4\Ͻ�9Y���h=NYgF�����@�����Q�)0��t�N��Z��2��� ��m���^� �z����&���t3�k��7����1�3��v�mj�"���3AE��z�k�Yf,���C�����~�����f�)�c�^L�?1���%��-ū�ah(��/�o��Qt.��QNN����� �#_��c�����B;�!a3�3�,,\va͖y���ж�ΨK鷻*��$o���3]�����hds���o���$4�Q0!>�C(�iF��ԓcC��w�ƍ�p��������䏅�� ��#B�!����y��� �6�ӧ �[�O��Ĥuk��m-0]��Kf_գg���@v+%���$�\: ]�3�����5�����L%@��? �혂'��bHbE�*4ӵh⚤��g��*a����������Č� ����O�yk����~�;WT>���8L�.��촍���N|���`}�y�R��$� �]_�w�#i�� =5$�dk]~uD&���+2�@ѦǏ��=�<Ħ e���H����� �g�d��MJZ@,�n&�,��gW9�)�K.a9|��%b���<?�����ҮA·@��� :��Ō�~�ۥ�S�����&�~�=�ȋZMI3�R��]yh���!h0f�aqۯ�ӏa�rFq���LAI\��+�=qE�&%�Qڵ�y���k[q��"�W���y�Tuoj(T�?��ly�&隫�O ����1�@�������k~�@��5l@�x���f�3��R[H`иO��"Q<i8�]��C���`�0�'�+p��R��Q^�a{'lr*���5�5����� ���|���N��,�ye6��§ �渭2�)��T�Z�A����ߑV���H� 䠅�s��-ƟA����-��e�.��Y6��y�GL���k�<[﵇>9s�>�L+�{���#T��˓~��L_�a�\բ����eT��R�0=�Hu��-8i&�ʻ�&�\9c"��.����ݚ���r�xQ���1����� ���9�+㫼�o"/�;֤*oy�d?VW��N釭_��H~0W���lM��9ʷ�?<�z����s�V��c�q�� eP$h|da�N�^��U�b��6���F�5��B��μ��l��j@]\�!��j=����5�y�7/x�aR������ݳ �e���}�H����F� \oBj����3���W�O���>ߔ e{L=̀�}ev������Y�6ӱ�顫��=N��p��عPE?W����2��s:|ZY��Fi.���k2�@de�^���VS���0U��)S�c�s�xK���lzS�k��|?�O4��9�ܡO�����K�ɮ��P�%�C7�J@H��n�� - �b��J�����B��3����7�t$ݺs1���O:�Nt �����r<�x�}�[�k��������zk� 8�S�u�h-v�)�XQ ��^H�{���*$�{����!c�V/��gL� ������R����<�}3�b��������(�0����8�����֩�_�S�%-�����l�����N�K-xn�/�BĪVofKw��I �_��t(W(p�1iI�E��?eѯ4Eߨ�*ͩ��Q>iDK��>����Eӻ���%T��l 4��0pN�#��>�U�o�#����5���q�� IL��MD�x���AL����DON~a7�[��V��o�U����C�]��J���-�O��U���������N;��Q����)xYyQ�s�3��d�N��U������\:ү��]ذ�ro/�#� ������B��{�e+�|�����]Y��HYw��-���%,�B��� HM��i[H�^�Ē?�~������bl%��1��_���e�- Rw����j���)=?������/�^���o�����@�u!m��e�]��na���\ֽ�+!*n<cne9�B���u�ٽo:f��%HF�*��\c&�{(�u��9�Lt �khmY�~9��,���p��<\ew��ZPp�TG� m\�^��(��L�(2�"�9�d�Q)��"�x��a-i0��5TJ�f�5�xzs.zȩ~���<���FV�eEU� 9zA�����Hq)�C:�eۀ��(���S�p����`���B�����{����E9,3a�=5ٷT��:������َ���F&����Z��������z�4�QĤ/�渨:�8�� B� �6hJ��aE����q�18BF��Y��{��w��,�A�Ex��bqY%� 4��s���������q��nO)* ��2� �x�����fB���=ȹ�o�V����/�3�K��1��#��N��Z�c^o��N����:����4c�v�����^ �) �J�����eߚ����tpj�W"���M���;Ze�!|%�b����*�� �C��D�X�nhX���{ '�����a��MB������*�W�]�'�c��@�赅�7T�Sd��C��^�����;�����)S%-���2�}Z���E�r8��O�ǚc��nWӮ�PĠ��7۴���W��3�"O!F��.nYD�ᾚ��7����^�sO�~]�[�ɜ����_�� W2��Q����O�S!�b�Ln�م�z^c��08�.q%� ���������g���`�"Biv;p���3W����4��>+����[�ʚ~?�"v�k�E\�S�NC�+����=`��j~�6���>�^Qu��i�hT����� 6����7ғC�PK61�T��r�x��J�(�:m���f2� � ���4�w1a\��ܠ��V���j�/K=�l��j�}I�8;��h����}�gH����Z�QD���D����E���,ƄL(�W��e{� ����_#'KӔwo�5|���؏+0��O���<�Y0G��Ø�C�XxG��i�zv�c��x�hS��n2#�.�(�YZ���+R~����}�������7b��B_f��ׄ43,�������9`�9Ԥz��1A�Prɱ��g��YKU|b��cb���r�%��,S��w�"7�Iq;����Vd3&8����͕3��Q!]B�Up=+��[�-��B�ޣ,�ܐ��2_���@>��8��}��e�<�̱�I~�Oav{��H�����^��r���K�����CyG��`ߋ���aLe'<43p<���4U����q[IjK8�=�UDy�0J Es�����d���i�k{y ���]:c�Ȼk�d�\MD�A�ݥc�t����J�v�@�!�*?��#ݲ���;!j�ZN��in��@��/e��[?3��
Static task
static1
Behavioral task
behavioral1
Sample
84ed2e47ab2cd791814e4b4476b054b25993e3c506967a086f25f048c2828a8d.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
84ed2e47ab2cd791814e4b4476b054b25993e3c506967a086f25f048c2828a8d.exe
Resource
win11-20240802-en
General
-
Target
84ed2e47ab2cd791814e4b4476b054b25993e3c506967a086f25f048c2828a8d
-
Size
3.0MB
-
MD5
0f87ecb26b198524a62fec9eb3f4db77
-
SHA1
d4edaff3be26f2282b9cfd3dd283a9b1db4dce8f
-
SHA256
84ed2e47ab2cd791814e4b4476b054b25993e3c506967a086f25f048c2828a8d
-
SHA512
706f5ffcbb9e1223336e44a0bed3c8c54c0d03c423b6e3f9700018dc8169a81940c41c41210116715740e4b11beb835ae8ea681070456e0501bbfd27ce140db2
-
SSDEEP
49152:zj9hMMwajG0wvRvLtEBaLHvl4VksrOUnR6bNT045QxffPwi9tqwo4NPi5kJwZWJX:UMw5v5LKKviR2T9QxffPw89Nq5FWt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 84ed2e47ab2cd791814e4b4476b054b25993e3c506967a086f25f048c2828a8d
Files
-
84ed2e47ab2cd791814e4b4476b054b25993e3c506967a086f25f048c2828a8d.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE