4���u��اU mߎ�5S*�'����/Å���W�)�����Z�eAM��.�㎷>��Qbl��O�.f����YX�ܕ!�-� �}D�9���7Ԉ���w�?�8m=���`k7�@����k$�@ms'^�><�o�Ѡ�1q�r�洟���.���?o�x��+=�RgY�G�ǩ2�#߃,�t,V��R@l��ȫ���b�)�d � t��;8��ޘX��^m��5����Lb�<���v/.u+��=�wI�Ou�@����p�.E�R��|C���%�{UB�aQ�\,pR���_��S��C��9Xl=m�"��pwI�9z1:��"&.�hml$.�Y,�Q�������S}����h��91r�T�� �/�D�N��j�!�~ٽ ��}�n��$j�[�dT?\��S��_�i����!����$T6�tކ5����R�GN[z&w�����t��D�p!��0:��=�!}"�a\��ߝ!UA���#��W�[35��5,�[>���@����^�"�f��p1mXg�o�.u���ou�G�8J�A3����oO���Z>���Y��=:X�-"p�����Z,���Ś�cS^�|��.)�7.f�4�#ň��Q�~)j/E���x���٫��A�'%�f������N4�_��g���劓m/6��-�HNO[�ZbH�9 �@����7����O�� ����<Ȩw�j�;1��m õk����W�y�d��{��^P-�Ms�(��X�3�����(n����$zN��ܓ��g3J��d�\lc�8���/IJu�jf:?Џ��<�FQ�X��_go��(�V���nk�W�L�h[���Ыn����S�i���/;� �[;��W,�#�j��R"vs^��=+����J�O�s&gE��%�_rP:Z��� #������f�%�-n��B��4]��U=J�8��XG|NJ"'R"g���kK��"�(�Cc�'E�mF�~��>�|e�z���d�)],�\e�p��<���eJ5.���yL�Md8���4��%/L�۹=�o2� C��hO���-/f�6��P�S��� ��'S/���w'��k��lU\�� � �Cpj;_��I'�f,opo��ǀ�m�ֵ"g<I �'�Q:!5~�T�9�F?�{o+� �&�K�d�@qk4bn�oc4b���T[U{ݮ�皠��������QD�x���I{��i08�9�U~B9R���R4BK1��X"킍�!��Cz�l.(�/�;E�+�'x4���}Zr�?���^�pl��ӥх�y?��h�+r����?<^��daCf`��p�$��}4�cPK�>y�5��!#��4_���M�%w����Yg[�e��O���1o1و��-d�s��f�����>���!�+�|.�c[�������-��ū���~C���z�͡rɸ�3�$�PߪX�/�HL�����:v1 �>Pp)Đ���匃����B1�+�@�x�%�����芉ЛZ�ak��gHQ_�jǴ�%á��"��6�@3�'���������du߈ ���\��&������CXm�QY�T��81\DK&i�NО���C7�x��`�!��;mJ6G��o‰�홤>�����*�m8��LP��v46["��d�vX���X�7;�m̺N+\⯦\0��K���ǐ��1���L�N]�!]��I�X�'���l[�� �c����M�>;0������v)f�6�����[��������W�>�$Yڥ�]�b���Ci��ԆP3�4�t\V�@�: 3�5>j�o�M\�R/k�#�1n�|��6}�Z���2�bۀ�Ǯ����I�!���e����C���Zc�+��xʩD�'���m邨z��*�\qz��@��ή)C']{��I>0�6Vt��� oFM4������h�{^Nk�p|�~��lWwF?��� �� ���R�b��'����O4i�5H�x�M���ZR*N� Up����a����$�>QE8�Fቀr��Tݨ)Lj�gz�!���Q����sj7�k&'��� �}#,� �}]��n���%,���S��v�91�8��tQb��������o�u��Irs�@š^��|g\,��R�L��k5?��m�$\.7Y�̺h�㞅��Ѯ�%nr�U!S�[75�_�.�������%���*����o�)�7- I�܇�!���$�x}��a���"���?��f��=���dG�8�YQ��|]k�ϝ�\$;�k�Y��+��,�ڠI@x2P*ߣm;����ln{VPz�0����lA�q����B~r��,!"S���>q���7���G���);5!�mO��m��wZ�P]�u_����p�kv�I�m��QH���of_�d���D�NI������X)yJ����_��Ͳ�4-uT��e�I%�#�wl��H�=ǔ�8�Y���� .���{Yh��T��hB#۸���"�)#�L���I%��.A���M��puec���o�y��j 1�Ŧ�/8��c3�����n!L]n]o���_���`!_Ղ�D��k6��,x�����Pk�Y��x6�<�G02�JL9�{�`r\Kr]X;A���!Өe6%&n%���D�\&�~�zHn3�J�;CWx�H��9� �� Ia&��^�����NԚ�"{�3Ժ"�p������6����n�:�:eq�Y;�U 7� �y~�|��aH�������:��y{>=�!u.[�/qsdԂ�n\�ƞ������ܥ�]P�㮈���b�QH�~5�Y�s2J�[� �㸾%6�L l��-����\S�\�3�R R�6�cR������Dj���:�t�<w"��B��.>��B.�.J0��5�q���n'?z���Zi���J�2�z���e��1�-��H$�ܶ"�N"hY-�]ӂ��҄��_��E��D��|���%��@V��>���ث�cD��Um՟"6S��xc�N�Pf��Z5��uuR���� �d��#ЪE����T�oo`��K�LL��U��K��z�R.@�?�,��wg��坚�]$�2,b�*�?��0$D{���K0�B�p��
Static task
static1
Behavioral task
behavioral1
Sample
82ebec3391c43c860cf1950e342cee1b4a55f2540ba7cc2ca768bf570f1bf1c1.exe
Resource
win10v2004-20240802-en
General
-
Target
82ebec3391c43c860cf1950e342cee1b4a55f2540ba7cc2ca768bf570f1bf1c1
-
Size
2.5MB
-
MD5
0a59357ee50c8272be24168abcd09fca
-
SHA1
2f35f3dedf5b11e595e2cb9cbc036859313c1a3b
-
SHA256
82ebec3391c43c860cf1950e342cee1b4a55f2540ba7cc2ca768bf570f1bf1c1
-
SHA512
fd3549eaa2b07b241f7bbe205802bec12d5b4c71187122092d56b5026cd24b4fc5702dedbb6edf4c6fe43841001f41c785b394027eba034483e503b7888fb17e
-
SSDEEP
49152:LEKniSMiiFSa+u36JVlxYh520XSyBuMJYFmBNivrmcwV2KFb1jReu5QIUEQkodoz:QKiSMiYOVlxsjJYINErRwoKb191QIUEz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 82ebec3391c43c860cf1950e342cee1b4a55f2540ba7cc2ca768bf570f1bf1c1
Files
-
82ebec3391c43c860cf1950e342cee1b4a55f2540ba7cc2ca768bf570f1bf1c1.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 131KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE