�^k��&O7L��[�GY�F��D�2L�M�EaQz��r3��^�.%�� C�0�rk�O#�b��D\�*�������ֿ/�[(��k�/���Եr�jP2l@�����_���F<���.�H�VMv��Gp}j�+X��sLI�V4�����+0�G��'-nIƺ���b��:�B0k�-��p���F��gA�S�����t�̾�`�Y ��=��F~�'��[��״VG����dլ+ITČ��:k��&�����V�&��"�YW��pG!�o�U[����U6Ln��]rt; `�j�;�!���c�߉zdn���7. /���,kC��Ϗ��H:�y���(��c\ �b ��p9~K|S� `O���ܕs��B�����+�$-��urc�����*�&t6�|1�R�*���^�_���$���[4m2�٣ܑH4������2��(m��$�A������(*���Tz�7Io=؏���)p�jF$B,2F�ح�q֭(���n~%]��t��Ѕ QoX�_ސ�������M�_��� D>N��9h=����b҃۫𩓐/t� q��t�ZP����cU0o5���BE��VQϟ��[d�M�/��?4Qr�� ֒`�+�"�����{V��<��5�����s�:Zx+�hy��B�o@��;��E�H��8���Ŏ����D�[әw- �?���o��^P�of8���!&y�K��2䭇�wS�眭n_kS��� ��N���f1Q������c��p*G�ɵ�rVeL��x>S��K�<�\�z/��]~�I}��gMf.�Xy�m ��s���� ���|l�zp�9h�����y0̃��{|`��!���[�A��O��eT"wR�7͋&�T �}J����������*o4 !�U��e�Ђ6 {T�D|���,������u�#��(�>[�c�⸁�f��U��i_*��`m���Ͷ����f)�G��j[�3�A�L�L����|��s3w�D���eNj%]uOB���7�g�C�J�5��'�Tj=ϋ���6�����%��*P����A 6M}2"��Qk�}!:�k��=����=+d�ѪuRt�;VezZi��n�#H��]�tZf�Hc��h!�|�IY����!�ԟ��1�J���d��K�ȼ�ps����7:�U�Ro,L�c�*��#��<w7h.�l��#2y%�N��;|���:� ˶y*�+<b�%����p�D�)���F��?���^��V'5��m�rO�~/�A-Q����i�u~���2�yM0�9ʇ��FG_�߶Ci�(u�aD�S�f4ϭ[����QՈ���$��Lpʊ>�2)z���"�eQ[Y9M9� g4��/��������cq {j"+�|Zi�-�SX�3��s��{犋�ç?�"� ��� ���^���ГQ�����u�Q˶��.������E�}{�?dC�T�ђA�:���VY���m�N��9�ÊD��7(` Q1ƶ�C�������G�]�UE�ix�CgĪOx 9��i)�Y\V�<��mq�7oU`waO��V�y���j�ʹ�8���Ww�K��Հ���s���}���#s�J: ?�z�}�D6���� 4;H�ԫN����S�I�;��_�W`0����s��e7�HyG*<�o�حz�ͥ��1��d M��{2j��ERW�����V$�(��A���������s��~r�̈́CL����7�s����"'�X4�AM��l�����]������l[��a �Y��a+�7,j�������+%B����J[��+�Hd&4*�<���ɰr�5����@��V]��4�I����^�wp���$M���F���Fe�i��+������?(E���Ϯ�T�j����w�^�%>���Օ��)O�>��Wt��0;�0X�4��4�� �gHɛ"�_Dm�r=�-�~�����H�Ծ�PHګ;]</z;��EWՆ��Z,d�����vǝd�n���e�Ix3X/�@*n��:q����#��g��.��w�*�����T%����~zI��8@A<ܠ����>�B�k+����tw����!g�x?,����<)����� �w���G�d�������e,kF�B��΄K������t�����H�_�f����y��_ޒ���B.�Kwx;̛�g�?L�Dň�ж9�I&Q���P�(jE;i,�6#iN=/�Z����F3�#c��F:��ְ�~�-쾼G�u���x.[[;��(Yu����r�R�K*��j��)��/a��A>�ZmGK\��p��Y��,�+��^�n�6���l:h�<4��OVv� ��P��p�M;�Q��w@*�~Z������N-�ݖ�[*�T����&�(�$L�O e�Ze �� � �7�Z������������Uͣ�lL� ��I�r.{�6˳�lg-�!3���Wq��|�ZW&��� ��q9�d���~�P�x�߇j������6qe���ֿ�~�J��~U�%��v�N����K�쥐�c5����L����`k�C�q�T�O�Z��[��r�$$loq��(���j�H�3O���|;Ԉ@f4���:ߣ��\�:mo��M���i�n�n|�~g�a�+'s�mL���1Ő';� .d�Ä��h��R����|W[7�����s -��2�z���Vb��� ��F$�`���9�ҁ�#���b� �HU�R �GO�9b#*F�jk� _�Z��,ɬ�ϰ����U�R��| bۻn �noW�?�נ���?�z[e�}*嗖y�dV5�ioG���˓,������N[Fai�e���o�;=��lH��`�R�r/^U����"� �{���^e*�6�ʊ�2#��=d�.W?5��`��a^�y��F��`k�ܹ��`TBx�>�ܟ�rI�/2��}�o"2.w;t�f���3AbwI��G����c��y��?�]����Wyר͒��$�r��Q�7{��*y�f��k�̎9���B�7 �Ё �r7����Q��G�SL(�`�ћx�_���Aù���>'iV#�7g�o���|��E���.�.2~!ά��КR���Z^G�H}ώ�"�L�_���6��m%q���lM#0��&�f� o���c�R��V�]!�i }_��0+~��/��߰ uq��ԃ�k���2���s(�jo�)�(��������=� 5��Z�{����|��4_$Ӯ�7�ǟd�.�z��&5��W����>aƼ��-�e����p�����B���aim�h��4�%��UEי��V�ߴ����^� бhx�������ͮ~?9y^��M���4/'NCIL��ȧb��{D�/��R�|μ��T"Kb.���]�D�y��ŜR�4kGg@w`x�~2�?�Niu�Kȩ���ʼn�p����$m���� K<U0����p���|���l�Il�c��@��� ��P��B�"Lm4�Ps��ɧ����d2VE�`D��
Static task
static1
Behavioral task
behavioral1
Sample
21ff13f252d862fa4af651b4185de3afd87d42427aee67295437b3f7da2c20d7.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
21ff13f252d862fa4af651b4185de3afd87d42427aee67295437b3f7da2c20d7.exe
Resource
win10v2004-20240802-en
General
-
Target
21ff13f252d862fa4af651b4185de3afd87d42427aee67295437b3f7da2c20d7
-
Size
3.8MB
-
MD5
37d0266850672f1eed4903ee4f4100ec
-
SHA1
ae649605db04d173f46e77a44dec2109496e8112
-
SHA256
21ff13f252d862fa4af651b4185de3afd87d42427aee67295437b3f7da2c20d7
-
SHA512
f1ad73be790f25220b509f24013a26733c485c07730a4fa8145f6f73380bda8b4c6795b5dd6c4062db04d8602548b2695a34aa99451c25d480c3f5aa78406f1a
-
SSDEEP
98304:eumfG8R6Th6jyE9yxX9ChGMdjVv6NCyPsn6QZ:eu6shItyxkjViNCq8rZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 21ff13f252d862fa4af651b4185de3afd87d42427aee67295437b3f7da2c20d7
Files
-
21ff13f252d862fa4af651b4185de3afd87d42427aee67295437b3f7da2c20d7.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.2MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 147KB - Virtual size: 560KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 10KB - Virtual size: 235.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 197KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 76KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE