���*Y�{��?3��"l(o������st����%��o� �K/�:K�AL>9��ܚ,�boU����윂�ddc\�1�j����`���A/|b���W���ˡ�;�UGY�4 �3o����=[I&!ưٺW��@\X�Mu�Xe�G��_��!#[x��y����}����?%�ظDۄ�p��_��y�p�d��w���-MI���0 ˮ$�bp1nyŶ�Hu�C ��e&�,�w0���]���"��` *��/�!|�^K%!�(�e�4Ŵ0uQz[M�'?��wshlT�xq��Wic�Ȟj�c���k�R�F8��O�g:n az��7=�i���e<K��&�l�[�ƣ��U%=$���G�[� .���@���ֱYp�7�B��NQ���z�k9Q���`��ep��<��u��v c)δ^��'M�Y��6����;C���[�-���~*|:߷$��# ����H��l8 ��~3�#�v�jƨg����=�w�7��q��R_9����A.�M/w/V�E;��U_z�>�,.��h�"�<8��ǿ���� Hآ� =6�hL�R�a��o3�K;�����U_8�`�K�~e)��tO�2:n/��u*g��\lN$2{MZ��l��<��F Q�^�(���a-�4��z8�K[c��� ��ނ���1Z��œq���YV��;{�Y⼬|��.ZvJZ@���T�H�O��f��R����t��!cRǥ���z0TE����]S���������V�*�]O����p�k1�De|���?��r�_ўАw������?�^���|{��;�CMJj�!q����W�җ3�Y�-8��v�X�$"��C!�0�^��ӫ����H<{�����Șc�Z����`�f�ҙr0�V߲�m���H՚�M&~1�G��LO�0$��h�'�&|~xޞ!h��;Y��b���Yc�IXz���u��a� b���G�1��xӏ/*9�w�O�>&�A�j4�Zpp�rC�[�zM��nSiKh�/i��{P���-��iqz���������y��op���Q�e��f��$r9�:��^��6`u�y����P�P���5��}��r��KrrOzc��MA�[���+Qq���Dd�X�^�u�N%r��K��*Z�6�i��cD��/U:P�5��SLwv���l��ž0=]9A�K@�wc�_u4"neA/R5+����M��(o�m�����.� ���Tf0'��v���Q�`0�d>_�U�g����P+a���jy%� �u0[!��<<�h���ˍ��-��9����7 ������'�u�0ͽ6�)e�̏�Ɉo�F�#kk�=��4{-����d;`��&%R�y��g�'[4.U-8���M�BHF�H���� c�h�왜q|$"����]��7�;��J��mY��%�D%�� ���Ɍp�$���R ����|����T��ֽ�e�Cd�*;��<y��{u��B�L��z�q<���U���Z*� 5nޝ������}"����|�r��#c1���� ,��MXs�["���:����.l�';x��x5�˧�[�C��h���u�`p��.�,���SkN��/��u�������Q�ˀ�ݿ�"��U�z�EeNN��>_��A� �|0y7Ό��c.�Pmu��j$n�����ki�s�c���c��fe�3~�-�C�Mk�Z5���|IȹF@�<U���i�B�)�T�?ӫ�wŦ���-�ʈ���#�A{m���Q�N}Zp� �!�L�u� �'b7����K���P� ��P2� sa|C�\վ�1+'���������Z3 �;����Zs)�21�N�O�ֆ��"d�)m�LG��-���Fġ��KV����T�g;��EuV�"J� ��>��N�o��;P~��b�D Iq��o樭*�p�_T�@��K��u�~l(�R�G�O�Q,i�l���|��ό>�Ϣ�&�l�k�WF��N]�d,@Dq��%e�w0[�l�m��t��'J��l�!.���jg�A��w���g���ls�$�{`�4_s`�u ��m@�5��b�+��U��5��h ���t��u�����3[>�Rc�އs+����վ��� �0��@�I2.f/Y��VՀ�ϖS�9h>H�%��9����_)��>@���]v�U�]|�f.���r���f!�/���%�> |����~��yRXNi��#��X�w�+� �9P�1�9_����+G+.��~&/U= �@�,�{�TA��P�����u�y�~�=�L{k��q�eA�x��X�9C�]��$_a� ?�.��"����d���6'���M�O��Z"S�{@}-��d�p���]~���h=А�V���D�)�6��mG�'�g�qp�n�2����OFI�86��D[u����&�^5֤U��@�un�MH��z�p�6��_��@i��:�ܩ�:>� f(����Aq��� �%�������H�'t�F�<�IK?x�����y+D ��b-����V�{���ƒ(���ZM��n�Uɚ�h�D������U�� ���u�*漻�mS�������M��ަ�3���*�?��hd��!�� ��Ax�y��A�L�mқ-�q@A�&��3i�*����{KU�Ȱ����bQ�#D�\����)i�%į���r����E��=�}�� "9��g5���2"B�p���Ϧ�����[ �:��D��^������`�!.����%�[��U���Z�7^k_D�����G>(��ߐ.uɷ"��B�XUV�FA�ՂQ�g���1�/������6b��=Τ�Z�~[D*?�HUʱU1�'�2�_����G��Q%z�9 n}�:w�BY"F�# �N�{3d��� c0(�i*�E";���Z�m?��%909�����Ϳ/����M I��=NcETi�9�����)�t֜� :ⳗf :vS���S���l�C�R=:}G�C1�Dd��F��e�ז`���;\B�hy�;�0=P�P`�l��CsY�O�0"j�؝�'��^�?Wm�7��ʷQFA��+�͕ ��� "$yDr(�$�չӧN� ��s��E���i ��p̥o�EK�J{seUʌ.)��U��g�W���c�Mv�5i�h;5��͡�eVrʮ���Q�ܲ��z$���_���#���\�r`<;��m���-?�F�? N�c&A�>�|#;��e�J�~�с.�PAPPxpFw��1��ӄ��q��Q�DU}s����R8+��:���J�T�`{w������2����pG2��tF���_�u���R;4.a1����BR���݊^�<�:V0�057�:�����t��8��.A^�T��3��@�#�z�r�*����Pϔf�<m����v���c�8�������N�������*��&R��ta�x�|�#+�֡�S��w,嚖h)8�<y��ȾA^1�)�w�~���4Sl?0KP������;{��H��`I|N˗�e�.�e�f� �]G���6�����(Ѻ��hH#��I��M~_.��bS�V����!�6��-�
Static task
static1
Behavioral task
behavioral1
Sample
95a742a546546bce1590d9ac8cb15c5a681593688133d6d92680bbf9ee299f36.exe
Resource
win7-20240708-en
General
-
Target
95a742a546546bce1590d9ac8cb15c5a681593688133d6d92680bbf9ee299f36
-
Size
2.5MB
-
MD5
d90f73c7ff1684b33e76141951e709a3
-
SHA1
2508afb0008ca21997a6bc449fb7feb48529d941
-
SHA256
95a742a546546bce1590d9ac8cb15c5a681593688133d6d92680bbf9ee299f36
-
SHA512
96620a7a6a4d8781caffe1733107d15aaa005944e75f434c1ee53a5d0ce356255e4f8b688aeda639b70c93503cd0925f2b9c1234fc1464f17478d97eb84ec724
-
SSDEEP
49152:ZQGYcVhpnz0dX9ra5tz+Len/Bg4hnxYLCXX6yR3MLR:ZQGYkpnz099W5tmen/RJZRER
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 95a742a546546bce1590d9ac8cb15c5a681593688133d6d92680bbf9ee299f36
Files
-
95a742a546546bce1590d9ac8cb15c5a681593688133d6d92680bbf9ee299f36.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 131KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE