AY�N`�*�+%x�*�/���?�^t� ���ƛ���,1���|�" :�WY��t�L��sj�P��7OŔy(Pլr��xY�+惾݈g���G�U���{�>����Lc�H`%F΅�Q#�pP$�6���xlUZr��+�P*��2/T5��#�0�v-�O��*�%ݑ�hU?�E ��W�����\(s�d�HZ� �l�j�?��M��:�,OO�:)��3q��*|�l�똢��`�peT�c�T϶@�����agO~ږ]] ����_�����������p�<���q��aI�1ź�?��_�@F���B��&���Qo!�~�L��N��� ��Z�M������j���E.|�m9z��Z���cKlYnY��<��b��81�FA���s��9��Oz��d܃�͑o� &���������#��}�*���ܭ��'w>� O�$���d�\X�D }gUQ�/>�{����o�K0�H���P� c�����N��F�,!ވ����E�^ �@ �����b�g "���x��^�)��10����W�Vi�.��s6�,���+���C�"�Rɞ�^�M�]������Se`���mV�`(�2D�������5�a���`���x ŕ��m?����[�����Al��eBr����{T]��oN�e)C^���)�O����-z@"U,|�'(�4?_��(�9r�T�'���3+bM��4Ŧ�� jQH��;l�x��.���h�PS�0�\�q����*�9�+������q�pmB���Sں�~��ɩ�Mi�۱g��j�r���XM�01�i�=s ���X#���8z_8V�aء��kO�T�%@��{7؞Z�tߜ�>��f���m��S�c����{s�q���kd��,��VG�����J����Z�qo�:��U�0;а�_�VE�{+��D���J�=R �D�Al8��p�ǫ�o� �)�E��������ZY�-�"Ў�̭�0"���T 0k�ys����X��k����������;]���K�4��@ �W��Z؏x���l:��d�������}zy�2�"C���Ds`p�-���kd�Gt��W����;"�?=zL� � w���V��b�8��� O�_r��?h�w�������\��bs�ȩf��ˋ�g.����}�Vq���|m�C�ݺh5]�����L}�c�~�Ä�l��fCZP%�ZX�;�{����ٞ�Bz�Ό��Ĩ[<H�� �%�aL]��� ����m1�A%b:K_n��S��ܠ�����Bj�<p�Tà�}�˅����O��QN&~3��I��� S���t��n���c��Y�8��̥M����@7�? .#Yv������{�*�[���ͱ��x7*V뻅�;V�l3�te�"��I��K[�k����y���0�1Z������T:j�u��5w���OR��2���]yn=oָ�t�����Aءr'utTB,�A^��y��`��(d0����#-���R�a����&��q�E�?N.��at#Vq�nbUNOHQ�!�8]��3F�0�4�L��~�ð���@eN�w�.���B�@J��N�?^�������}��5�p]���7-�3�2.�B?�n����z��-J@m�������[�4$t� �f����8�|�pC"~~���G�4�@��3x��{�w��@t�J.\�K�D����l=��<< ����P=b�~}@)[0v}ِ{U�����6�ETj���u5������\�dn��ĮBn�&C5�� �k�d���*5�����۳��F���V�?��S�R�gq'����@��PL�xH�E��f���gx1r/9���ؔ�J�uB(Lg�g5x��.�.����J�q�"`J���s����/�����G�4���Y��tI�d"g�jX'�dAG�A�y?��%m��*��L��w.�����@�`����`�3�_�D?v�=]��7�)�~�Fma������y�b�*�V������8cz@�KD �(�l2:m!�~�*�ۘ��bFeH��5X�z ���]��G�H �� &��1��3$��q�G��$�)bn`���g2����^���x>@���a��� <�j���[��U G����S�Y�nh�9y��Z �;�t�7\D�5Fx$ P�T&�y�]3��4�=,}"�'�^���.�B�Ew�%�j�D�>-^t���Ru�t��,�v��&y���)��'� Lɏ�cB�)]��<@m-��<�-�D��3;�3l��c�9,��ʷUgy9�~e3�O���А>ƭ�2�wS?�w�5���:�it;w��� �٥~Ϯ��3�u�ߺ��ƈ�D��6���)�@���)H���C�>B����Yn��ͯ��p0�P��h%lh�����Ȭ�O` l�#��(�&�-�-��4>�wsyH�� ���Dі��ܷ͕b��<ܖ��Cq�Ӊ�ݗ����_*�o��\��"��@ K�u[�Fҹ��}�~s g���������Km��: ���(���qL����Ԟ���s�1PB2dX�م�_p��+�������0K���Vx��Z�Ы��g�(�쨑�i&�����p���z�ꄘ�a(d'�N�j@XƩ�J�q��u��z�iI��L�Ʈ_��{b&�}�g�B#'�Ҁ�����N;�����fUI^.�f�Yb�hg�Lv�U=P(7�Ӣ8t�-��̈́�yW������������ � �"}G�! �f���l�_�f��R\[}��i �KMB�L�������Ǡ�HRue����i�b�i8�����s�w�@��t��]�şL/�*:�[H6���1��Eτ �~�bL�,�e�+G��Kh�i�5"�jo��Wi�՟��KeCա��'n�Fk��,��)vα�6��~�;~�B��o������̑e^]���;��s�����At�e��Sl�� ������D�:>�SHX���(��_��yž�T��®ȟ�d��z��Q��K�g�Kg^`8�C�G<��r�^4,�J_�����Rb�uh����N"ثXb���v�m����4ue<>�,�g7�A� ���hQ8gc���9�a��U���H'8Z�X~�n�-HB¤�!.>��T���.z]CjN��u?E��q�� ��G���/�k�U� ˡ#�-�A-.�y s�T<G]�E]�|m�[�y�}Gy6�b�xGq�DM�P��\�&�V���rwa�����bQ�b��k�ذF6�Z��rl�����ʶ��4����ǃc���Y��.D��|0d����խ6C 9X߄8I9g��l����m�e���Y��7i������K^��/�$~\]�q�8��9Y3tmR`����t��MD-A��g��r�~"���npZ���pG�NesT���tC� a sn\|���WD8����wgI��e:��7�\�1{�����xn������'yo͕u�4W��ϝ�s�L�q�e7A�V���O�,���$�W�V���)��;��OjJn;c��x{ ��ˇ���Z0��$$�u���98�@���}�TU%��>��NM���D;{ll7C�+�{������8o���ý�蜻eH1��;��+Ļ�Uʡ7�B�s��AՊ���5��w�^Zy�#�H�~�i�d��6����r�=ά�'�aě�GL�M~(;�B����8���ݕS�U 5�8���=h
Static task
static1
Behavioral task
behavioral1
Sample
574fb98b7d36c82b569786dd8c28df13d6b0997f1b091c0b1348e2bc15a57b1b.exe
Resource
win7-20240708-en
General
-
Target
574fb98b7d36c82b569786dd8c28df13d6b0997f1b091c0b1348e2bc15a57b1b
-
Size
2.4MB
-
MD5
58fa3ad9a82be07a1a53785623ef5296
-
SHA1
696edea47290f0ecf0e4fa0120939d3fd1a324d5
-
SHA256
574fb98b7d36c82b569786dd8c28df13d6b0997f1b091c0b1348e2bc15a57b1b
-
SHA512
6e4d09f70442288c9d2718be67caea7d7cc709a4a67a2af3f6dc692732dec8ec7170fab2d43829a53898a25a7c946cfca608fe45fb20675024717108d4271399
-
SSDEEP
49152:Gys5HVM1SeotDGCoYO2HuxhsJfW9H9OBUkDJi6WhF:B9gDToeOUg9O1DJi62F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 574fb98b7d36c82b569786dd8c28df13d6b0997f1b091c0b1348e2bc15a57b1b
Files
-
574fb98b7d36c82b569786dd8c28df13d6b0997f1b091c0b1348e2bc15a57b1b.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 131KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE