ƭ��G&�M`�r2c^�{LK��L�����X��A��s#p�٬#� e Q��F�3��'[{gik����5�I�� ^|��;��q�8^.��/� ���?�e,k�7�y N��㌬�bCV�oճ5��w:!� ��~n��������ݨ=�=Y� �'B�-���:�[����_6���jX�|���B�7Јi�ӛ�u���#m��IH�68^�e�v����1[[�ě./P�,+WSw��>��V�1@�w���gf�Fc�z��5(����M���C��f��� (�6'�ѫ8����R��R� {&�=�?_Loҽ^��S�j�_���@����J5 5�� >��������Jο ��_�t��r���?�Էv{Խd9nI��(:���Y�P���ے�^��XqW�����0�ാ~�_�;�u�!Ѹ_I����z��y��N��wybg���$��,n"�͍�������_g����(?:�DžP����9���� ��_83�<�~�O`P-ȃ{=YI�H|���Ne�3��Tŀ��`�������r;誻�u��\�-���E���Rf��'�=Ctv��S�Fs9�gVj�����I �[c��ﰋ�d��7�g������X*<�wތ�{����!��l�W ��I.��~L[����m�iH�h`��Q^뺽µ�1ک�~��yy��%�_v�(���dŏ�v>ש��6�11��-b<�Nl��%N֬{ac��k��O<x9��"��A��x0�� �TiQ��;�ܱ�8���,�Ol�Av;��a�����g$A�$a���I���a���.N w��U��b�c���"��\ݫ:�������h�#Ld͏h�/|�p�fX$'_��y�/����\�\��y����.�i�.�"�Ն7���˥e-��ł^ȯ P��mJɊT]E��<��b&o���cyMNA��֥���J.�o����l) ���lh����vǼtK �20^m��$�������W�gE�>&���)�"%ez4�n鍕��������B����Ye4<3�{�j:�κ�C�����m�q����`z�������|t�� �k:�C'v\��<��k�&��� R���]R ��"��XO^˘.w���T�A �Y�K�Q����x��Ǝ�u+�m[�?���K�]��[Y�|�LJ�J�?~ɽ�ng2���1F�����b�}�I���IT\96�fo���@L\8Ө�M� djN��X �������HL����p:$~���������-�6�S�n���ɪ�<]��Vf�YM�C���`[U�����u�BqSU�jfܛ:04��p�7^<X-�Ɗa���/�z�lyA��QUj�VYe����͠r��`K�'V��]T]*y�<#������G;�Ćjm���ݦI�Z��v�൞2�t�b��.�P�6 b���B%�G�]��q�R m��6����t�����'�;k�YȢ��m����a�f����������t���j�����J�����("��� ��|�����������u��<�K{���{�f�m��u�.�� ��Ҋ��J��J��h�V�0$�o��������g�v �!�q�k$L���\ڈ�_:�=��N����e�Z7�u7�ɧ<�/�:�����w�ݳ�+W�U��|:6�K �����h���ᦱ#c�� SӜLjop!*�a���MGX�4��b_$C������]��5u6d�����:�N�%|2���v�N��7�P�N7�<���$���!���ovk5���l����QZoӌt@['e ��AS�I]�ݏMI((F�#i����3O���!g�1d�����oz�!NI��$���FiI�#sC�Bp�.?}t�A����u�pN���9�0�u싲�tHW�A-��1�J��v�P:V��IOPv���[w9������`g�{�a����h�Pd}d�'���|'게V�,vp��+IKI��c_��9��j�ot��x��1y�@���Z�-�GܝAU �*9�g�K�2m�uQ�R\�U�=FK~ ���J/|�b�Lg��J\.� lp">KX�J��v ���Kq���N��I}u�\T�f ��j��X��E�E|n�[���EJ��QpT"&`|�� ��K��7E�Z�~��p��x!���$��K(w�hN�V����導��l��(%u�@?���?��eѾbs���!ď����w�|��I�V1�k:�;���g��>�1���MdQ���_GIn(���i�a�qz�(�餪 �w����߱�2�h���FH㎫���o��Ē�@N��&�q�!�R�:� �\�D6�6�u����>��)Y�@v� /i�xX �sZ�ym+����q���ؼ���0�|H����&�>�l^��T,8���4|s�i��&� �+�f�E�Ɨ��+�a+r^�lQ2�o��+�Z�����w�0`�9�R��z����axmr�PR<(�e]i���6t�OU�5�~T�v�ܧD�eK^8��n�c[Ւ��VX��+�&=&bm�Й�g]��Rk�z=������L���hxͷNq�O��//��-�"�o�L�|&��B�.����6�l�;i�ۘ�E�$x�/t*$����Z�KB���x3���4�F�J�(�1��D�U��o�#:[�*W8���K�y_&�Ĭ���L|�&�*{���ǯ:(��&�]Z;P�X�oj�����}{E�MP�C.�E�n�J�fF������F�]p��bZ�6R�R��T�J}��j�y��ڒZ��||��a��TE�����Œ��Ϳg�5w�J���Z���z�=��0?�}��v893�컾�3d[{�ԢWi�R�?���� �R����Q����\�����7_ He�@ �3����;���5�;�'��8�F�����axh=�ܮ+o��~lLQ(Vp�PыQӄ�컬�+��um"�O��K�Ų@��i�N��fŽ�o���k�T����BMX'4ٝ�j,�W7\mr]����K��⊞ہ��gc�^�]���������3��]0���>������4I�ޓ����m�L���{xޯ�<���dⴝI��L�&A28*��.EC��ΏTވ�٫ʎ_�� }�!��J8��>��ݺ���A�*���������<�4a�8�K8� �֤�&R}�,�}��TR�/���6����{} �o�D`�k;%6LV"�Ƚ]�]F�x��v�.i��d�����m''��C�ᮗY-9�t�*���qo�'ȍ+쀤5B����>˘\��&�ә�RU@�;l"�`\ٙ�oF3��$��w[�K; ?���y��#w�眎�9�s�:� ���(h>���埉Ȕ]����ɉ�idu����!��n ]e������� "Z���Z��Ip1���%����Nl"�ْ[����U�Η;�*g��/��1L[��b"J�-��jQ�︶:�|���Hc|(�A����Ի�)��>$<t�g//�O��ӭI�>y��k?�Ѕ>+Jc=�k<.%��*���o�A/�s��� vt�!f�t��ߖ�>o۬Iť@��k����m=�gMZh����p�ߍ�`}�c���$�8�FR��]*(���"��0��A�� ��łq^���ՔO��T�?[�����/��
Static task
static1
Behavioral task
behavioral1
Sample
472f9f3895e4d9cdbbd1b22be0e22c0850bac16f848827443775fa7d5529c904.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
472f9f3895e4d9cdbbd1b22be0e22c0850bac16f848827443775fa7d5529c904.exe
Resource
win10v2004-20240802-en
General
-
Target
472f9f3895e4d9cdbbd1b22be0e22c0850bac16f848827443775fa7d5529c904
-
Size
3.1MB
-
MD5
e78088a4172ee12922c638cb8b662497
-
SHA1
754f4c4fc653982df5fb608f459eefa50c728418
-
SHA256
472f9f3895e4d9cdbbd1b22be0e22c0850bac16f848827443775fa7d5529c904
-
SHA512
d560057495edfc7a9bf3e27f06e02f1884a241d61efcc88fb82dfd9324b9918049c7dcbebc4df6b8ecf25b5d3b91da502ad5be53c3bfd489e986867a0e4c0541
-
SSDEEP
49152:oABX+AbHheakodcCy5047NaCf2VUBo3TfPHu3ohvoeClRT8xRuCyor3097V4Mc0e:xBX7Y4Ui452VUBo3TfP99858tyoQ96M
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 472f9f3895e4d9cdbbd1b22be0e22c0850bac16f848827443775fa7d5529c904
Files
-
472f9f3895e4d9cdbbd1b22be0e22c0850bac16f848827443775fa7d5529c904.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE