�5*�Vc����\�,Y�@��@f����.ɋ�2� �@�!2�Df����d�G|IaI'9�����=����P��������0���I�y�l�: �&���dbaY���T.Y�3lwd�8�� �+"r���Ҙ&��d{��{ �%~N�����Еc�%Bn!�m���Ο��a�%�a�䨆Wѵ��]U�����f"�0�������˟nڪ�k�ȱe:�-9.*��+�㐌2(ɡ0k��l(M��ډ����{�9��Cc��"�:���#fS:%vjo�*�e7����.%����V���]���TPdz��ɺ�}�S@�FE�C�y��j�03��z��<��0@�d�d���U��ߚ�^#D��ܬ:kd�Aګl�Np{Ү� E���{��]�����R�1�wm����2�l;�U�_~�]��i�F����<�� #+���1�|dQ�@t-��@.l��O9n�C-r�g�����`M�6��O�n��_�����@k���J���3�z�t]���Ȝ���O���Ә��MM��{�j��D�2uɷ gxt�,�)�SAG�������*@#$�S#}?�� �F�lh[{��O�O4d:r�R�=�}0�8K~�r��Ww�����"bV!�T K�F|��T��\H���a>p��A��\X;���;6����{�ONۂet�ØgU��&���v�B���։\����*l�*�a�V�*Y��e�������" u�K2:Lڧ�w�?������Cb �����N�@N�;n�i�u���t�������ٖ��.,v4����Ƿ}GʎXY8ф�#8:��ѦU4f�Ke��$#�iun�-k�p��K.��Rkc���u5��߈vR�.8� �)9��e�DܗDaeo���l�y��qkT���u7��W�*5���y s^���ɫ�������br"�B����V�>1��_�}z6_��;���P�Q���e�G�S�g��(�Ի�G��7��v�Y��op�>�,j�4�Mm�ҋ7 rރ7Wqc`�ǯ��'�ss��n*�0P�b���ꈸ������eU1���H��zH���d�9�N۔+xG���kNF4�<�u�"��بH��N.��7E��!k� w��Z�de�����5�+9?Ԝi(�\�V� K�XP��7�j3-����Z� y�]�-��[q� �o�B�w���k�C)h�Y�}�� �L��I����ȥ���g�)���xS~Z���rv�2g��ȹ�߫3�~<�[ �5W)-�; gjQn �`��`{��& ֤�"����$DN�e�K�Zy���ֵm��j��4�r%Ó��K�TK�Z�3ɻ���r���Z���ݝ��s%�1�?���Ya�D��Cg2�����RM�4��Oɨ/R�}��R���{/��LO�R��Y�qF09�_ �����H���FYAT$qO�b��s��Er4�˅��2�ʐ"��$����S�z��.<Ҿћ� ����B ��<��9�9� ���;���E^͡��؍.7�˽*����^�B��n�SU�LZE�:f-�0��|c_�|��� �n�y:�ZGa���u���M��R�ס>>��֖>�S�ƀp �ی����*�4�%,�����He�W��1�ǔ;���i��?~R^�:}�r��YL� ��F<��r�cs7�˽W���W��f�����EZt��s�j"�Y����� ���0�군�ƹ�Yo��oD `�Y�z�EA�:lF-c�4���[��ρC�͐$�g�tE������CZ�� �i� � Ʊ~�� �~�������⋚��&�ĹbJI�{��g��-L�����C.,�t1Z�τ��q��}�G�a�{?��!����"K�<�c�z���fy�곔�����i>�H�{���aw�`֙Y�>�n=<V�{�e�b�ǒ"�-"���r4��H�s5��k ��S:�ڽ[6�&7�&dm(Gᆃ�J$��V�.���Y�5�i2�{�YQ쇑���ʰ�Q��ע��0�G1@ @�Wn���ʺ���ʽR&Ife�&�?��� �Qڦ""�"�32��&>R�:��p����EF��rgA���_<�Pv����8�L�� �U�� �ɽ1$FX��!K�zz������?A�,�oí��`�S2J�_��ЃЦ6�$��DiS���"�w: ?��ԡ�M��.���5s���w��g�9I cg�������z9%ܞ��ݡyq�#�V2��ԟ�|���Ә����P� ��f����'���?��XE�=���|A�ߝ��*-�%K����lZ �B�Ȥ|6r+ix;E�D*K��j��ߴ��l�Q!�ª��d�ލ�>�����n�a�5Kd�UF�e�.�7 �'��]�����M��>0��6:�;�G�n��g(�y���cf��FO�2� 3�Gwe�ɳ6�-a��#�k���IҴN�\j n����%Q�n?X������8�j�'�e��i�S�O�Y�=»^�x�&Y�D��c @��'��DrXq,-�،�n>R9���(�UH����M�S�l*��|6�3�D�q7�EB_n�G�i�j2 �M��������?և�AVG{��� �S�W�]B����c�N�R-ټ��,/8O�ݙ��gH_�m�<i��m�(�MB.��3Qɢ0�lέ�.����"��,ܙ2M�Qz��D7iJѻ��-�#�E�陷��]��@ �Y�X�g��"�/3h+�$��W��m�}�dkc�7��|�1R�Ǫ�h�)|� �0B�b=�(-�q��g8iE���K�����~?d�� %�[��ͯ�M��ħG%bC�W�a�nH��c�A�GӠI�E R �0�?�v�b��������E>�{����z"��4��ҮrÊ�;M^���w��9M�5�jɟ��z�Y��a�5�����y��f��G����g�X�E�aY[�.��.�9qb�K�^�Y��n(���v��$�ţ|�~����Qs~q���zpb�z�� (�W͜o_x�P���P+QC^�IT*���+���S�1��o�*W�T��)�d�C1O�e�G���+0�/�0��W5������{ܓ~�E>���W�uz�tr�~�:6��y��G ��&|��Ĭ���`���F:i��T{�!Q��H�?`fF.�����9���:�1��&�j���뒉�SK"�8uMaF0t��F㝺-Z���b���v���ڌ��[2�0^45_�DLH �W�������Bi¦�U�c���Øe�y@ʍ}���:gxCŝV��fM�V ᧽��Խ� >�ʠX���\�~�&���(�Vx�]9�\"t����]�W_X�YӡH�~�2�������6m+=�]�5�V��z�21$���Mh�t�-NΜCg���������k�{���Z��+3C��G�;��� Yt��O��_�'4�j �^��^��_W o�e�E9��з+S�-Cf� ��-� je����Z�f�K#8OcO�Q�̥K�~�ׁ���\sI���~|�ͭ|L�%���a��&���7H=f��ڣ���Z`A51�#���%���S��<��IB A *T@{���b�����Hi�M6~���J�Q���� :4-�O_;��t=IlR�S6��k|v�P�>� ��^�!�0V��^����C<� 3I�2�nL�JoY+x�� [�c�> �D!�hY/N�2զ�����A��0Yړd�3�����N!��
Static task
static1
Behavioral task
behavioral1
Sample
15b18ba1ec6630d410300f4b65bcae2fbe38130c3df71850e86af22d758cd738.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
15b18ba1ec6630d410300f4b65bcae2fbe38130c3df71850e86af22d758cd738.exe
Resource
win10-20240404-en
General
-
Target
15b18ba1ec6630d410300f4b65bcae2fbe38130c3df71850e86af22d758cd738
-
Size
3.1MB
-
MD5
6542ffced3fe8c6c0c59b13f4f7ed1a8
-
SHA1
5771f42f0cc8fcfce0c88963b978857f3ff50b3d
-
SHA256
15b18ba1ec6630d410300f4b65bcae2fbe38130c3df71850e86af22d758cd738
-
SHA512
e1c4b90909ca64d5d8a63f77e09dfbefabd189589bd5955f6bb4e5333def9d44be3e2c4c92d764e1a436176e1651d3fe25f41b27c382b6d9576ca98f889eed44
-
SSDEEP
49152:V0Zm2bomfHGdIJHtV3OT2QlRwObKyLmCLYyvUFsnh+hlYhp0WmL4ybyXqiy3iMZl:iaZktV3ORfBvfh+hlYQWm/bYNyySFgs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 15b18ba1ec6630d410300f4b65bcae2fbe38130c3df71850e86af22d758cd738
Files
-
15b18ba1ec6630d410300f4b65bcae2fbe38130c3df71850e86af22d758cd738.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE