<�5�s�����r�����!�۠�X�b���'�mg+a��ފEN�n8"�+���T���P������٫����(\�W�-���v%�Ï�d��EB���jLOx�����|甲��(�����r���&L}��A,�)�Q%1V����>+O�+,E��<ٲ��w�����D��W4�ېf@�,"���p����J�0�+�ޅ�����ֹ�<9�.;wݸ�M+��:v�d�m���)���Tv��{j���V4�X�ڎ�L��n���A��y�^��ݬO��_j��Y��*�j�FB����a>�`ĸ��<\�cC8�� e�F%����,���R��(��w|㞊��w����3^ǷU�0E�)����m]K�7e���0�#�j��fVc�w���toI`ؓ�5h�$,!yS+ޭ/��/v3ݕκ�&�D�g "��&��@J�G\��1'��.Gc��jεqH���߄�W�_\�b��|*ij�Z�m��(�{�Lx�W2�f�����vKudSIe���L�� �@���.C���Cs5ZQ8Y�V�a����.��ݣ��~�� BNj�&~�y{�h���s(%��;^Y%��R����@����w � [�?��Z�!=�Gł��7?�X�� �˥'��~k�I���B�}\H��h HrW��m\����zŰ�����9.��/~��Zt�7��d*�r��br�����˯D%�8�}O���t�� ��e�'�:��w��0�"A]*Zۤ�;���z�C��`3�����)���Ct7w�ca3�b�1�S���֩jY~; ,B�L������n�� �M����y {��g#��玸�8E�t/��1x<�g��� �y�#B�yY��Jd��0�n��m���>OI���!i�?�������ܧ���C���Z�)�zjӚu� �5�I�(�L;�@��ȣ��fz�\����々�;�t�t8�_w�U�&`"w�=�����"A����p���)��(�!�j�h��'�C"fN�T{�xk�w�7o�;S�㨹S�m�F^[u�Yj���K�9��{ZN����CJ �q� A���?�<�*Q�����>���☕�농*ϰ�1ݠh�Zzt1���Z1��;qi����r�n��Y���?7��d����D�qrK�c�o<LD�HzO+��QH�=`�$kvX���~s�f$�<d�D7�:�/]� ,��e?�:�FZ�@#ړo"w:�dJD�'� ���!>��e��T�lڴ;w��"��m��<��R"+G� �]v���/�Bl�ȁ/�a�栮*S��.]Ѣ����+�$�X��X`�e�|����"����os�x25ꀪ��p�B�����q�?�r?Q$9V0�g2�JRс����bw��uPbz�"H`�<d�lQ�K$�sۛ��.�F���8T>Ma�a��!��>�-��C�LZ��PzՓ���7&<$/K*x���Z��}�����WIj�)������iO_`Y\����\YT�Z*F���F#B�n'�r5J86!�e3�z���e.]�qӜ�(��E[���F�j63=b����"�'��}�Q��Bp�V�$gT?�$o�e�d��b�l̈́3���gh�Y_��ø�aw��͏��W�/� �X���Ի_���7�)����Ȕ�{������3MU5�2�骢�l�U�d>0T�ų�^�o��ęI����}����rC5�+ON�&:Ӟ�3�k�v��"'�C�)n���N~���j���-��@��3X��ب\�#E��W��n�"��a��!t�F��[oÎ�Nk\/��T�U �R|��z�d��ځ8���$��T�lbͣ;<K�q��T79��پ��v4�'Zr56�8y���������l�,I����^F���W����}�J�_X 9V�n_ǘ�m-�kF����!l���ф�xOZ/_}M��JbM�Xd�u��yl�ا��������v� �Bep���$��Y�%jQa�d*��/+�pꏤ��Љ���ǜ�����l����Ұ>�6��ܩRO�$�זQ.��jLS,+�Yӎ 6Es����ܷ_�A Ĥ�s�@eHV=��B84F9��g�}���m⯬*q @G��:�n1����T�%�r�������@_��`6 ֎tĺn�l�:�+��+>��6���G�H����,B��R�l�/S_WY�}=���}�"@ei�~cs�'69LY5�o*�PY��.�[f��+�]2�����hZ���![��D�1&�.>�GJ댜�M�~h��n��x�Q��>�|��;>�[��9@�Bp�F6�I�E�h���Y~4��mk�#�g�)v�pf,[�"�n�=�����>v�ھ��� �� l�v:�CE�{_���jT Nb�*&U������_1�2KΪ����q�|��A�kJ��m�;�ed���������l��1br�d��,�wc��c�A�x�_J`�U`����[gr7��<��>q�B�E#�[���PU� �X�ڑ��~n:g��=�A���'��V� �NM��i�����C6!ܣ��&@�n+տ��K��o���jeĶ�]�r��=���� m�ח�U#�'�7_��K�����FG��z�<�e*�g��PF���(n��� v�n���X��s�@|~�y�sg���������d�eˌ���i��H�w�����~LҬ�㩿I�j�T�sq80�=�<� Tx��Y��U��ܼ���;8cp�ڋ�5e����w�Ou�+�} ^��O�M��M;/eΕ�z��o/��{u��<��s��ƃ���i�c��DpJsivt��9����2L� �jfVf�B*4����8"Ⱦǝ(<y���V��S8���D~��Dfly�@��I��T�T�dB˅� ��+���#}X�d��!-����[�$��%���h�Q�Hn�?�Ӡ��-B~&������gqu�?N\Y~�J��A�-�#�&�4P]���p�� �����YF`�����\0��%�����X����e�zH�2N�U*��q��q���:kr���= �4(��[U�_12�-`|�a�82��>Z�� i��D)x�fY`�y�u�Q�rH���¸f�͓[����Nz=.A0�G�C�Ci��Q�W��v� ���腗�����6�!9����j�r[��o5Y�N�͏rb�~�tրvsmY� 7vsr����s�:tO�-ּ��օ۔hj���Z̸g�0�}Ѡ�,�ur�k�RA�<�#�[����1Y��x?"�UFQ?���塥���\f��9�� l� ��܈���^䭋�MW��R0c�� 968�/��Ѻݻ�>�TC˷|����'��y��ەn�Z���Vq���jH�lDV��Qs���d�m ���Ӌ��nU�d,JcN��2�S�BB[u��Ϛ��;���!�@mv�IrQM��6�C\t���_3��n�����`����g˪55��R�W��o��6I�Pu���C���9--}#dO[.�CH���L��(����|�?���R�OGl/k�������ʘ-d�ٛ�������}C�p��^E۳�� ���|p�Y�@6\����.v$o�G�u�-)�yM������ߖ�ƔM�t�ҖOB�nw�� �\�����y�$G��� �k^���p�VZn_G'C�o���qR]K8����` ���Rub���r=H>8�i�⿳9���/ �|��[�B�n�,}~�}�J3�����K�(���y[9a(Z&�KM��I�F���B%A?���3��(t�#��(q���͍
Static task
static1
Behavioral task
behavioral1
Sample
ac3c551f36ea2c77d8685944cab9522b9b379935de874f84388abf8be0c45f9d.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
ac3c551f36ea2c77d8685944cab9522b9b379935de874f84388abf8be0c45f9d.exe
Resource
win11-20240802-en
General
-
Target
ac3c551f36ea2c77d8685944cab9522b9b379935de874f84388abf8be0c45f9d
-
Size
3.1MB
-
MD5
19417b03222b012127038fb25e2eb2d3
-
SHA1
79bd763cb76d85c5eba125c41c9185b70e996a99
-
SHA256
ac3c551f36ea2c77d8685944cab9522b9b379935de874f84388abf8be0c45f9d
-
SHA512
2e063757be6571d4c9943509ffaf3972ed0490130c483e54cff51905a35352afd91499798a7273ab039e6f80a93e3cc3137bf756ca7df1a9b411337bc918dc8e
-
SSDEEP
49152:U/rAnuBe64gE2D4qLczigGqv3eoHjhNJTsiNdMA7SUZcyYerHrZp0+5GgAQTWoK:fpHow7h3siLMQSl9erLZpxGgA3oK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ac3c551f36ea2c77d8685944cab9522b9b379935de874f84388abf8be0c45f9d
Files
-
ac3c551f36ea2c77d8685944cab9522b9b379935de874f84388abf8be0c45f9d.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE