n�7l�p�[���:<��s��[�2/�� �ਉM��W�л*蓐X���2 v��*B��k�����O&%#��W��p�h�Q��7���U[l�(����q�]���ƃ�v����$�Nء����G��W��1ʳ����b�QN�X�Je��(����DD��&nְe2VU�>Ȅ���Y �ȰNKOx��{���0fv�To��S�����v%I��Z9��i���Φy�.��35����I�����B� -k�uf��_۽w���� Ҙ����M�>X�A�����u��u�֭!�R�z�*�4��� �N � b��nZ#1W�K�8�v����b>�ãAxT h��ɒ�C1��zk�����/EK���^0�VAJ�W��u{�:��F���_ ��������0_���y^kW)9C�z�hd�������,��G�U�'Q]���{�y�M:����P�����E���m�>{��j�Вq� �su���gMR��廰Cv�QX���g����������k>�g8>����TE"[1���$�ڳó����[`-X��݊0D��f�d�}�8�D�Ҿ��<�{2���䨀�|�;E�Fh]p��1jMn)&� 3wE��7_6D5b�b.���̔ ��Y�Q��1�l�<�T��b\�y<Z�����ٟ�T�;`�Ұ[���0�-/��� ��Űܗ�R�"}H�=���8K�p�g%bŧ�`Z��{�� K�D"|8M�A BP~��Z�=�F%tK)�?H��m���M�/��'i�%��ЛK�������c��ᥠި�� ϔ��a@ᤞ�C� I܍���r<=�:�ڋ���Ǣ�_ �a�M�v��b@\n���\vGp#A<�Od0;^�Sv���0,F]`����`n4���A6�T��ij6��E�a5Gy�z����iU�1�����T\����e)4 ��p=�:A�H�;!a%7� 6�U�Ϙ�eK��|�&ƽv[�P�e�e2T����|˛a��Ş�"��^"��ۚ�C��ȇ��X���}�wy��m�܍� �&5�W�4��"�+�uO��H�O��zRr����沶E ��M �|]�Y�����9a�4�s�~ҍ�S9$�a������F�Mi� un��4(,����S�tQ����~���&��u:Qč݊>q�7rb��W��$ac n���N�]@C[����E�P����%|*�1_��C{���EvJ�c+��/^��{T�� �c�gpx�s��\<���� ��F�/�f�럪�E_[;�|�6P�������+о*\�9���G��v�<��4B*�y�-�0K��T�?��2��n Z@c5���L�%TB� �����E=>^k�f`-��\��\� ���FS�Rq `�k&��֊b��B�J#��Θ)�/�� ��g��)��n�����;kn��%�U���#�>�����x�������.�9 ��u�6o�/[���d'���H��A�9 ��� ��������R����B�wi=eUќJ�����m.��x�O��Y�aO� ���CB�,����иh��Q�ϢA�P�b��Cf�J����~�fZ?8�� �;쟒Y{{S ?��;���>�q���CӸ���N��on��w�n �"�����5�J0���e������vS�+�:���xow�[+�o������M�Yȓ �ϫB^�3S%�j�����o:=F֢E�D��Lv�]b�1��� ���1�(ˤ����<p�Xfo�l�xmY��Z�B�SG����v�����x�~, KK�r��] [��.z�'Z�I�[G4����1�6������ܳN�.�5]�U�U[7��-c�Z���r����T&���������6����lt��)Ś�[^�~�F#�O������s�V��T����3�Zp!�����ZTE�7ܻ�Ӵ����F*��Ɓ�sQ?��B���s���6���\����wvx.bY���F��{�1�;3�/c�5P��B4��N��'�����UAE�]I��XZ�G�s���۹���c�?"5��2�K<�,��(Ew����YVS�wt��s�hQ�[q�ލ�i�gn� xN-ʤdn�֬��"+�����H��f?�T�u�hWG�s ����&y���v(���P��7��� {,�]U\�ᠶ�����%7��I�h���*ҝ�p��##��-QvO[`�~���'i��T���|S�|�[[>}C�ʇoQ��N#l��a�Nʧ�E����3}���(�W��~n�����9%���MƢ�� H��`^��7���'�� �%�]'\����9;=< �8���Y����f�0�T���Ì ���h�.-]�?��nOp���q�EĀ#M#�����9ɺ 'lNH�-�wP(R��ܖ{u��}�K�x���[�Σ-.�G���r�|T��|��m):+rv��I�f=րc�meW`� �v�|��y�A>ٞ\F ���H�S�]97o�vz���Fv�A��T�<�=�r�j��M���߄h{?��}�G��!�4��k1��Z0硼{!�6��^"����9�L�͔��ƚ����ob^����+Y�@��| ������]������R��0�ئ��T���:�ѯ��|�%��$/�e$��^(�N!t'�� 36�$���u7݊�� |Q�|�V��&�ޗ#b��'Y��&�l�������c�90�{2�A��}X����A���I~c�@�6\K��x;�����b盄c�:�����H�V��=l��m���y�����G;��)㿻�s�mD�`�):k�����f���8��ZM^o�O��C9 �L��J�|����e�U��y_m�'"��Q� ��C}��Zxb�{��Q���Z;O ��\��2 `���t���'t\���d�Z3t���GV�=�g�q*_���v��q�S���=Xb�|ݵ���0b��#�X8�yG�~��)�����$�3�rT0q�L�NO:O��w@�@��ֳƬNYE��ּNf��Qj3+r��?K?���!�]W����2Jp(��Y������/��g|`����%U6��N�%��!Ht��]�&2��~�xH��vk�H,j�suѤ��gnՔ�����<�A��V0V<�m�7 ��߲�ЋR�@��=����<��ʚlv=�x�9U�D�>�����¾��:�B5�NhE҇��Z���[SV�sצ��g��p��!@�-[��=����m���#K�U�>�H���f�2�I�q�,=��1P1F��@�Mx�-fs�����k�qp(�\�p?x��� ���|2>�z���l\â�LX�ia\�� -�����J�P�a�����P��K��d�p�J�3�ګs�K��( ��q���=p��0�+M2�DA'��#�b��x�`������������L������ � �o[�VL��I��R�`f�s�vD�I9d��Wƌx�(Z$x�'O� a|���1�6�ȀLe*���ԡ��ABsp��Dp�������WY/�]�ݨCŽ����$ fk=+������ho���ꬿ��tC{�B.8K� ��L�B+j�u8\�2�s�MAe��2�#O����X���' ��'8�[� J�����[��H�Cl ���i���_�
Static task
static1
Behavioral task
behavioral1
Sample
44d58bae020cef67c873cad1793cf0f83b96f0186aeedc19c2c246c48fe1596b.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
44d58bae020cef67c873cad1793cf0f83b96f0186aeedc19c2c246c48fe1596b.exe
Resource
win11-20240802-en
General
-
Target
44d58bae020cef67c873cad1793cf0f83b96f0186aeedc19c2c246c48fe1596b
-
Size
3.0MB
-
MD5
4345fbd654b44131fd91f94b05ba7360
-
SHA1
555a13a9206bbbd24e583d669e76a3528ff8c572
-
SHA256
44d58bae020cef67c873cad1793cf0f83b96f0186aeedc19c2c246c48fe1596b
-
SHA512
4353aac2f8a22e5cb0343374bfc715b91d3a106f449b34ddaa33420db82ab29a47a8a1be9abe2df36832b78ebc6b31c87a3c6b525a551d570dc8a22b0d87a75d
-
SSDEEP
49152:4G7eu07ij6U4r3bqJzsDaTXc/2TWPyjSomicaA3sLMQ06pPmBnx:77B0zLMBXl3yUj16x
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44d58bae020cef67c873cad1793cf0f83b96f0186aeedc19c2c246c48fe1596b
Files
-
44d58bae020cef67c873cad1793cf0f83b96f0186aeedc19c2c246c48fe1596b.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE