�ˢ1�9�c�6�Է�DE��>@ܩ� *O�E��8�U�y©���'Uh.�S�:��Ԧ�Y���N�6�t���*[��a�nï�9Yy��X}��{b��}S�Mb�)W��X�����^ w؏i��g�)W��N��WV�'���d�w�l!�s:����#��%<HR<9y��G�dDO��m,�v8$��h��F���5�C�� @���^�� �����k��(�} �JO�h����G�A�ެ���B���ȁ4������a�)L�bf�<ŋN�Ƈ0�(\��U��Jq�Q�#e)��W$my����C���!4_d�t�U��5J�Gu^���h����2(���T�k7E�������Z�������^��ⷮF,�곙��O�ް���V�캀��/�$�Cd��=S�2|�!*��ǻ&�>^w�i�5�������ၚ1f.�i��pWޖ9셣��T�]ۀkqO;��(�D���m��'�6ތ��� ,TԻ��Emf"�r?�o2?�+A�?D�2�Y���*��B�Ӥ?AtAL˿�*�?~˭������Y����$�bR�\����qA�:.��\-�!=�c��[8�h��z&���K!k�SM|������ڀf���d,�,����r��Js��N�d� �BO+���<����Y�Ӏ��M������K��ȱ]�n�Rl{�h�8��O�{�I�V��?��J ����9�n�rե5�v��<�p���P��^u��Yd�+pF:M�:��;;�>PlV�0���zļ��l9��]�{���ڃ:�s����f���_����\F��lz^*�'��`u�.����3�T��y��W�B9�ڲ)�㥃��֏P�K�=��2�v|1:�a��s]s�k�OY�l��;+c!]�} ����[�����@��� ��������宫���WJ�����oy������X�I�gƽ����� S6$��a��>E��p�W{Ȇ!J�C���ɔ<m5�o����X�&���@�W �}��q=�S����D,�6��əc^!ez��h����)�O�Vg+l�cL�A1�1b��?�>}0H8��:�ʂG`#�= �%T��-�T[<����-�.��Ra�_�gcq��z���|p����*kp�����}z�Q@���hOP�Pђ����ɚ�X& �"/�����G�=���UZ�I�u���_�[�H��FSU��~t �ӑՆO>B�vޢT�s�U2=�j-IGͷ�仄���'4Dw_���G1����*į�d�\Z�[�"���enJ���5�&֮��3(a���ȑT{PR�Q�D�14b~T�%�ݑ�J� �l��@l������%��cg��ScZ��* a��������W}C�s| ��ޔO;��_����Dޞ�����:�.EA�l�6�4�ݜ�@%� d��ǀ����j;e����6���Q\���iq>%Ї[B¶e>�ֲ��- ��S::�D}�w�q;s� ��r��kPP�-��a]qYZH�.�(�$ù��-��ṕ���X�3fo�Oh �&in�������rG��.��w��ľg��]%���ڋNk+ն��4��J�9�T�d'�k% ���Ӹ����,|��o�$�M��CK{qa���1 �I�6y��ݦ�ߪniW]�5(3�'w��4�u^�H��lC��_��+l���ˈ ��Nȵdͷ]��:���x#kJ_Z-��/�����cP>�@u{4|�~����pN�C�,�Ѐ6�z�'��[2�y+ I5���H��a�N"�,���.\73�r�Qx�G�]�F�h)@��G����Cڊ���b5�l�����N�����b��++��Dm�.�p�nY���T$��NV�L�Iڼ���h�]��B:.{kø��A�nsW�SFD��*�x:z�"�O>լ��3ό�'�_�����I���������*]����)�:[7$��� ���w���0̵מ��087�F!K�XV��JB�¾X�M7믟��ܓc`��?��Ӟb��I���S�n��}a۵� j�j���ao�Rr4Q.����n�<��i�=���Nw�Nz§���C��:� ���4��R����%_�פ�y��#��3K�CA �S6*��?Dk4��Fy�lׅ+>���$�A�g���P|����k/x��g���}�$��r���f��[R���l�%���A/R(��Z�wI2$�ZT�S/'�m�8��+���Ưo�㎻ó�皦�!�;L'�����$_�KF�SU ����Zͻ�oW�kAL��l��$Z��}a����RK�)��}P<Q�;�pͭC����ä��� �@�������]�N���$���T*��Ҁ�U�|V�o����Wʫ~X\'4��V�D�YR䭖�7l�<An���#H�b�#X1~�����։K$�ܟ}�,�m/J*�y8.��p��q�[�9��S��F����'q�pb��U怮d���^b��F<w������W簀}�}'P��m{��oJ<ZN0�1q5�����A��Z�"����s8XN��U���_��7��b�hk�S�Ð�FDG!�a���$�0�^�$�d#P�Vw$��������Rav}�s-��h�:?�����ڜB��p�ˠ�ꜗx��Cր%�x��6�k�w��&��� ����<����= ��EF^��c�k$�JTZu��4�� q���������8k�I>U�,j������qKG�� W�4��`xt��-x�(�D�+A �W��P���߲Ў�+.�(�]����B���Ej��I8�bNP�/zޔ�%���e��O6!��+_�@Q���mK�"-I������Y�c�C#�v�����o�KO)����!9 �b5=���%,�xI!%n����4�TaP��"C;0tݶy����5���!�_�"�E�ɖ�hT��|��b���w���H��R])��nՏ%��TP|�'ڻ����r��T��r�5�[������r��=�=�4i�Rļ���M��p��+2��~�Eq�hS��y�5��z�!87e��[�}�R��q(�$���+E�G�&
Static task
static1
Behavioral task
behavioral1
Sample
d289e5f29394af2cb37b575331ec9590d96c560acefcc8a3176ca86a225b9384.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
d289e5f29394af2cb37b575331ec9590d96c560acefcc8a3176ca86a225b9384.exe
Resource
win11-20240802-en
General
-
Target
d289e5f29394af2cb37b575331ec9590d96c560acefcc8a3176ca86a225b9384
-
Size
3.1MB
-
MD5
1c38ded71ef1672ae1579f0143c42074
-
SHA1
8ec61de2af822a8055c864885558da687db09d13
-
SHA256
d289e5f29394af2cb37b575331ec9590d96c560acefcc8a3176ca86a225b9384
-
SHA512
02917390f32d7c66eff0da53a4046c43e26adbcfb673c12fe46e82780061e486c511e53fc968205fbdbb03907d8b11bce005df22282b18a11d047954702679ab
-
SSDEEP
49152:KSHbCgciHjn/FaA7RXCgD5fE/mbE4aeMFvdFV9+g1qTwEk4/uaIs:9HFHZ7RXXh41vdUgy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d289e5f29394af2cb37b575331ec9590d96c560acefcc8a3176ca86a225b9384
Files
-
d289e5f29394af2cb37b575331ec9590d96c560acefcc8a3176ca86a225b9384.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE