�p\�������\;���3�y���;s���@y��2����nc�JL��D����j_ъ6�X?�����@�<�X���� ����c�j.�Kg\�6Ԑ���n~��[��\�ׅ���[3�Y&�Q�7���69ӥ������?*�žɵ��%��ǭ�� ����[8���嬝�CL�Hx��H���;z+ݛ��_=,���}�(�,�A�C������ˆ'3By~�_6?J�1 ���ĝIr\~�{��'��x��u��s��9�[�9t����1Q@�<Î�v'������5��~��zO�Y�B�� %ͨ��d�.$U� ɽva"�9D^��-��Ig�X� �փJ�;��эP�廿�;Ff�� %�о�S������,��7�^P�;� ~�`?Zl}����l�S�b?A1x�/C�I��llv�j�++���"��N�P��Dk��R>��T�$j�����}�;���E��c�g�tm6C�YM(�b��^#�i'b0��?)�ݯ+� Q?A�^�3�$�a�+�ʩp�۲��\�戦wN��*o@2��5��:���Aђ�n��Ox�sŷ��*oFX9;�����o�͛;�Z@�/���ƙ���\��P\p��g��7!��NZ2�thn�)��Χ��f�X��1&����ƪ�u� qv�� �T��(�%���4���$��̷{�T+����7qKp�s�KP������c|�xℰ��{�P9X�|`K�sΣ��蘻ŀh���BH�k|�*�����ĹCk�ʹ�{=�Џq߰@���&���ɫ�a���� ���9~�UVs�����`�"�J|��Db�i�:F] G�K#�Z$$�z"^���|��~�ɓ�ȍ�Y;����P@cG��Y$�60I̙��UN�sm����[�8�mh��R.�¨E-$����J�^��١��6[�V�B.�C��F�z��nWG�P�aPr��}9n�n���v��W!qQ'J[�o�����U��&�p#U����<�|t�PK�R: �Lppî4WP�R�x8&�c&�;σ㍺��W�C6��l����UwL�'RϪ ��[Jt-ӽ#k����������*����_��qX�L����B����XԨ�E�k�r���tB��a�H>]�&�B����%�R��|f�x��S=L"̶&y���5�W��*z�"I��G(��B' �GcD�Z���GD�^̲�^�P�d��Z Blk?&�S�����:��X?b6^�a�;c&�2�*Mv����߸�(~�.��I�p6G'�t�pP������X�b�g�����9t�n�)G��<=~h�[#�]T@?SI{ 3��(_�����"Aq�kq�� ʥ�:�+���S]��؏�����i�O�����H%���&��q^;-f|/:�mJ���9����N�� Ͳg��;���x����ᷮ�5K���N����y�|2a�$�$xʿ��x ��h�/#����τ��r�F⚅d�x¥���z�d4��r���U웈V�-��:Wv��*/NP����%%ۑ�e�8G�Y��]A�a�L#gC�V�p��[��4�f�RB���{�V������x�dak.�@u�.��&/��%*_ѩ�f|-\d1K�75�U�� 9��1�E�4��U�YS��PlE3m����) �������!ʰQO���v���yi���Sޮ�������xr9�� ��Y��B�����A�g� Y���P��HL�RSG�$L2����u�H�u�JUr�>?�q4�5 ^�ZN\�ݲ]c���=?��"�5O��KʟH>Xc��`�`�F��z ��Ѝ��Bz�?nfNf7'.�=$,�2G �3�'m ml^��N�������<+{[�W7gkh^��\p/b'�S@״]���R��6�I+r����%�tRf�D�R=Ѭ�5n���"v:�f�4&\�"�됨RW6�˿��x�E={���۠��T�����e�~�r�Ѝ{f���o�V�v[���KX�ݻ�_ �>n�h,덿���>툊rd�BW �vu����$���+��������Ih��:�U@��L463p�tQ�� 3똋�) �'lX�5��%U����W.X�G����>7�6�\ ����B�U�^�X"�@�9�+�:���}̫"e���/�,�olM�.�«��`���6��d��)��P���J�� 9�zpeF���Z��;*\/���1P��4i��t��>��|�$��rѓE�FO����䕓��f�i�;��e)�j�NTǫ�t��T�ȿW�����������LÌ;���������zO�˯_�,@�^LEn�4��%��'��ß�4��h�+�Pׁ��"��F�4�_c���Jzy�'F�u���"3�Pu�>Ⱦ���~�w ��Ȫ�����#��Tlk����X��c�ώ� X@ �] �p��F� ����AD~�mÒK/b�����s��R.`�WB���4*"�P�'j2(�hV���-���}��Pّo_<_P�7S8fwQ�N�4_"%ͼ r�h0�"��o�p�h��yt�[�,(��;I܅�+I=�)Lb��`�B�_pt+b앚�����RW��l�IBM.�� ͧ�2���F�Of錼���%Z����}�5'����/c$� ��]c4ʀV(E�������������@q�ʳ�A����-^���#h����F�� �A%3�1�M�ت�5�}4'h��R��L���� �Э�����o!���r�;�OD!�1������d�����vfF�s�C����\�L4ϩ��ʜ�Gh�.���!rP����>[� l)E ~ �X����5f�+��:i�q�i���`��f��b����C�-�.�9n-k�!P���(�d�2��6.�4�� X����6}���u7�8�B&S���FZ�r:���y�| �m����]�\͑7.���ɣ���Е��kgw�� �'F)j�9)��%�(y�ja`�C��T>{�ؿ�)�#�Q�e�J`l�b� �0lK�Fx�A��w��������@����� �N���M~�w���W<���z:o��L��S�;�Z�tƵ�j'�:�k�.��;j�,�0�7���F�zSa ��{N���,r�T}~���3ލ1� #fw1Ԥ���/��N({}�+ǫ�'3��ι���{7���3�Z�l�� u��~~��|ޑ��X����Q9��E 8��� Cn�u_䋹�k�>?E��]���~����0k���������� ���������J���������l0셜���S�b>�6��4���C�꙰Dz�.arx�~U�[�g�g�ǨA[���F '?�-�OQ��p�ܞ���fO�������՞P��;����jR߉�=��j4�����-�ԑ� �U��2�=�d�6�<�p���S�bۓs:6#�7%Z8E:����Lj@F��Sբ� 'h�߳hǁ�,�%,c��黄E�fQ?����ET�Q�*�u�{�� 0�=���ea������v��Cx鉈v"���� OV��a��oH��@H�Kr��^��j��Wɝ'vی�P�����uư�Y�(~�<#�"��a����U�?��R��M'5K�X��*:~s].��)�5 d)�M;��K���/.��b���x��ME�a���e7�b|�Є�l�6FPݹ)����}a�&��t���#Hw��K|��?�̤0@��ݲ`��2%�b*�ܕ;�*��9� lK!8��ã &�
Static task
static1
Behavioral task
behavioral1
Sample
e6f29119bedcc1cc7a81a834adb39a6ed16714618865e5b92acb4e03510665ad.exe
Resource
win7-20240704-en
General
-
Target
e6f29119bedcc1cc7a81a834adb39a6ed16714618865e5b92acb4e03510665ad
-
Size
2.5MB
-
MD5
14d7477a583b1493f7bf8d0e82692e05
-
SHA1
203a3b9837c0d13490e02075771f82ca3cc9047b
-
SHA256
e6f29119bedcc1cc7a81a834adb39a6ed16714618865e5b92acb4e03510665ad
-
SHA512
166184332d0ca677ebdbbe0634e4abccb9c4ebdd86a6d357c335f3614c4bfac6a4d4b68e4f50391a5eca8986839d980921e85a2445e940e1978caa6fbdfdc398
-
SSDEEP
49152:TS6IMW7KzRa4CR6A/hyoKqbT4YzGyYAe2sziAMppPypkFJHataGTG:+Vwc4eJyoKqbT4Yz0T0iWJHoaGTG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e6f29119bedcc1cc7a81a834adb39a6ed16714618865e5b92acb4e03510665ad
Files
-
e6f29119bedcc1cc7a81a834adb39a6ed16714618865e5b92acb4e03510665ad.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 131KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE