Q�����]�:����2�1b>�-j���x�~�j�uW��W��o���-�^�3�1�i?�i�� ���T���J�� ��d�h!�[݂����Q�������R��>E����P]u�C��qֶ��=!1>�[3`a��Q� �&Z���ܼ�Ե8�@7W��hMv��/1�>��gYs�],�k͍c�^����:�"��t`�FCº���G#`�o�q�p���t������Nު��L$��YN=���1�ȳ��Y��\2=ቡ[X�-h5�44$�9�A ލ���L1|q�$��=��r�2�U-��aZ��Kތ;�:�&(��L���h)v��1��� �g�U")������qZal���������_�Q�Ͱn3P�ЩHR��}Zt ��"�6�0��tL�9�̛@��2*����Y�����'�Dƶ��%�<W�y�g~������R� �'2��K��Ш� ?��!Q��ig�+�:��R�x<��a2{���"In���U��"�I�}_��/�q���-RbW��B�Й}�~6��v��.o9�6g�0��^3�!3�����{��e������"upe=���.?�V����g� ����V�fi���;���Vo:x�����Le}����~���+x�5����K��s`Vw����oCX�_:*��"sf�e�s�L.l짙�����}&m-!���v�Hl�<��7����mA$՚S��1k��Ǐ8v�9p��{�|���A�5I������Fc�3+MU��F��e�$��"�5Ç��c�4���p��[�k7�7�v�<}ݼ�����^�u��c�����g?H���q�s9���`����Cvҵ��u�9�@�i�����=c��C���h��,Gw�.|Nشd�N$���+��u��o�1���;��+�փ�D��QjDh�;{�����0��zK�/\1��և�-�^̄{e���5X�Gq�.m047�8?G0�����Zq�̵F��&��O9�ZW�gT��D���TE��B���>;����ۦW��u��JwO\^���� ����m�#� ��(��;E�4�����e����U�j�}��c���Е�R T��.or�ٓ�&pP��b.� �����F"����Qa��۴�I�XCT�,�T$l�{�������#����N�FK�>��֟҇r��Գ{L.�8����~G����7@��d�wo ��j⬐ -��J�3n���yǺ��?NJ᱐t�!׃V���\���ɖV~~�-��B�bd��'���RV"�Vo���*��L���9�Cwg��9 ������9���C;n��� �gy:���vT�+�;��V�� C�����0�E��U? z�L�����U���a?S�G�Hle7 �6{�$�(�u��r؏��v��^͖�?^TR� *�n�n�tG}p+fq�ع�-���%����X���@o��&�Y����l�����J�Ѻ�����6V�\����΅�sj��d)W��z<�нc-$�"����L�:���EK�?Q��Ē�-��7�E����n\ hi�h+���0v�]�Ⱦ��V8/R�#� ���kH���J~���-S�o�� 1w�Mv"�a��.��%�'GNX��t��i��M ���F�Tu��)t�B|���-t��&�W���oKo�^m#�� �; Eo�4�L�y[d�� nH��F��?R�wU�WN����0U_�n�uv��i�ەyL� h%�ȥr���R�w�Gs��|H�~sss��<7�S�qu�������݁�,�H]��$O]L�9k}*"y�da�L �'0��u/��4���t��e߂��R`cg�aVM�_�7ze��ҟ�>��HG��X����į��M�����-�A�� aJ!hc�h@��ۨ�N�&4�uf'�?Sq�Hg�|�ln���0��)oNg����H��A�Zu�zR��OV��Vҷ9�4� ��Z,�d�N�B���x<�g �;tnֻ��>r �Ȓ����l�hj z�#H��D>Bl 4����]ʩ7��X�?&ui�7S����n��1)AN�G/i>�L�L\%���x���y.Q�����+����=��mSQ�u_���'��"%V�[c�� ��4=e�:]�r��nȖ����B%�0��� c�\Wa����R�q(Lh8����7H��9��l�d��S�ZÍ���[���#���'WVF�0�r��֧�����x*� P����o'���C�#�"� *���zGV&G]��:^ eP���vL�������&�Eu`�"�y��eJ�[��C/8���0�d�Vi'H�mգ�4l����K�^�,���E��|I���P>�S�*��^)�-��QP��<~���`f ΰ(��P7�)ō����{��_��J��A�Sl[ U#�����t��p�R̕�re��gs%y��lN�4�/���-�k��詌$����9�� �毹'�v&���1���M4[r:w�{��� �����%����wAj��p���ʳ�z����>�����?xG?��02�dP���o��G��<imZtĖޔ�]����ߧ a�T��MQL�F���`�;e�������:����S��r~�ʶ0綍�O)d�G$�: 8I#��7��wV�%]~�ˑ��T�_l?L�iG����k��4 ߓ���,�̓�%y�~����̭���Wێ�������/ݨ�ԭ��5؛2a9G�]9 Js������:���p�Ou��U�Lq�������j��WNhT�@�����:��,XR'�S���*�Uf+���t~x��be7�Pz��A���E����]!�p#���\����9^5��夓���N=T�>��jX���@�&���eq�@ď�G)���u�T�><H�!���$��1�$��8H��M��c���7]6-��(�R����b�u�CsI���=�t�IB���5�\Hhn��xڋΫ�}iE(M�h���m���%�*W�`#Q\ �� ��)bE������w^7��$�8�O��h�џ��J�S���9� ��j��5)�K[g��{���}pj+/U�BN���&���/DY�����+�)4���T%/Ƨ������ y�N3�ʺ�oP=ʍdG����Ӈq:C�2-n��B0���M������i?�OdH�w�q;*.�ɳ����oI*]o��,�]Y�dCqR4cݺ2s�cAE�,d�<,�ͮ��ҀZ�Z��42 %G�4Q�?A��O]�F<�)���۪���̜� �ԍ�Ac��^����3��$X�z$I稧��ʼnO\*/�� 8w3�4��r6l�7^~i����R�<�o^=x��A��'���ۿh�{�`4�E���ɸ�~c���96�+x��)N�ƼV$#)^�XBr4&p��ޓ9B�o��H�/��Y���pY Uϳ�V4L��)/'ƉI���| �v5�������@����y���D�c�����]�������1k��7��UUb�܇�[ij�� NBI䮃
Static task
static1
Behavioral task
behavioral1
Sample
fd8e76f548c435795d07be297d2b23bf979f104c0e05078829061ce20b15f5a4.exe
Resource
win7-20240704-en
General
-
Target
fd8e76f548c435795d07be297d2b23bf979f104c0e05078829061ce20b15f5a4
-
Size
2.4MB
-
MD5
000b57a262174cf76ea2ba68be49c1b1
-
SHA1
24da13ccf827475453f311b5e4edc8d345b75103
-
SHA256
fd8e76f548c435795d07be297d2b23bf979f104c0e05078829061ce20b15f5a4
-
SHA512
4e90ba8a9871d6144755af0c95093f81b0de78b1a961782565a16eaa788b76bcc98423475aef9bb561e89f3a768a2b3214fb1a5a393126d40eb436604a11b361
-
SSDEEP
49152:NSz9mt+NLZmw4RQsd6fYsPabpYRJzQVdUxcS35IwxCzLktGjT5ZC9R:NSz9mtyZm3d63YYzzQVdUxca5ItLksTG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd8e76f548c435795d07be297d2b23bf979f104c0e05078829061ce20b15f5a4
Files
-
fd8e76f548c435795d07be297d2b23bf979f104c0e05078829061ce20b15f5a4.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 131KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE