Y��;(�9C&��^���T\i7g��F���G"}�N��<��t��"��Z�Tk���K����>��-Ү�߱����ǙU|Wo.�����P�y�&c���}��(���);¥ٽ��Q3K��.���DH�k�4���xfJ�J��q l�x6��(�J��#0��&�WY]�Cw�C�BT%<����fQI�Z���B�#��4�&�{�C��b2N �{����j����?�*~���������R{)h�i��w��/鷴.�n)Խ��Ţ`PN��\"��,�b���AG3q(�p�,��������œ F�`���4v�x��V��ɢ����赚��"o<�]��zG���n�4��:���������o����:�(�)�<���vT�Օ�fx��F�����TJ��U�FϞ�����$��ގ�p|+��C�QZu:=;+p��F#E �@�ڗ�� ��I������BѦ�rI)�W�]���qq��L6d�Ŵ]�� �ϐ�W�@R���2�-=�*���N�K�W����c[e���<�Q����+�ѥI�Z^������"O�{�g�y\��ݬi���5<���Mw��&�n�.<ᑚ���zpGz���m�,��,PMX������ �D\46�8� �.[��&� �ch��@�w�=|� Yn�nȕ:8����|��.�М��B���<j~:������n�8�G)��)l!&�N��*Dde�\:DZ0�6��.����J_�v�5}W��w��T��a���>]C�(߱o�d�.W��°�Pa'������DGc���2=4�2�D�U�jێ�1Ɣ�x6Xz�Y�,���w��f��z�ejxg1�k�w�P���C�!�o���;��Ȁѣ��n�����r^DB0S����F�ݠM�L����ƫ+Ь�Yx������v�#O|F"�vZ�"w62-���00�>t�~0�`Y%3�h۷���d���5І�l:5$"��`��α�OP.Y ��_͒���Rk�c���t�z�B�o�\f���qh��ӿS���Mh�f�A�B��^�������ѩ(��ăxJ^(U%�xR�pX!Go�^lc@!v�K�J�-���^MWu�|�ϭܬX7�����f�� �;q�t��r�-�Ѫ|�;��W���6{�w�.�[\2�o�!�E��M�n�L)`L��Y_�$������Q;���������C5�7|����9�҇8�*�%b�)`�ǽ�f������Xlsh���$��2��\�N �s%[�yn(��x|� %�p����E�uY�.p�����m6J_����6Ő����`dؔ�^�?���ގ��C/O�18 >mG>�>��6��z��GfT0� ľ�[�cŷ���|�Pe˛FSez���3[.���;�a!Ӵ�*�\[�)K!!<`�aLd7B��5cA�E�,��^�Q�\�:J�!zƇ*�ٿ*�4cH�g<�%�.���MS��:��@Ď���qJE}h�i�s��s��DU�6�玉�ְJ;�i����c -C[M�,�ǭ4M!�c�?��:��YN̶a3�v�#3�e�̻�~1��a�~�p����G����q�~C�iX(��� ���A�h��8�_�4 �&�V?f��v^��/o��#ƙ1ʕ��p^q�6���q>N�@"=E K�-f�@E�H?5&/����b 7�JecPx�N��J81�� B,��y��`��B���%h*PԎ8��}q`��M���$��=P�]�I �oQ^�U�]X����i!�����.�`_ݼc�k@���>�k#�*�5�Oj}-<{��nM�[�I����88��#�e����;&�@��Ĕ��4X�_��d�9�2�����}����wE˙U��B�qn��:f�W!���K1���B�Ѵ�=���&�#]8�P�ɟ���>�8]��?0���7���W��=Oh�������F.� ��MX k����!��U���'�;뾣$|��� ��Y�20��>��mi>�q_���a��Q�c9!n�M�?~U3�ǃ�kJ,��VB������EŁ"pO�~XsU�������PLE�x 07�v/���/���r�m��p��X���Bto�4�1l��c*��8�~y<�mq~�q#�Z��N�{b���(Pj0_sP����%�V���X���c"���Պ�e$�y�d�Za��k��&���8Adp��a�A���O7�g\G�;+1����XB�k��|��<��� ��-��K�'�ӵ �ſb���I�7�E�$��3�4��AF�����%��J�hBL�B�F}=��Lf��Ч��)m��S:t.�pȋQkl�9_-�4���J�j�r��%;���}�oB<�.�)����\J��*���~�a�7w�[J}����֓T:��j��/%\{oLĬ�ǘ�9�]":1�3�!�N�M:�Y��Xw dL�_�R���u���ENϙ�`���Y��i��oq�T9�[��F�k �LS��T���*�D_���K@Y����SYԽ#� !�R`��jG.]���}�V�F���\��Ȭ��:n�aq%@����_;e]������*TN-{R�Y7���x�HT65�σ��G�8�O������Q�і��B��/�[X;W���/�S8��]Z�s�{���\�J}�8�;hvŭ���v�L�.4�_>6`��9ůِ0c�ug��_�,�?����!aiz$dhf~U���3�K��}o� ���è�#T.z;�� �%������.Mؚ��d��D���<2|�zd���ؓ�q˼83��� -E�V��˷�7�$���{�gl���H!(xl��4�*~�mu��, �JpD,5S���\a�� O�#�E-zW�(y���)�vY͡Y���kΟ���ט>TSu�"�ו�����ܨ��Η�q�o��J��B�?����q'��w��5��P�ST ������bb�NU��'�P�[��Y��(c��U��/��tG�hU�R72V�n��;n�(��I|�M���V��]���A^X|��ŬA)L^�ߦ1,5F���3a^-�~o\�U�����ɞ;�7��|]����s�[��E�n`Q4X��T1�-��w�B�_��g|/���SD�>�<�Z�j�,�1n[D�vH�(+E�.�`����w�_BQ�Ob��J��~r ��5�#�k �!����Wϊ��]�<�l]�ka�1zX�K�d��ۣD��-5g8#���e w�����Mn
Static task
static1
Behavioral task
behavioral1
Sample
b1e5ae60b20f611f5de2615328a12b702ae54a3cb7c43147d289eb6b1d83e323.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
b1e5ae60b20f611f5de2615328a12b702ae54a3cb7c43147d289eb6b1d83e323.exe
Resource
win11-20240802-en
General
-
Target
b1e5ae60b20f611f5de2615328a12b702ae54a3cb7c43147d289eb6b1d83e323
-
Size
3.1MB
-
MD5
3ab8112ec9caae49286d94518ac99476
-
SHA1
5c42a1824f0e14a0c7933b32236fb8e9badcde9e
-
SHA256
b1e5ae60b20f611f5de2615328a12b702ae54a3cb7c43147d289eb6b1d83e323
-
SHA512
d5c40b6538056029dbf6ceb520fee22f310d8613f07a5b919e92a7e11b01d31e9c2f09ab08c5fae9f9fccb8d32c415acb3d96fe20217d3951021fd1784ac20f7
-
SSDEEP
49152:Y/TfI7S9S8FZ+guo1wdV8Uh0GqyeYr42+pd7x0h3t7W3oLIlajLRQ5879/KB2yg1:GI7Skq+86qXm42+pZfLILRxo2XN4ng
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b1e5ae60b20f611f5de2615328a12b702ae54a3cb7c43147d289eb6b1d83e323
Files
-
b1e5ae60b20f611f5de2615328a12b702ae54a3cb7c43147d289eb6b1d83e323.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE