h�!����L�Q�;y�l0��ܨK��&��h�ݩ5;+������ ��cB���g�֜D��@o�j,��a% �jn�KU�ٚ�?���*B®�S&�&�e� ")�oEUt!���yL;�N*���1�7���S������q?���,&��+2�*�����\��F�M��-��������(I@��\3A�(��`�s��<B4i��� ���[�R�)�i��X2 ��v\�_q�F7��q����|�_�x���M�A,�6��D�:���s�kGa���Y��͜:`���ݡv*N�A�,�Ok 7r��cX�ƶ���G�̿Gw�A���im#�;N�� ��]g� ����a��>��g�ί�{���89C����OZЭRQ������&R���H!�L�iMu)����}�����sV9`��]`�,��wG�Do'%/��q/ F@d M���8�"�P�<���t~:Ê�a�@'�9՞S��W��g:Z�����{�*H��N�U� �Ȗ���������=�͚dҞ���.�b/_%�o2��`T����$5������q#�-�E�z4~;p�s�v �U��"\�HF���O�Sl0j�Dh��O�!�T��<s�m�����cs4���`���+��e�fdJ� �(���y��bkJU�;�& Mާy#�5�v�K(h�A���I��/��G��,��rMm���3�Hz�FYB\���@3~�O5��^7��[kT=�������<����С�O�>������m�Q&f���O=�R��l@�n)"��Ƴ�mA0����Q(f�o���1x�Q( R�䤋��B0|�j��!t_�mg�#q�Bge�2��g�N��y��9����.����;� R`��Z��-�����8 �%7��u���R]���q�x3�ի۔���IȽ#k�#�8�DU0��,�'9��?�� �����Ŕ��_��.��!�n65b=FT�F��C!�#X���C0�.sE���ǝ���p1�����K�x�k�o�&U��\�%��.qŬ��}-F&_%��������vw{`�����D(�OL��3��t �qzcE��� Q�5ۀ���7X��^�)��"ģ�yץ��_u�|��G\9g?:����$��T���N#����������ew␅zf�c{�Ҧ�)��b��RYT2¸�踉x��R y7 #����9cXٶ�Q�X�3�4A�wY۲��i�� �z��Qȋ˥�Oxh���4.n���v~*]U�z2����魹��v��>�L�nZGT����Ĵ�o0:|� �dl����Q��t�Y���0c���dX�a��S3 �O�S������^n��x��b�Md%����Bi�9J�~���5�g2�L�F�ͷ��4IF��A&n6�k�_C�?��k P���}*�Z~�h1ͱ�'C@}�.�#*u�"D5�<酐���?�IO�֥G��O���5�Of5�:R;���5����a��sW`���購桞��n3�+��?�@����Zaƥ3��h��c뛺�i�><�y���O2x{�����<@���(�H?��,��c]ꘃӐ�X.^�B�dM�d�,ix���;�ч�-�$v��$TY��k��oǁ�N!58c�'�¾�&�)&/ Cğ)�����OG��I���&��}�e=�w��3k�ĸ�4;Sp�F�o�"D��Q�'������� ��Si?�A�]��WdD�����"��;���TǶ��fs�q�10�`����xa.��D�&|�`�TwL�]�NS��ơ�����K31'[�=�U�|����J~Ԋ�S��"�=�$l�'!� �g����� MʓGJ���#kԜC豴����ʌ�V%5X�(�tF7�٤�W#�?���x���Ys��.�䎴�� �g:�ݣ�O������3���VKQ��U��t&KttYS�ό�+r]#D��!���y�@YlR�vY,G�1�I�-��?�cP6t����/�`i+ȫ@�C���++e���{�T��TqB��>nR�)��b�t:a���-��rn�J�¾��O�O����T^:>��b\��_���ͧo_,;���G���_B{�6Jd�������aJ8�Ps����^��l��Q�Qy!~��E�F�{�C�T�#��} KW�cj�ڡ�n;W���τ��i�bJ��]�LN;j��3�G?F���B)go3��B~�p3��!�'_YcS���Uy\M����@���H�&b�z`���(է�\A|*�U�>�hs`@⒩����2��y�7[Ka�@�����R�@��ݝ�g<"gcRxd��q�b���Z��P/�<����1�?��ҋy���ڕF+�vi���?p�I�����Q��`����S]"崲Yk6-}R�WH4�'tއkkPJ1��K�ñ�#v�������3�Pcu�(2CZ�FQ��$���������?���,4��v� ֔�B%�CLmы}N��D�U��Hn&�dFGKxʒpj�6kL~�@CWQ��*e�����-h�M�{��-f ������P���_� 2��>������tk�f ~����#K�|0��Qs����ƾ������\uYӂQsU����0����ۆ��z�IwɕZޒ���.7��o֯�c�U���8r�>#��`��x�ˑ�S����lz����[/�a��,2��� ������ބAH������u'���DʑΡ\�q��]�zОrŮ��H�.8TD����� zhh=Ƹ^��yo�w%�� ���!�_nfV�������]��P2��&o=�]w��L��Lz3'a�D���qK��b^r.��N��,�'i6^������ba��x-x\�T*�C%)��3A�U�:v[0�F��£r�$i��Q�v��U¸�h�@��ף뚜�;��[h`N9�cx���xZ"����+���� �Mr.�ZFV�<X��������3w����%��K����(d�,����Q��5s��a������0�O d�hQ%��OK��1L����h��N-�6Iӿ�H5,c�vQ�^C6�wkj���\z��1
Static task
static1
Behavioral task
behavioral1
Sample
3be29d0cebd27841a56c0e782ddc691ed0ca6c6abf1692a49ac5f0c55314b435.exe
Resource
win7-20240729-en
General
-
Target
3be29d0cebd27841a56c0e782ddc691ed0ca6c6abf1692a49ac5f0c55314b435
-
Size
2.5MB
-
MD5
9a6ddff76d9ed6d19fc2cc35dc190d9a
-
SHA1
70dd7f65185b1102c937296248bf0fb5190f7163
-
SHA256
3be29d0cebd27841a56c0e782ddc691ed0ca6c6abf1692a49ac5f0c55314b435
-
SHA512
5ec7abcee9199875b3d88dd28c0060dff1a26e50f8e446299126d7e3f4f98b40a05ddebead3811e007a73e646b6adccff7a19df1e6e93fa356839fccd638abba
-
SSDEEP
49152:5bI3M0JQLJDNennR07T64tirErigaCAAzAZuCiBv4lwGwdgGkm6:5mKcnR07dtiwx5v4lwGwuP1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3be29d0cebd27841a56c0e782ddc691ed0ca6c6abf1692a49ac5f0c55314b435
Files
-
3be29d0cebd27841a56c0e782ddc691ed0ca6c6abf1692a49ac5f0c55314b435.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 131KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE