[�( ��y�j�ւ5_V�W�\�P��<�|_���.��/���7��M�V��lʿ�8x��\fâ$6fwQ*��� �H��ej�D�Q�@H��B��[���<� Tj�6o�5���q�O�A�k�+c!�f/]� ������E��ESprQ���[HIu� t8R<���Lmz��'p��q�heQ���h/��67+NX'�҇�}G�y�>]ʷݙC��Rzή}��w *�E���?B0�����R����IŞ,�i�}�v8EU=ϕ���4�@uխimT�?�V��L�R�)����L4����`WD���'�s���o��Փy��B�gna접+Z=�v�2*����X8D�-���:~�����q�����l�S���(m����o��8X�w#��4D7�&���>�C�������{!v�[��$�V�'�;(D��S"�2\2�WI�&��c%y8���o �_� .kj���Q0�%�[�aї��_6�Ɠ<�D���O��__��G�#R]¥���`��]� �'T��~b�_8��Ujԭ�v4>�31.^z�sg�14/�J����H$ �jz�AY�q��!�!�D���M�f��*��*�ߪǨ����������GS?*[lNO~a��=.|d��"���y�t ဨ��?h]��%�P�jm��U�kS��㨈px�+�3�F�;2E����oKVY~��[(22�C7M7�Ӧ,����0�n����R�ɒ�o�Y&4��b����M����^f:ec��i����L������d����oʅ�����jR4u]�S�đ8>�r&ؐ����(d��&7%��o�����(H8Sx�XB��x`ɒSd�z8s����*�M�s>��%�H���=�&����zU��"��0������8Zm"��r7 �@����/~;��N�`Ny=� �VY-�6آ\��c�#d����uޫѮ 8��c���p4BF��������f,4 �"�\����C��Dɒܩ���t*ޭ�G����hp��$�a���u��N�;U�����y&S�C)�8�|��-�Ng��$v_F��o���zk%��kl79�ʆOND6{r[�V+CbzZz�iڇ��K�M�?���S¿�^����|5C5ǁ� �)#t��r�Oj�����Ҧ�4Fߥ���&����5����XC���A:l��H~���(����h&i0��I@,w���L�?�����O]���g�ژce��Bݟ���7M3j��nߌb/"/�(���4��?Y�$j��#v�ln1\P\���'�H=����sN o���Β#�j����f�"����� j�[�(���VG�֫��b����S1�^Oo�jSAc[��������E8���y��<R� ;�b@QH��ʧ���m������Ar)ƽ��^Ia�����:���<=z TG���(91"%SQ��i!?���K��-3T��� .6�g!c�����f:�E�Z)%$I�!c@}��J�S�c��PGY/K�GG���x�[5={���u$��I*G���ڪ~��AK>�/"0Dn��`����KȘml 8OJṇܘ�>T������U?� �5�R���P�K�����������_�p�50�s���}���#�xsp��o��b�j��a=&8��A���l�V?��P�/���;�u�]�b!n�ƫIL��d�u�Vt���-Ӗ�&�Q���0yw��2J5b���|2��R�;���3���o`%�ė蝆LPCx�T\>".L�'�js��T�Bƕ�k^z�PT��h0�y��ҫ�&p��A�ϭ�+8,p!��u���.�\O���P�c�S?��U�Ǣ�(9l�Z��v����#��|V���<�1��4�����.��li�j� �]\ �Buw/�UQ��á�]J��4�:P�:_����l���9�� ���~7�>��=i9;Kbo}�>���oق���r'2#�����Ϋѽ2{���O������/ȅ������BJ��-�q�V��6Y�m%�"��>P�P���mz�T���JC]%�գATE��ib;B�ȯy�.��6�ڂ3;����^m�Qo6ۦ ��I {%(I���ԫ��(���hzv�6tX�����t���Ќ}~��_�����"_�pC�@���G"w5 <��90�q��� -v����Q���T��,�A��z����n�V���)�t*ĄGM?u�w�I<3�/EĨby<���f���kBs��,���X�l��V�-�_�w��� #W邂��j�����I%�i�ݧ�$��x1lkߗe�~�&�1z�/�z��X,����R��?FqlK"(���� �O�Y�^�9�x�T�V���7B��x10p#QaE�"�2&}�P`�t jd�@��=y�9h���'���'')rRX��دh���Po�������]������=t���n���6<�wtwW���=�m�sY�T>��� s5�ֺʴ�vcO|�@��H�X��׆�6��{8(k�Od��c�� ��� S����1���s�!�3qp�O������"x���I;����2����j�r ��2A+�(� ��S1�"��P� Lb�y�K�I'��hI��]U}�B\iٙ�9�����AA�6YmJ��6�2>����ݪ(3���\����j/�� I3/��wY�%h����7B��@d�b��v,��|���GG� �5ˡs��P4.Z��A��Q�`�341G�s1�����ݙ�`�z����H)�ú�h�5�ڑꑵ<��4�~Uz�����I�X��»<�E�5Nh��i���V�kŋ]Ɂx�ic;�F��Oj�~\�qH$i��0@��P΅����x �[��/5}����^m�d�M?G� iz��o�|p;�A�ϗ��l���2=���&taF�����iMҘ�6���{��BM�l-�-M�����W�qUt@J�#n������v��ι�p� �`��=�3S����]nTg�=�b�:���Wr ��.݇�5ABlj�,���x�y��ݠ� )��7�`�Z"c�\J����G�닳1iG�O���^������b�G' �-q�_r��v���&�ɦ~N����} sc.��X�� 1����|I�a��l^��D�>��6��=�'/� ��j�ϵ� u*K�j��m\9������o\٭G�`,qM�p�<�,��F-��uP0n��@�l0�(��+���MxjT5h���R:x���N}�7�����td2�Q��˝%ަ��
Static task
static1
Behavioral task
behavioral1
Sample
17ff8bfac862f6315d0d31a56e3e8dbd647362289962fb65dc02453514fcd7d9.exe
Resource
win10v2004-20240802-en
General
-
Target
17ff8bfac862f6315d0d31a56e3e8dbd647362289962fb65dc02453514fcd7d9
-
Size
2.5MB
-
MD5
0db0d62b5f45eea50c3f4e9d5e99098d
-
SHA1
82c92e6e1f9871baf1474491f48167f93ac314d3
-
SHA256
17ff8bfac862f6315d0d31a56e3e8dbd647362289962fb65dc02453514fcd7d9
-
SHA512
916e04fab166a9f927a548b8ea91263c62227d18e8676f2dfa0eab34518e9f2c137d86100d75b4676ec854e318a9b619e18c0d662fe67bf24da19ddfb4df8ab2
-
SSDEEP
49152:FPMYcU7gim7n3HfGg/8AqKmwlQtge/U78rrNeR9+FNJMSyr3pC6n9Jv0fut:g4W7PxlSH+8rIR9+Fv1ylP4C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17ff8bfac862f6315d0d31a56e3e8dbd647362289962fb65dc02453514fcd7d9
Files
-
17ff8bfac862f6315d0d31a56e3e8dbd647362289962fb65dc02453514fcd7d9.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 131KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE