`���M��Q?�%G������i�����w@&�b�ś}R��ܥ��gb�`, G��8��n�����kFZ��{C:��J+�ȓ�%%��i��8��Po�J7a�O���β[�此'�$9{�*'��C*5�����r�]����?l�����z��� �s�4�_r��3���oe���.GD/�Rk���ag=~y�:G#�̎j��B�g�*~p�ܓ�)�@��|�W��%���[r���"�o�N\$�!7g����vJ���CL��2��O��}���65> ���˚`��5�Ծ���^�n����g����!�O�~�7�o����[������xN����/!U�?����v�M�A>�X�z�i���8��L�@M�v�5���={3EiPH���;�B`��%0i�i[��4^���ٵ��9*��q�=[� �:�I��]��1m:R� f�8�cW���B Q_����^Kn�%e?k�E߽������^㸯U�&y�4li� �0Ϊ_@�G��K���>�eϝ�p���'���Kr����kVx�1�'������kɡTTd��L�ڽY��+�����$���x�9��v�1��_o����T k6n��"�Lt�4u�$T�{��0��o&�I�C����WҐ����)�iҊz"' �FYBd�������A����k��O�g�Y�\`_[6�ʕif��yMὲ}\ë��L����n���b�d�3䱅�i:6G@���}���Q���2�Ŷ�PK��e��s�<�Q�[������t���K y���]�(�zap���.^8�.p{����G�jv�������'��zC�ܭh�X�j�f��): 8�v ��ɲ��ڻ>��ާ�V��(�H[':Iu$�'^2�a4�.�X��M�/T_����K�c������Z+���BAfu�<���EqC-#���J��nX�B��;��b��!� �c#s:⧨��n�E�Xq7��^[��F�Pc7���Y+?�N�b���2�dpJ��᎙^�ºdM��ө��D">��f�%emXsE�w��٫���J�Ɯg�ײ�=Jʑ!\ ��j� �� ���������L4�8�8��ܩf�<#:4�M�M>�F��D\��B �u3�^^?�ʝ~��bXȾ�,������q�玝 �G5F�X�嘏�_ ���:���"�����,~�۶TJ�K����.z<tަ^)�� ��,��W� �K�]u�˦���0�{ @F\�c�J���ɵ@&�� ���u��n\'}N_̃9����L��m��o�|LLI�E�lL�5�i/��z�A���o�wKI���q\�g�$�� ���rq�S@�;��]%����n�اЎյ��1 ���[���b.���62a��M���,�OpӚ��'��n[~'̫�Vr�p�>��/���B���:40�\T�<Q�k��nѓ{d��,��� t�ղ���ڵ<���xh$^5L��s=�/k��f��)!WE����tt��~n� ��{��-`�.<Vu��ez)�-�=D!x� 7�����5�5RGE�S@�\�!Y���� ��u՛�K$�� #���pq��{o��,_C�͐���F���x�ͺ3摫<ܘ�9�"�Z֬��w������U��T�U��*�WL+�-��9����ͦ�T�A��lw��ȝ,K�E-��Чk�� �|�f0��N�Z����jG�E�7��ޏ`�>���C�`����=�H��g��a)AuB�Z�^c]��Ȗ�ױg���� ���u�vy�{V�C�;Fyy���(O�SJ�@}U�L��/�P���P�15>2 Y�[sY�7���<<�Z�}\SB m!��o?���);��;a�7I�g� ���ڥ|��Ì)s��=���;f8b�ƝЏ�]^���/I� 9�s��oZl����=��.hf��s#�d��p�Nu�*���u�r�Jl��D"Ͻ}7���ݹN=�ו�G܀�_<g�!쩍�#B�n�3k]}�N �ѥ�Q3?X>}>�i#fID��1��C���sn?J�G�a$3��B!"Q��>(����l��Q��#�CŇg�zrq]U9���V\���.3^�]�}imác�L�N^�+�G�1��Y%USuH��Rp-�P Z��L:M�0�f��R��[�,��i���t�#A�s-���d�*�V�]�6����Z�� m� �� /�0qF��<���B�SϽ`���Àh���{�$�fv,4��:�.���q��{Ѧ_[I\]>lp�!O���Y����t�G�:u�U"1�$(p䪿��� �.\����YKG�ܢ��@ģ>��Cf�l&־B�9:HaED�s-&A N��Sj%CnB��G��`�����]e�z�� ۞�l� f���Ib��hX:"P�H"K�����^"���������a;�U�W1��U<{�r*i��ȱ%��p<'c���-���W8�X�[��ɴ�҆<*w�#F���+��?��Kf��U�T��q��i�Zo~&;��BZY�5_�";<�XLӇ"���jR��TȀ��g����g����&��^1ݼm"��.�vqm����?ͽ�r�����e��I�g&^`W�:�s�w�<���Nу�YŁ�.1�V����6�B�0[4�$ڭ?����X+j���E# ��k�y��y�@0k�ő��i+̽��!�K�Q[3mH<N*�(/�P�DW�tO�̄*o�~��{8� +����lsa/lDY�7���C��Xl��� ��8��h2�C%`��,�n4r2mMK��p�)�ʒ����o�����t\g1�E r97N���t�+�VO69.�@�����t�h�êm�r�3{��+���"j#������/���T�SAB�")��@"����D���zt���{$8]�$a^_f��Ȳ����؊��r)�9gAf(�o�}*�i�-|,l?i�#������Ǝ��r����'`̶� ����Y�ld���T�����@h��tTbp�b�\�PC����E�@Էޕ��.� w.����a�N&�����ćZG�n��Z�R��5+^V�O;�oS��ƅ�cK�WL�+,z̚���A�sBDd$s��qY>2 �j���\���} ��v"�*��r�r0z���2���j�:XW����w����O���g�̈́����B;=,�6D/v�DŽ�ܽ�9C;}�ye�jx{Ƹ.���������oq���{�y�t�����dKPA���s$S��3���Gn$�EZH҈$��Nv3���f��S�:F�'�9������i1�է�s2�G��E!�S�e+{����)�|�����]����z��q]�@�_q�L����o��8�������5����>�4����4[����ʵ�d�Jʃ�1I9f$ѩ�,���ϸ���*~�b�]�n��SkĞ{C�́� .�4�=`+2�4Q��X�o�.ɜ;����J�3K~�0�Ud"<����ա�g���|�^��=+���ITh+ �h�,���ޫ�����c�[e�Oq�9{ѓ���d<_�v/F7���,�G�սl�00�����Ş������qH���ۂ (�q���a�y* �ࣈ��q��^�{�dn��r���}����f��(��qi�X^������Yy(�U�m�l�-ΔT�b������+F��r{�����=��qu���6j� )��#�O7��Ӳ�%����u3 5z�6��J��=��M��G��.U�P'o�7�o
Static task
static1
Behavioral task
behavioral1
Sample
918c12d94b28781a74d87fb250d0152b62d5931370381703184f089b6c7dd387.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
918c12d94b28781a74d87fb250d0152b62d5931370381703184f089b6c7dd387.exe
Resource
win10-20240404-en
General
-
Target
918c12d94b28781a74d87fb250d0152b62d5931370381703184f089b6c7dd387
-
Size
3.1MB
-
MD5
7ff4cc99d2d1315971110051775dc383
-
SHA1
7b27d3316fdd5e1abdc14eb46246f7d36dfae28d
-
SHA256
918c12d94b28781a74d87fb250d0152b62d5931370381703184f089b6c7dd387
-
SHA512
a10728a4c1abc99c97fb820f898be271c4ec98b3c833b0d4675af43c2a1190561369b72276e90910cf12812f1bccc361b40fea7413f95ccb33d6c9bad88ed52e
-
SSDEEP
98304:JOhOIispPaSwm59PgY400/IeDHkwlqIl:8V9pdwOoNAeJl9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 918c12d94b28781a74d87fb250d0152b62d5931370381703184f089b6c7dd387
Files
-
918c12d94b28781a74d87fb250d0152b62d5931370381703184f089b6c7dd387.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE