M �y��\G��J���{S��).aW=+����4A���6^.E�`�Y#�~}'��uXæ����d�p�:��BQ.�j/ϕɘ-��mA��)9�������_���f<A�u������W&��������{U��Pu�K>�:�L��������x~��������g�'��,����FJ`��� �(wEi| g_S$����c���H}-K�2G��5dc�73*�Q��X�6]\��9�K���>�3�o��7�$�=%�Tmu�oga�ţ콹��Z�<��I]8i GUꄆ<z��"�GEY�2z�S?������i�4�u9Yچ�t�<N�����3O������0���RPYL|�xď�k������={O�n�Sót�2�_��Pw�ck�>�5i�F�b8�}��.�YOn�� 6�OU��n���Wɂ+�:����L�y���A�_J�P���f]i��+` �5�㜟�J"['��E�Z)8]�����x]kb�g��U�����:������u�9.X���Ԇ*�oX���A��Bo%6!lŝ�R�;�+KQ_4�:;A��bl�Ը%r�}���+�![rк��Ȕʂ�Q�&�wҌ9E�Cmu�n��q'�u���3�a�v7��kW%��)��wO������q�f���jb��A�7;��Q���[5�l�j2�K�a�Di��l�QNZ|K����:'s}1��Dw%�t���݀]� ����$>U���Պ�`�E��ސfٻ�eȭ��*���Q7c�4�M��Ă*U�����plll�!� �|��|l<�o�G���<{y��VC�",+�����B.�@���t煽Qي�N�SjN��ӤL���l��BB���OĎXӐV(�&�'��G��x������o�k����3�ǃe^��Z {XV�0m:b�x �)T����ջ:�+N��{ē����Q\��(T�y����]� |������b|�>����pI��V��ؼ�B+ӻ�&ckg3���c�����+ƒ������T���e�{��]�Rތ�=>��tVJ��;w.[Nv��ԅ=L��cg��ޘ�<�!� oҀy0܆Q,�>\z�A�ȡ�Bg0����3�.`C"�́�����R����'I>����<~�O�X����r)+��*��D�84�ꥀ��!�8��W\q�G��'���OJRי|߸��O��d+���È��nKA�¨��}�d)緱nNT, ���#)� ���kbFCC��%9��]َ�V?�Mc��X"F����zG���>��͇�M�|ӎ�X��ӕ/�"���������k$k.�/j�f.�o&`TA�B�����ġt®��ʩr9�]�be1|����(��|�Y��=��H;z-���,�P��_WO���:`1)k��s,9�[��#��j����P#��X$�cuq�,h1s�>�@��rZ�Y���b���d��D��!����(V��Ћ!OW��@���������eS�v��u�G�7�e�N�o�c��U�`�F&=�>��]=�y�Lh�A�$gX`h\��▦�R'+9�>(wɯ�Maq�*8�N}\[�{LZ��X�~"�dP�>iH:�.�b�1�;�N@������]y�nVؗ�&����r���+�Jn��D-͂J��} H��^D�I�kQ�D�d����#��4!ۙ}M�,���r�� �����-��r��ʲ��pR�)}UU�2��$m�dJEe@��p��F�1��M!Q,^ש���������/���ʆQ�7��Kadv�L���$�4G��� 5a�p���Ȋ^P|�����um�:��Ҽ-s�çb�h�C#��u��v�G�6��"+���1/1��2E� � m����< %��SG6��eѴ�(�H��r�%��DGXba�s�U�3�� c���ڷ��s��(ύ�>��w��;h����b����Q���r���0��!<V�5��� $]�]2�3K�����#Wx �����Ԭ^ewF���(B3\�dyk�.)2�ş�U��a2�l���ɐ��h��{1�<N2�������17H#��^?Y�Q�u��B �d+X(i��Ĭ�9%�%pa<z�5�)�a��qu 9t�Atw��N6TK���?ZQ����>0ԡv2�b��W q��R{�Iw�P��|�5k�,��t<�Z� ��s�B����!Q�Vժ�Y#��Y����r�{���m�2u��b�k��:�m+�Ρ ګ��v�~;*���6Q�h��M�CQ���1t�A+���g$�^��*d�����r�[���X&��d�4�`��b�N�H0?Bvp!�Sj"WN��?ʗ����� ��$8���n���_ơ|��\���`J����L^x�~�Y <va4K�.i�N�E&��� P�._��8����{� 5�� w�I��c����@._���|)�afih3#�dl�G�fdo2�Nb듟L�%�T��uv�7�LZ�ɦ���ACRph�; �K��T9bV���o ��k m?Չ������\&�_gG����́��[�j?,?�k���=�!���u�Ȇ��kϷM���I\�q��F�������̦�'D�ɨ?3�����'P.�Q��8c�|p z�Vo3R��7������.��3�ƌ��R�%�������B��RbE��{�0����>���@�����$С���!�Yŵn�?Geg'0�%@�g�;�� �I��~���З��e�\w9��*�$��g���Z'�4�\�J� �%?�p������ȃw��TO��������o�Θ�WG����H9Y9i��J�<�cp�L��$�����P��jY�ԅ����LS�����*B�����d�H=6cEi���|rmډY�I��!�L��]�(@��7�]�/�i��2�:4��ڴ/Wn���2�]�G;&C�зq�t�X�MF ;k�g�iZ�Tk=v� �;߶q+4E���B�o�l��W��0�X*�4Gy�b�n@$�)=�cV�M���m�+<IT�C���C=o�'�7@�H8d�����3a;)5ў-Y��&\�`�'��
Static task
static1
Behavioral task
behavioral1
Sample
2921464d60e943eecd345e1854fab260e2d8b8784ef30d6ba09f256e6aa0a335.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2921464d60e943eecd345e1854fab260e2d8b8784ef30d6ba09f256e6aa0a335.exe
Resource
win10v2004-20240802-en
General
-
Target
2921464d60e943eecd345e1854fab260e2d8b8784ef30d6ba09f256e6aa0a335
-
Size
5.7MB
-
MD5
e18201d7d6416f8b9ff0357ed9a39214
-
SHA1
2901e317c23133e7b6f91ca15cdfe68a53fa1c73
-
SHA256
2921464d60e943eecd345e1854fab260e2d8b8784ef30d6ba09f256e6aa0a335
-
SHA512
8b8a6385c36ab8737fa6bef8bebf5051a47d82c188fafc19fb9874b468bb6b3b2ecf0464120b2aac73f3aeef7636d873f50079f9838c25d75780550f80d0a7ed
-
SSDEEP
98304:IWkTMd+cVzUEB4qxwvonRvztDbsM9ZmETqTR9y1oA5hFaNCUoEc6stvvI5U:eTx7EB4qNtfs+TsuoA5DaNCUFstvvaU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2921464d60e943eecd345e1854fab260e2d8b8784ef30d6ba09f256e6aa0a335
Files
-
2921464d60e943eecd345e1854fab260e2d8b8784ef30d6ba09f256e6aa0a335.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 45KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 17KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.4MB - Virtual size: 11.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE