�'ת��)FOK�p7��̥$5�6���}^hA���s3�j�����O��L���,���"��t���z�,�=q�k?�I6�5�E�1Wg�w� �N���� �ND��Sh�Ե�lNoq l\}_3 ��!��I�kd)��7�3����=p�TFG�2� �1!MWmږ�y��Ճ�v��F�5:�b���a!N�Q��梌2��Vzk�$UaE��w�����/�ʋ��_��&$���d���G��K�7�v&ތ�ݧ��ɘool���$�"�e�ú:�?91�0?l��g" �-�(ތP�^�י�SO?ɡ������hD�YwW�䢺RK!ԧ����E���_p�s�d�"����`OEE��#�̺���vON�{�"]9��C|1�B1�uIv���^����L��k��Ϫ�;v�r�?� ��{�I�g3�46=<[9���g_F�K�!� ����kcp�+B�����=i�䥾�����C"��hR�)j�[|�4�uKʒ�D���# ��y��H��������X�x�!D`b��v����An:�����D�-� �K�BM۟���|��n����P��� �C��A��Y��y%:�/�wn�C* 5�0���/qvz���U�1�9x}�Mz����phpN,�Z�_����(��yRQuj�iT�%EB�ܽ���#_o�GZż�*i� %����#���j��P�#�ǵ� pI9����22Ҍ���=R���{�qA�L�χڬ����lj�M|�;b�W�\�m��$ແ>���8�BvCqQ�71��������W�髢[�����P��z��z���w�t��GZ��%S�������I�������0���V�==`o����UA�6L�ת��s�Z� >� ��j�Jd���Y��\����6kڎ����%�%�>�G�wC��t�q���U����r��u���(�0���zo��z�IV���|�ȟ+�L�z.+e�~�����.~� ��N�t����w�ɫ73\]�^�<����L�i��kR�� �/��� ��.��� **{bm�a�i��L����Ċ���$9�i~�A��j�h�3EJd������*������N�,��o��.$4� ufDZ��z�X2�{_�t�"Vt�t�9FaE٧�~�?#��~�OtS�p%P5�&��ePf('�R��Ӛ� 8�YI���=W�ӂ�m^��k4�IR:V:~��/�C�Z�N��� �B_�\��S�<X��EF��4W�2�8��"s�6o����@��q]�<� j4}��V4Ot4:��3���e4Kŷ��p�_qJ�� �\�{&H-�WAB.iW.0�/�=��&��� P=@o놬%��G��@��J�_w����/ D%�����s���(�R�a�� ����u��|��5)O3��~�d7z����@�B#���ƸzZ3,�%�;���%p���6c���rI��?x��i,Ni�D̓l�@|�:T*W)�$<;۽n�7�� ��a��G�?�)`H��/yL�r�g���@'�\�y�j"�5��Y�Z��m�4yS\BvYۃ$u-�nM �zE����}�`��;���$�.m���}[L5F��TԐz�㜅�C[�o�Խ?Ǿ�!$<E��jW`�3�0#:=OKMw�tZ�#� �I�� �����]$ި�t�5*����4���h0 �w^l��������v�������,���V����D9uE���M���#5t)C��߉M�{��g9��ĦZgv8�O��<���Qn�E�)K���e�S�M�@x�{��%��_���d L�,��b���D]<��L}f�4�@õI��lF`���F�wZ�y��Ǐ�f��ĔM�w�9�q���'K5t��ţ|����8�6c�:|k�[�9҉1�~���\�P�Eq[�����1,mY��ڕl薱B�C�On�ї��˘ ʳ�D2�2OTb�m@��q�A�u������<�/ȯf�!"i����v�_?����D�^~@��VV�tFjS�h9"��d���y0��3?�a!��Yɲ1���[��$٤�!9o��h�f���{�T�n�+�IIrj���D�rK�߱Y1KSR�I���DЂo�x>�j�ӹ�v+���@���������?��b��;r��L=2Vx��r�G���v �嗶�-� �V��k�e�Ȫ����n4.>���1Qq�K��O`&sS�/�*?3�� �;����|�+��"`"h������ƗN�ϣ�e����|����$0:���3��y������f6��gZ��������Sm�v�s���d��q� �S;�Azj��h�<lT�0��:}���*�5�G�{y0�VF۵q9@����및˿�T��mhbb����~7�ڒ�l!骸bl��sݑ 7t�r^>����(��_HZ���n �x��)��=��I7���0V0���)�Ԭ�����3� ����q ���`'6eJ�ߓ�^? h��sc�e3�p#�hj�z����%|!�-�1{[I��������R�վ �&<ɩ~j�?�c�a��������8�-���7�R������b��;�H�(�P��4ᖉ��q�ܙ����Q�0K�%S���/�|��+�w����h8a��8���HS�1��N�ގx�=�P��h�Ux�@M�bA�r��ct�Ђ&R���k�G8yKI��p��Z��7G�t��)w�R�y�@�(��% ]#�!�����C M� �)�6���Ĕ,��`{»ʏ��pMaiK;�P9�����8n�#�̗XR7NG:���O������{G���+v���{�91��f>ɴj��Z|�Ӥ8+Ǔ�c��I�(QB�����3�~�s�`gu�m\�9�q�:8T����Z�� J>����z��qkG����D��:-/v�#����!��u&��x��0P���+�)6��8���qېi?l.�����U���PO��E�����bL�c�B�,ۣ�+��$��,Mw��}6V� B�U���a�M���|� M?�И�q/�X��R��>v�oOP B1��Nt}�=���^�o�lH�Z�����C5l� � �g����Ctn��F+�Au�;jwr�H�N4G �ڦ��e�������~&�5)[�$ j}���Ys�}6v�Ճ�Esj̎ �<��Q��Ұ ,�������6���������t�E�0�S.ŭ��P����s����o��xi��ك�y��g� ��[i����V#u~xRߗ�Y���B���z�֔c�*Ӭcf��ϴ�7��:~�p��q������kȜ��V����ܩ���3�.����w�ж�϶X�L�����-fy���h�Ԍ&�Mp$�m�>ځ)ٛp�����J���ћ6�/�UR]+�
Static task
static1
Behavioral task
behavioral1
Sample
fa2de824beea1f16efb72e4e4dc883665b1196e7c9ede4d6d130ff52a1ec0bc2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
fa2de824beea1f16efb72e4e4dc883665b1196e7c9ede4d6d130ff52a1ec0bc2.exe
Resource
win11-20240802-en
General
-
Target
fa2de824beea1f16efb72e4e4dc883665b1196e7c9ede4d6d130ff52a1ec0bc2
-
Size
3.1MB
-
MD5
3fee6951de76acc25c775827e927a9ce
-
SHA1
c6c05e0d69e21627643115a4fc564c9880f8b11a
-
SHA256
fa2de824beea1f16efb72e4e4dc883665b1196e7c9ede4d6d130ff52a1ec0bc2
-
SHA512
37f98ff191b372b1619da473051ab6e2de202df97bebe5461f562e6cd15372b1226cfd05b8e381883b7243eefbd9fb6b543ee747e360ac8327e6e9efd18d27fb
-
SSDEEP
49152:K2NehV8UBa9hRfrgP/frPCeIN4eI18yjtV2MlqQ5YIrbm/Z7rehFDfVW6X0ngiuO:CcAjCeIN4eI1ntYx/uvW6kbuO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa2de824beea1f16efb72e4e4dc883665b1196e7c9ede4d6d130ff52a1ec0bc2
Files
-
fa2de824beea1f16efb72e4e4dc883665b1196e7c9ede4d6d130ff52a1ec0bc2.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE