�]�k9��j]�u��i0,��N ��s4����\\!v� �-)~ �U�H�]�x��)<=ܷ�����r��O�l�U1�ZClS9ۥ�0 e��T����(�����F�2)9v?��L�G����p�:��*�dzʄTE�#�Vy� P��ߓXu����y( tN�Z)��X���8w����a\��`V�B8b��$��!H�羂��6ڰL���bԔ�>����<$�u�?����Q݉Θ��8���.����#�0 '���/X^Tk">��qJ5�!��`��q1���b?m-���k� �)g(Aa��އ8��>[ �����#p�M��*� B�������R ��x��~���J��.�Y�~�Ò�}�~�WDz%��v�a���I�W�zT)�ϐ���-�-�sU.�Z��j��n���m�2qM�[�� �edtM)H��s�������*m���U�ϟ{f:E*��;a;ƛ ��%ُ���&^8�lB ���BW�Cqw�q[��f�7������\��y�� �?�$h^C#��)�:�V7C��<d�l���C+~� >��y��O�..=���=dE�V-]���H�P^k��=r�W�Ksɠ���u1�C5��=�~�a���&��G��T�rmv0'��m]�#�zn�����F����t��FI�p xX�^ "m!�U�Cx"��\K:�`��������>>+�w��?�mVV�T���x6�tk�nY��@Aj�D �.�5� �<K�`���`,))�1��i kEŨ��:f� �+v?�l�b�r[���j� I��H�2�p���Z��c���q������uy��&�����R��Ҕ����I�$|5���],�H=WH��~C^� �9o���bOu�?��]Y#n����]�`2h+�M[�<�謲"���+���Ý�6�Nk��S�)o�R"߃���3�i��z�\��u�^Pjy��z��Oꉯ�0�'K,��}d+�-.E��X��I��vM�z-:��Ov��$j��88�S�/,�G�M�E�Y���8�8��I��mƥ�y�G�RR~������(K;m��E8�ٴ�e��(p�-87%3�����qߥ ��~h�'M!qu:��u�7�h�0;'��'��g((�9�kB��a!u���%a�㨺u�4��]�2�Q��f��y���%y*<��)�gA�z���*г> ���?��|�!�V=.�d��ͥ�j�Z��~u{Yd��Ut ���hz�͇�w",(�۵���=m<�pS0��B��T2�Q�s�EZkz2 ��1��5>H8߈͈�h�� [^ ��1&�']&Jܡ�d�H�!����߱cM�"C�.��ġ 9�Q� �m�����v����_hW�^6mvHl���r��y�-M���r,-��!X���WHb�6Yˉ@��3,�h�*�h"����wƴ5���\ �/�--�'x{�ق�y��O'.ֵd��GU�����w*����Q�%�C�ztѸ���OzH�ݤdȼ��Q�Ð�3۪j�������m�J���E�Vo'�pvK��UZ����� v������Nx��Iz=+:�a�0h�PKʍ�$ȴY����ݍ���{��~��p�8�P��ro�`�뙺�O�Ŕ��V�]W������g���L,m�-����F��yS�}:$��[<���3Z�]e��a�|��"�5�O��&!���*�ޒ�t^ص�N�����-.r~���L��䶐��2�|�e�m繋�#o�(7����|��f�F��,�|��`�F@�69�uW����·D�*w����At�s�M�J��%��p*G���*Z���s� j.����2�ex���o�kk�9��3�-�k����Z�gG�*�k�?�j��y�/�]�s���s�}:���pѾ,�M�ʵ�= ��~��G�]1{~%Ж��~bI�����x�r`&cF��!�3 e���PŧYnX��5B�]j��P�Hg��@'h�Ӌˡ%x��ԏ����Ll6K�f�\���)��uO`A��>^G�B�[ Eѹ��~M�;x~��ŕ�돼�6� Zll��M�9�2Wy6E,�K�}�����M��C�`�}����i���l)���fB�z�>��h���U0r� ��e�"L�f)���aJ���i=�a�3y�h�hx�;e�-}1!� [ �"��v�.��8&���$����DFT&��>܋��{�`��#�� �W�bɞt`���p㛞���ɉ��'*<\��*y��ˎ��n���jC/���� ��3'E/�C�r�K@�y�b��`ͻ�h�e�Wb�ij�����7��"�����LCꐤ�݉�����0XE(�nH.\iO��d��K��;��I�� +��I��ki0�AK�������Qe5Ѭ�ٿ$�ۃi�sͦ�M���vOe$E�9Qr��Q���7��v�3ߪlɨ� ���Q��5%�wR��4��:Vݹ1'���>��V�.14FK[i��O�� �.�?�7�<��[a�����'Y�E��l��x�V��̘����� 9pCAچ,d;L~��a T���u�(�^zt��LA����Q`�����Q(K� �ˆ0�ǩ�dҤ[̦����8c�G��%�T��s�.(�}G+����տ��C����G��R}m�C�b��ܝZ�?v��6,K��E�m��v�4�aL���;�����t�"}�������=�]zh����G"��� m����i�2r9İ.y�ML�\wqU<j�k�\�����9�u��M1v�����ʯ`��3bJ#��5�B}��^wv���.�q��X�ߋ��`!��p��B;���k��6��sUwFy�l����hb� �.}�v2��"�o���Ӑ�-���>�����^9Ӧ �ZEo�<q�]Ұ��#���:<��?I�$c�W"�c� ��DHnh�o>9̃l��x�O�_U �;�E�@-�r��R� ��Q��jPZވ�� ���4�/�.�e���!�A�8Ҳ�3��Y���6��U�J�L���B��Y ��æWG����;Hܘp'FA��#�G�"���@��-I� ��5>1 |�]���B��@��?b7fG�!�s�RU�.��^��I@֣���)Mo�?��g8?�s����<&��� Eo���M���ȋ}g�X��]l�0��}�.m�p������IƐbW >�Qx����)D���y���'��=.�<5%��6#"]��;/��!&�uz$���?��-�T�k�*wBnd|�� }��e��\�3�Oy!��U�6�OVB�t��F��J��D�d��=��C،�����\� ��i�$�"��z�m�R�$ч��_mj=7雊c 8�c�Y�0�ܔu�HG���tn������>f�7�3�\��l�G��!�I��XQ�8:� �>��+�����p�9և�c�l3p�h�Շ���d������
Static task
static1
Behavioral task
behavioral1
Sample
479f42facc63b95742a370b28dd82a647ba78c6bbc15c3d383ebf0068b7237b5.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
479f42facc63b95742a370b28dd82a647ba78c6bbc15c3d383ebf0068b7237b5.exe
Resource
win11-20240802-en
General
-
Target
479f42facc63b95742a370b28dd82a647ba78c6bbc15c3d383ebf0068b7237b5
-
Size
3.1MB
-
MD5
4d3ceb10d7502f8831483f12e57f2c67
-
SHA1
87e0f58ab0e26fa58a909f91e63a66dfb9811fa0
-
SHA256
479f42facc63b95742a370b28dd82a647ba78c6bbc15c3d383ebf0068b7237b5
-
SHA512
5bb192fa3e66e11f583717f0767571791db5216ef494c488af2152cc8a7061c878b7b529763de8311cb618653859ba66040569e2b4e39e23dcde5b88183ff693
-
SSDEEP
49152:h/DYXeEVXcOKTq8dOYrqmh73hAdQC5jXFyNmCvZ2+A4hbCc4PmUXAt1NFcYD9MB7:R0X9iOmlxl+jYVHA9eUXU53MU9e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 479f42facc63b95742a370b28dd82a647ba78c6bbc15c3d383ebf0068b7237b5
Files
-
479f42facc63b95742a370b28dd82a647ba78c6bbc15c3d383ebf0068b7237b5.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE