����}K�I��}m͵�ǚ�S���(ښ�pOW�T)�o,�e��iU^d%���s��qʢ�0c��X������8��1b,�p��%�)��αۨ��k�J��-.jʢ]����� ����z�� ��>l$^�����y0����c�ؒ"Ax�9���W @�-����{l.�\��$U���!��v�fXx����qUKJ��>�-�?C=O����Ya<��rjQX��(W�9�#��_^�+��C^ۋ�O0�2(��w�h�n�!f/�v��>��0@��� B��oQ�81��®���|R���f����a��K��b���`��TX�6V78��H�f��[�nx�_mM�Z�x�J��7NO��I�\��v��<�@Y����a� ���u�ދ�ؒ�;Q�"_Z�`1YƩ~'�b�M�F��Z�ĵ�b�M�@}��7��QSH1~RY�.x,��N��+���g�����\a�{�&�yD'VX)���, 'Y���A~pwIz���"A;A��Y�o�1�ܖ]E|(S��x�kvc�ܽ�����0�5,�|��V���6�bI������~�����cG�:*p��^P|dvH���/�f �I����.Ҷ�� � ��QK\����j�����%�{f̎� �*�Έw Ƀ����c���z��(�I݃9��?�^|���Z+�^c����V �/G��� ٿ;3.4"�SUA{�I�!�8�a�`��,NM6P�! ��'�tT �'G.C��� `@�O�8��:�|sJw!�3�-ͯ lҊ��{�~�&����WO�����^�]��Ͼ�V��웨^2>O,����ܱ�*���8 YX�������R=��s�8IY���IF*�?�Z���)�ȵ�t��3��pd OB^3Ǿ�(3�������)]�p�R�)��(���w���"�gT#����6�n�6�[m�-p�6$��!% ��"�-���Ieش�� �M�2؛L<<�w֦��B��جj��̮>��v�2ld�5�yϵU�Z|�u�i�b�6���~�LP<��j�)?��y����<�/;h��!D�}'���'��GRk�����ٌ4��*[_�q����h��!=]2Z]��Dh_c(g��_�mJ��s�,}�%��w-5��+Z��o����m��^1U`�q�ZKB��7DP�~?� ��`�/���U<x��������k%�Q��iAT\�Z=���Y<i�䨃���C���P�[�2MI#�7�R�Ul H�rd����̸,.i�����#���L�ۤq��-0����D<+��,b0X���Qwp�i�AX1��w9��T��D���Z�\JTy�j[�gƒg�J#�����5?��?;�0?��3V�t�^�<\�=����C���w���< ��1_��:}�؈��e�g+P���5UTa(���Pq���LW� �t�^G�{pIQn���~~ч^#q�Ā�� ֯�ԉ���[`�Ǻ�kZ?8�h�O �A� ��AfH���xL���Q�)�~r�U��G���O#}��=�@���T>�T���T.�����r:���~KiA�U�K��-�0c��5��ߝ�\��:}�����li�_�<ж��y)����<kT�)/��0�gZ[2��o�f\��\Q��}��"����@� ��6{��ouF�P#V�݁Q��gj�5;8,�Ȍ�J��>rU���ĸ��P�s�}b V�SC�����Qj�4c�i�GAHN�o������zI���|��!�~�d���S�Ҭ���!L=�Xe!1��1Ijrhƪg �TV$Gy��3���$���[O�������> I���[-5"u�M�$;(@��ǵgC� ��������!��ևg�k��w��^� �`+�߁���o7Zy0�#W՚� �tY��* �r��{e�8����E�I�� 3���F����5}!�^ԝAa�Rh�� �c�W����>�#�^�_[��2Y{��ƛ�v�_x�=�X7�{h?M��G�һ��£�Q���pUW��9�e�k)IN NU��H������j}�`��VJ ��q�`wK�R���K��J�C�m"Q������큺��s�<5�dki{���_�'�a������t��8X>�,n ������-�b��*�}���_�(1��D��=�:�@������v]������5TM�G�����w�P�or� �-����<WR��)��V��%���z�Q3Ig"���ݗ?�^=ȗR�@�����$�uL��-��������W@T��y�\���x��gS�9�ʠ�V�a�'X���M�"/H�������X��a���dpU�@5�|AwO��(�J�Q�l�K7\t��]b���9�%�+2���0(�};ݺ��D{�A,T4q[̺V� =�h�DB�Y�4 �0�.C�'[g�͡���Q!�RD���V'ʷyJ�A����@h������#�mC��ID=�6� �ư�D�΄fA22�ؘ�����D�Ơ�Or�FvՓ�hB�1����|W�&Po�/n�-���vb(o�v����*��i���i�U� LY�pHe�H��:�=����弖|�%FT����{L=Cb"y��x������*ި"�P�N8$1{^�ϭq�~�օ`�6f�B�RďlP�\2��!�t���Y�z���-��X��� �Pͨr>��ʴ"���4���Y�-����>�ڜ8S��U�'��ji�aKp�N>�-Z�_�+B�Lƨ�*��d�ݏA�����%���AA�$o�[O�E�G�;qW�����yٖ���fvǰ�*�>(�>)�?�Y�w��"��2ș+�,>N���YX�q�,�,�����_�a(U�%�@` R�������ubKx���<�h��z��U���������k�L�Y��oJ���0���X\۪)X��@&����������Ɯ�6�ځ�֜� �� �忊��uAjz��v �$R��l(����U%�d�ַE����_�*��b�G�Y��{���z����PH�&V����O���S���,���"O!��'ْ��\���ܹb��H�� EֱF��$+�B�˾OJw���������9��5��u���V]�j ��U�/�������sw�cŔf`�SQ�[4�e�����M���E����!�k����'ax�'
Static task
static1
Behavioral task
behavioral1
Sample
4c6c7df6e9d3828dcdd0cfad206fdad1780103d9c2c1f38191d23b34fbab71e9.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4c6c7df6e9d3828dcdd0cfad206fdad1780103d9c2c1f38191d23b34fbab71e9.exe
Resource
win10v2004-20240802-en
General
-
Target
4c6c7df6e9d3828dcdd0cfad206fdad1780103d9c2c1f38191d23b34fbab71e9
-
Size
3.4MB
-
MD5
e04ecaa0c0183c6f836cfe60071d2cb2
-
SHA1
ffce80b60b018d4fd3d6a42237032096b18d7b1e
-
SHA256
4c6c7df6e9d3828dcdd0cfad206fdad1780103d9c2c1f38191d23b34fbab71e9
-
SHA512
0c372fbbde3a036c2d21dc73d72d46db7e01e6ee774e5c3c7170d8dd8c86cddd5c254772ef6e8c37a9ab4293aafacad6f7de6841cdca9fc2678019b7c95db694
-
SSDEEP
49152:gP+iXD12wwa+3U+3i+QZ1fzWe5symFwfqQ+I/x1HnJ0l/iVP+Ul7GNfqGBi9gD:g2isk+3Czz15sympQbbHJS//UlQBmg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4c6c7df6e9d3828dcdd0cfad206fdad1780103d9c2c1f38191d23b34fbab71e9
Files
-
4c6c7df6e9d3828dcdd0cfad206fdad1780103d9c2c1f38191d23b34fbab71e9.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 297KB - Virtual size: 12.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE