?�R�f��1# 4Vuu"���;��i�bvha��#��7}'���J"��'y~�ux�[�h�DZ#ʳ�!`��q8��='�7��'N�/����� K�+�9�q�/̢�h�,'c!�* �+:-��'A�G�O50�喝�ު�z\����Z�� K��Q'���{߭㋡�`���l7s��Gv+`�S ��&�A�0�/6*-Ι�O��/ �[E�Jf����V�5H�pLeDl���(�D���}{{���M-��qY���=��h�P����~��e�բ����ˎ�&GM�>,��j�3�B�� �Zm�L?k�^H�"h.M�X䯣���^�m#E���8���xlH��m��.?4a��&�A��}����P�Ҍy��4���e�K����w����r d�)�}?͓�v�W�`��j���̂�]=�,��K���q��(�h����矪��ˇ!_�!S��)d�$A�= �`������Gm�4*�rS(�+n�46�,�o�N�\k�I����So��š�; ��Ji9DQ�1hA]�@��GɁY�q#�l��`��fZJ f� �'C1���q��H(���*PW�b�Ƒ �R���%91��D���ٗ�N��2�����t�+��J�>����@��d�%=K��R)�7�����[EP9=����.��n����<o�Nx� ���֚��p�\�־��gl۬�7��R��6��6�iuv� ���~I��,oy�!^d$�i+OR�D��� ���F�X4=�;�_9<2F�=�-�����"w��� [7�Lo6�f�����'�A�2����ܤ�.��؋����s�2�;�c{'~�����R���q��C���q��dߪ�XS�L�Wr�@��NN�-Gi7���?BJ�C�����ϓ�����d���y9ݥd� +� 獞 ���0Ʊ���ݏrr�I:����G/r� � �V⢮&{��)O��y���JU�o+@ez�z��\����%.�c�����d՜%R���T����հ���́$�X����M��m�0��|(Ϙ)����x}��q�hg>��X��M�did%������B[E�Q|��u^?*2��c_�+�[�P�+���Wa<�ҬSd"^6Vr/�q2pE��c�� Q�&Z��Bg�k����|~�����������N�T�C��ls��jhψ�iv�_��?u��uH+9*hP�U7����d4:���Z�'4���\�1'iL��㯙f�kOK[ �J���c�-�X-��T�jg����X�$Ն��䊙Y! u�)^OG :�t��H�D�����w�M�@o���9���� �)��}{�I�`����W�l��C'�b�љ~K^���r'1��'�v�:̮�sDJ��]Ƿ�4�q������,0 �>R'~�qf�L�H���8�k�)N�C+G+����Q���UG�ؗ�ca��5��k�_�i�Kg���K�W�����0�i�|��D�:q�<�,���ثjs� ��H����� ���l5 ��n9�ZU�C��"i���Y��m�FX}�>/\�-�g�_�ێ�S��졪_�O�4� ONg���h���b�I�q��x��J�Ab��?�z���H�A�~�|q��qK:{��. ��j��_��~�~,@7/Q�X Qۖs���Pr)��< I�;�,3�z��:��{��[�dj{�ͻ��v���+'s�6�g���G��%���W�I#C����=A���ah��y�%@~F�\��ʽ<0,<dzvk.��̞�ao�õ��sЯ�E�S�;CC�50]����Ҩ�����69Ǚ�0�QґOZf�U>�x��2C�y�C�`��T6Y���ZT7��4"�g����A�e�;�Hs#�b�|s����*^`;ۈ�p��Q�Ϗ&��d��\�'y�+{������Q�M�Ȭ��[�8�([�Թ�h���/��~���M� ��ݩ���/��W|����{��O#��.�]������5�����㧠��|�y�jOĶ��G�����qӶ`KpVצK�J[[�-���Ɣ����E��Ҕ�S��of�rc/&�cq$&�1�OiQ��[�^Eq�,d>�*�Y��6BձV6ȁ�������H!�) %���y���3Q.<[En$c�v��F��rLJ���[n��oC t��f�ԭ<�E�K~�M�=��n"cHj���y]������լ�ݧ�2Ȍ,g�,j~k�$f����ɖz�Q�t�a��o���Ʌ��$Qچf��� ˫��t��x�9�����q���J����oQU��k��� ����O|h���$���M�z�F�d�o�Q�\P܃s�G}J�퐪]\����f����+�6{�����8�nʢ*)�G�ҫ����v:n@1�*�3e�y ��C����, 1Bڴy� �~�?鶲GB�c24]�5�(�(aq���(����Hp�2�̞����c��/��<�A�� ��L�dG�݅�d��O�����w9��;X.-�2�����i��N�:���2{���k�Ls��_��C<S�~_>?��]EI����qP��������iJ�B|�P���E|�$�n:-�!����v�d �R����z61�搢���G��ݤE�������w���ph|�wrm�6S1��D�a�A�|p������盬9�lP� ,�CW{+� �,<ƠQ}G��k e��r&�,TOiS��)B�k��W������fx�.r��\J��50�|N���g2/F�>���US��Vz�X=�Y�{[h��3Giw��2��h����Sߥ���!9M����x�Om�p�md3�u��GGy|������:&L��笸���^����2.h�T�y+-�"�����%T�v� E����&4�AL��HաAA}�� ��c�Z%"�d%fOE�i 1�U�|x4�7�Oݓd�d�s]�#�j��N[�HP}������{w��hƆ�� ͗��!C�4BՐ�!�Su��B��k��CGL�v�Em&Z>8~��=�������5��QJOW2j�/���js�n���~�p~�5��7�F��`��c���m�S[E�[j#h#�� w[� 0�Q�2��j��� o������x.AXؾ�ҡ���E�ɳ}�`RG����/t4���?K��H��1��ї���f�#5w��%�HHh��z�f�)��7S��J����IFFfU��%r��h����){a������3<���BK5k�v2n"�P�e��)j�uD��A0-̽�������p�=ջkt�ϻp>�Oq�����ك������ctC �*��?��B�h&iXk��1����O�%O�Tm�93-��qX[� ��B��h�2�4�� r��S�7����w�"��.=c��,�)in����6�J#¶��g��oh�ղ�������g�ل��c�������m>��y�� m�g��|g������hؕ�M&��*�0G%_�Ux�b��Nn�7�J�X��a��>��~��>a:8���V{cgA�$�� ��9D>2���Q��}�&��� 0Hpq��YI����v]��Bg 5E�[���@ÿ���7��#��-oW�`"Ow����f�q��i� ��G����Ĩ��!~l_�^�f��TUrj��F���W�}{��~�)�r�.9�e��%��Pe�^�p��tE���x�Q8�)��n�S���hE� N0�����EҚm����y�z�s��Q9m_�3��
Static task
static1
Behavioral task
behavioral1
Sample
e855a64728d573d33d4cdf0c2cf0573c7d99db1fc1c7a3ecf2646bfbce7b78d5.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
e855a64728d573d33d4cdf0c2cf0573c7d99db1fc1c7a3ecf2646bfbce7b78d5.exe
Resource
win11-20240802-en
General
-
Target
e855a64728d573d33d4cdf0c2cf0573c7d99db1fc1c7a3ecf2646bfbce7b78d5
-
Size
3.1MB
-
MD5
38f619582609c19210fccc5978fd7a9e
-
SHA1
cde2a538a01e5cadd03c3cf11898f8bce3ba2ee0
-
SHA256
e855a64728d573d33d4cdf0c2cf0573c7d99db1fc1c7a3ecf2646bfbce7b78d5
-
SHA512
1c2dc2a7e3c42f45df896af434eb7a303fee35eded9ad9ca29cd6c069af755e638d5616804f26854b6caf7fcd17f5d76fe97a8ff95583426e914644ca1132afa
-
SSDEEP
98304:DwVppcSYwQJB1mtUC6hbPVNkAPlNymL1Z1IFi3YGw:DwWsQIWCcjVZ/r1U
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e855a64728d573d33d4cdf0c2cf0573c7d99db1fc1c7a3ecf2646bfbce7b78d5
Files
-
e855a64728d573d33d4cdf0c2cf0573c7d99db1fc1c7a3ecf2646bfbce7b78d5.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE