�`�-�Ÿ1��K*:5�#؋�x�}����@ԧ�����b�S����[����u�#Y��ll2�E7�vnve���<�+�F@���j�� ͏��i��i����X��϶�E�Y���Z%���S*��^��3��J����<�c����%즭���<-��� �~�c�J5K��]���'9���MM1$�<@>��o�,� �����]ϱ����8W#�O � q�ո��Z��8j�}0���h���E�IP157����9y���6��:g�XN){�|ђ Wo����XY���) �Z�DQr���@�4���:E��,�v:C��ס�uʳ�8C��Dd��N�����u$)b��"&��&�s�͜��i����$��k�ĕ��kh��\(r���d��P���f�� ��ݑ���8��=d��b쓸�wɏ�����3i,�A�ʨz5�Xi1+�i�(�� h\7߫�s�#��o�Oz��_ǵ�es� ݣ3�VG�_:ϟ��?�$Z9�V@,��+��ާ}�Ws��V����4ϓF�0�� =H�5?���t}�6��s�sf�}�(*{��5��^�6�����+�P� ��<.�J������J�).��H�����b�_B�.r;S�����=A3��������;8F�B+��l��N!�O��/.3��SŖO>T$i���\�c��[��ͷ��*��J1+��N2\ϲ���Y�4)���Q�r�r���*Ӯ �����%�$8����%e�Lގ�0����;����8ß �Ip4��U;C�{�ړ%�|�C���\e&���B��d�<���,��*�'R���:���,;@�I������S��t:�_�u���Qq�B缞^{�ߟkM<O�E���͜(O������X��w9 �z[���9��ShÏ����F|�� a�%��C7ܨTbvVv�7�¢6��h���&,re���K��`z�,Vi&��xߪ�DD�wݖ����\/y'9��bȵ��:@n�� ϼ|��i����3�wr�gVe)'�����<�fF���֊y��j�Ap�e�������(��Vf�Ħ��Z�O?��C�s����Z��C�+)��- W�^ V���E�(�9F a�$�t�~uW�=7�pl��D_��O������7�'���I�^�=K[�~�5,���`#��<H��^������d�3Q�l�|JQ��2B���yv���� yu��f��%�5���](���)���K$]��sN/�v��p�H�r���q W�O�<P�����h8���7K��M�<I��0����8�h�p���D(귊�g�"0���1�����(2=X�I��F���B 4Av�B���4�FznH-��Ҵm����w�*��8W�U�zp��_���RG�1���z��Ec���ͱ�̴��@�c�^���d���G�p6 Lv�9��Y�?�Y�2����<��!/�����N����^��X�j~�m-�q�@%oeG�M�?�L��q��f'����J���W��)G������;���@ő�*���a����V���H��1&���1y��c�M&�A�S��d�ӯ/'�ji��z��̥����H��w����I1n�@P�b����������E�Tf����l�S���|��l��r�n{�b�b�g�1�9մ�Aқǩ9�db����77uN=1��s�誩��(�fBJE�=���Q[��ܙ�y����PH4�[�J���Ԭ��(M�d�C��,*�:�ŕ�< ��z�*��� ��������w��EAr��$U�I(�":h��'�дR�y5��:a�=��\�:���������M�A�j�+���O?� IB�"��CyHFQ�GVښ������s�H�Qz��t @�DZd�ƘK�n�m�B�l2����~��EQP�����@SqXUsD:�a5q� {��:u��k�^Z���qWX�.�O��ke�zUHB)qf *�U#|60ƀ��?hm��*�w��"s�0��`>qCZ.�i�!IZ��'�'���5���u��M��g��~ë�t!B���ڸ��ie��w٧Z�K��ۛ\��<�/ )�~+j�搋�/���zM[�4���g/��)�ƿ��D�gMv��,�9��W�&]������(��|O��O�em���mN�!Mo�F|1��p��鐌]��M��*�3C��U`�5���Ͽ���^~�9�f|}�p��6 �4��������J����D�"�� �����d�^�gʐN�K�Imƶ��DBN���1T��ď^\�.�7\8������}�7�);�d�]���'dlz��lU�,2�Q31$�FD�]���\,z��Çهc��;����`�7��,��� %f�*K�U�<-�b>�� 8*_IDǡ�hp�ZHi��b��Q��W�5�Oڠ���n�XU��5P���xA)�t�,�x�Z`6���}C�\C�2]--QN���=�����d���G�`�a��4���y)�� B�`4ݗ�뉝�����>��=����v��]�(�a&��u�����SzF� 흜ٕi�gk�����g]��1���j�t��^ԋ��L���*�,gk��oHˀ��Ph^��|r�w#�69jԦ�wua��eڲ̼�GC*��Fͪ K�S�%bǭQ0�XF�5E��Q9�(l�&�r��V�C��MP��~)d;A虍A<[3���n�8�g�D���2֡���@ɉ���g�����;�;���Z�1�E��jOR�e�hUr�-.Q.��5@Ů� P���U�Dfn&l�����T0b�(:��?��iVP}�v7W��I6f��sx��ǼP��E�����]W�����;ߚ#Ԋ�5����hHOGU�~��.α�*� fa �6��X�]����f#�P���:�(H{n�����ΰ�Z��U�sT��m��ܾ%���0�tM{x�!-�w���������fCIiO���^&�RD����|�W�~��l�����Y�m.�Z��ƾ���(m�����}���/Y���#S��2�<F�����(T9n)���dgkB�d� y����H��?_�3b�:���oKE_�K2|�v�Z
Static task
static1
Behavioral task
behavioral1
Sample
dd998be2c43031c8af0da2bf128b9155a27f232f810852bc8aa511bd09fdeb00.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
dd998be2c43031c8af0da2bf128b9155a27f232f810852bc8aa511bd09fdeb00.exe
Resource
win11-20240802-en
General
-
Target
dd998be2c43031c8af0da2bf128b9155a27f232f810852bc8aa511bd09fdeb00
-
Size
3.0MB
-
MD5
ef5b53534d6be4d051017c23c1ec8358
-
SHA1
9fe57c8d3b2d8b891a146d60ba9dcc68d7abca55
-
SHA256
dd998be2c43031c8af0da2bf128b9155a27f232f810852bc8aa511bd09fdeb00
-
SHA512
f012f589887b400050c7432f2c75a22e8f0ca0ac1088468c290e64641740440cad30d39a966b914c7381311b8d1b7ea7a652c572fdb6b184964ad9379e207934
-
SSDEEP
98304:8yTtvDf2whC+A8MYyT8skYwXWuOyMVlEhhVjgEp:8yTtvhg+CIYSMfEhH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dd998be2c43031c8af0da2bf128b9155a27f232f810852bc8aa511bd09fdeb00
Files
-
dd998be2c43031c8af0da2bf128b9155a27f232f810852bc8aa511bd09fdeb00.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE