cFȅ.�h-�R�� �4�Q���a�JP ��j]k��M_-�����p�spkV<����ߩ�"��l� 1$��� e7p��+�ac����0��4��/�g����N9���`�����}m���ik��S���(��юU� ����rt�dބ�(o���8�G�M�oA���|q괣 ��O*$�4���7K4�{\�ū�$�uz�r�W�r�ӪJ���"\���S�� hpH�`.��.���7�<�f��+���K�5:�}���~BL%�EU�M������lJ0�*P�[� �<Ã��w�!5C�� �m��q囹�g+�+��6��4�rZ(�I�����0����:=�V7��� �V�E���z~��:n.Nw�A���?Ӆ��Tʦ����x�!�X(���4>pp�p~��.�nޞ��4R��"P?d�(�[�L�E�;��Ja�.{�!Ds��M�R�����w�M����"�U^��� �v{5�O��&^������G9�Zm-td�z������v�z�)�ph~:�F���\�Cy�����H�\x�΅���9�c�z��>o�zr>k�u����`W���5l���g7���Y��Ő�NF�� CE�#"l�X��x-WTA�Zd�c�d9?L���F,��ER֖�b<~!��|���T��,�e�-��DεRup��[��������Ŧ�#@�#P���Ӛa�m=oZB��"�'~!����w���n18������:T��4��9}i����R����q�a2��p,�[�Sݹ��p�<�,��;��]<���^�4�2E��a�"�x����K��(��p�Lx8��۔�Hs��.�;�/�i����h�t�������=Ƿ��$ ��t2��ZAu�욮�:wG�~��Ԇ����u餜-x��UJNXN��p��ú�W ~d��3�3��<O'����(���5�b�*�u�4��R�����Y�����z����וx�K�cE�B�0��<���Bh�4���ZA'���A��HeX [����(�+��?B㗐��&6�r��S�8�Ĉ��5���N$���s���.�tB�����w ��r��:�b�R׀�V����gMdʷK�`�����RQp��uO�ϹC]A���2�n��������/*[�9��X:�Tt��O�\|����'�~��I��G'2��:V���kWH� +���#�t�:�.��:��Pӕ�$ ;7��� ['�s�O�t�V���%�6R��%H_Yt���W0G����F�}c�U�!$�a�� o!w�2 HM��I��ZB~=?#��g����9����C>�8����+d<�>T7^��z��lF+`_քV����^6�a��I ·]�!�n�Fw����V ��HA���xw ��L� ��&���D����ŸH�u"��Ƣ�٩LC�T���&'ئ������c�H>9�3���o坆�1_Ȍ�6I��(1���%�a�ٮ�q�=����9 fS�.�=`(�N{O����Y{�{��M��-����B��<��������|v7�p�\j���*˹g���#ӝ���p�2L|(��^��\� rN��}����U6EW�*I^D�Lht�J�a%/o ����������%�=�x@�3�ޚ�����lo����a� $�I%���ΖK��v� _�\�z 1eiKf*��H�(vn�� M����P#4�/�����a�����q9��eYw_p�:"�5�3ƅD��ߙAŨ�E��CQ ��� ܖ���t�O��MG��pb��?���V��L`� �����&sp\ �Y��cw�^��am R)q�g��(_�p��Yc�A�-V� �R%ɬ���h� EW�tL�7�<d�YW�0�� '��X���Ï!o�ԫzu�")���M=A��`U�M������hQ��Nd�����z�xp��iXsQ�ۄQ�"���@�b�qf��D �������д�C;�ve?$�������,%=��=G�x���`;_Њ��]RN�'���=��f�,4��ƀ��7�����v�L����s�$p�k2��'�3�P��`F����7�:�U~E��AC�����7f1�}�/��5l?�9T�S9��M+��¿��aDg���W����1����7~�D�G�C���Ȩ���J��+sf����P�U��$�/�$ÀM��ִ>�<CKz{�����Sæ��e��e�ȫ���*:�T�}E�!Ϯ�cs��ܺ��ZҗS8u�%���!�TQEv��+� ��=�5���L�i�Y��j� ��~�a�Ԭ��j1؛k��t8�E��po߮�u!�BEF�*�����Q�A�Z6Ez�a�� ��I8KW���PI�^��e�|Лq��}����*f�8�i/��b��y����f�O�ZF��W��d?�a��D%t�F�02�����WzZ�G>��|��T.t�L`���ٝ���S�!9�s��q��w~�*�ؖ*��7A����q,�lQ��d�u�B]T�8r�B@�[%�'\t�b�`�l? ��,�1RQ;������\�8㋡Xg��ky�� ��M�mF���{�1Dz��H8}����{8�?�#�Kb�p�,�j��r����<%���m�9��&dN{�����:@�ݿ����Gz���N�����Z���l���m[� v��420r9���ͫD�����WP�v�@������?\Z+�yș�mvۍ�Ǧ���>!��!A]�8�.��GN.��,N{b�� b}5�@v��5;l� ���l7�@�O٧����t��+�Y[c=�>2�Y��/������y[]�c+F\�ŵ��\Svd�N{�21� ���es'�Rzٹ(q-�ɓ�co�ţ]��� u����Π�3Tm�W�J́L#�ꏨ���Bң��IH:�|[8�q�}rՖ��ڛ�=+�-Dҕ�2eHH�~�U�>.#��-�I����\cg����t���CE ��-{H���2�u��p,�;ᮏs��K���|�\e61� �s�thlb*�ѥ"���NN��M���a�A`a�jCk��������%�5��D���)9xo����I>>MN�k�fc����-V���>1q1E���w���/� =Ȭ��O�\c�]�//��jZ��ӟ����Ák�=h'm᯦�8*m�[u��^/9̗�3�t���V���$�{�]ݲj�w;�{T6����M�����zI��xV��)�`l��c���eL������G�"�F��)S)B�ܳ�i�Y�6��*mv�N֊f^d��Z�V�Y8��
Static task
static1
Behavioral task
behavioral1
Sample
2c009291053ea424e551b435f4a25da41e61e55c7195f9854c5c60d79248ad52.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2c009291053ea424e551b435f4a25da41e61e55c7195f9854c5c60d79248ad52.exe
Resource
win10v2004-20240802-en
General
-
Target
2c009291053ea424e551b435f4a25da41e61e55c7195f9854c5c60d79248ad52
-
Size
3.0MB
-
MD5
ab513a86c85c59b7933762a311c0c9b1
-
SHA1
90e1d2772b182a4afb071d89fdc8c394e53c0a76
-
SHA256
2c009291053ea424e551b435f4a25da41e61e55c7195f9854c5c60d79248ad52
-
SHA512
532913b39319954791375a0090e1f1676f7ca76103487dbcf68427bf36d9af4c2203293f195030deb6264b4fb76d1a05ac32d2490ffd7286b188f11b5262e5f7
-
SSDEEP
49152:SsiKnjoPGlx3U1kXVJGjV9dVbK947bhmo6HodskmmQKqJIYTTLnVgQKuKZmQFjqF:niKnkul0kPeVo943Io6UUKqJImuQKuaE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c009291053ea424e551b435f4a25da41e61e55c7195f9854c5c60d79248ad52
Files
-
2c009291053ea424e551b435f4a25da41e61e55c7195f9854c5c60d79248ad52.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 491KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 75KB - Virtual size: 220KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 93KB - Virtual size: 242.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 17KB - Virtual size: 260KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 194KB - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE