5ƸH�+y� 増��3�f��� �*10{�>�*��4ѪU�$���ki��[��?��R����*��*�3����D�٣3�F��Zܠ ���%-��\@�`ѶN��Pl#$¤�v��\P�@��r̀LC �+��xs���V�mk����d�L8�p���]a>�b�G�N@C���ˢÿ��ɀ+�Č��X����� $ wȠ�c���<9���Ip��!^�h��r�;��g9-�6�L���7�n`ƀ�N��Z8D ��l�o|��Z�]�~��u�a�f7�Q�����B Z.�UV�e�R� z����cijYe�i0dYA��R��ِU���!����z�S_]]���G3��:�g8bu��=���OCDŽ�U|���bxi���j}�U���9@g%��,FZ��1���3���\���k��|�x�cjԡI���fAѧm��+��m3��eo�P|�_�.��=���D��v+�P��A�7�pa��@t�̹�+c4r�Fi�N�C�����]R�D���셉A�({x�ƽ!x+^,���D���10-����wtT$p���� P�&�AG�ݗh"F7�:��!nÎT�hT�>�Ǥ79a��6_��$�@���n���ܞ|0t��^*��EH��4���]�"3�}�2[�L�5��gG>K�@J�9ׁ�E�I�t!�(�h��ظ���U���u����l(���cb|B��q�d7�V����������ܤ>Jf�!I�!��B�e�#Vu�^W�K�������u��l$NXnDZY;5����9��J���7=����]��k<T�Q-e�ī��m���\�N�$�y��ƿ!R]^�!�j��ds ��䧀,�����[��^4N�Kw9MG���6^��i�H$G�Z��� ����I� ����3�1�%���� J�@��������Zٷ.�FJ]��˧mX�A�$>�4q��L���+�~�����hI'���'��d��Ϟ:���t}_�=5��?��|#$��� �S���>巪�� �I֪M��YS&/�SS6(���%��'���{s�-DZ�$�< }[:z�y�O��6�� �����ݍ��2K�3 ��nNZ���A-�S5H5�CpYѭ�5�~����ď��aj��ؤ����1ljχ��Q0���O< ��A���d8-4����������YW�]f�mgP Oi��4�ͮKQ�/��[�@��;�� �JAD�(ҷT�}��[ ���C|)�0sN�c���5~�X=�*m�Z�drN}DRNE3*`����]g �O�f���W��������M��$ˣ�b��E��]� �R�kT�uK >��2,]�8!�Б_,�L���.���O�r�-��o��M�Ov,��"2�� �5W�����U����) @������|���.p|Yc@�����ӱ��.�h����t�����@�3�����6zT��|�o��e��@���c�?��ج����M���3�Ϳցj%�!����b��e����O�S�[?բ� �I���M���Y?mw���`�1�з�6 �/�)W����7�7��b"�K����v���=_�:D��Z����{@(�5Á b�*� �h���3�f�\��8 ^lR�ƺȇ��Fϳ�A��fOM~�w`r�"Ԑn��[4����v��ͬ�ۘ6t���]�Gpu�� Z=�������a P�{)W����4�`������<�=��8"2�����K���-�Z{���r�)ϙ��=*�v���@� �+4�@�M7�c�F����B|0�oq�����辺*W�/���[����f_O��ti[w�t1�w>���0 ����� ��N�4����@���S]��L��bV��E)��Q�� -p(s0W�Jag��!�b�DJ�p�w�M�� �vc2�j~���l�T٩a����B��㝕���Al��j\�V;���`J�w��&���V{�jw{�vɐȻ�� �I� f�ra\��=���9�~&J4�مm)7|�B�C�EM�?���S]JnlW㥂�c��SO�E#=�v�q�芼���u=�\��S��@���q �A3=.{��:QT��3`��� �������Y��-��×A�S!��+$�UK��8��z�����o�'U�G�W�ϟ�H��A�7W ڥf�ł�go�=�Z�$c��L@�xB�-8)麹����k���RT�����"f�����ÿ��s���|z�A�5oz���G�}�oe�8��W.�!��/�!�~���_��+��A��f�$"�H��鱼�����_c��t w��S���SǗ?~s��p�e�E�Dd^r���O�{��t7�h ~���8��ָ��t�I���j�u�T��R�����d�]'h��ۇ_���9Hȓ+���"S\t���\#�����r�KKN� ����݉1I˿6������őw�̥�J=�d)lYc��?�� ���2}�[��(0/���r+7T��3�፲ҿ���H뒖Zhݬid<��06��3�2����㡏h���^"?��mv2\a��"��q�����w.nԗ؛CQc.���<�c��V�7���^�ui� tЙ^*9�v��ϫ��(7���&�����Qsk��Žv����\`(�b���QU[���w��k�b��$l��*���� E�\_ "{�%|F���*�����\+�2� ]�П��������HY�v�E���8g��h ���6�1i}+��Ϟ�C�I�L�D7Q��ʼnR�� Ս�gI|%U�2O$,�l^頫+�5c���w?�e�_��Q��3����}���&oC�Z_�[2� �S�o���L�F��P2#vNc1�qW��k�N��56'��,�� 1��e��;���N���>���Y������c��Z�1k�](����y���1�@�!`�f)���C��bu㪅]'~�������Q�L�ZX�U�-�$��SJ���d��S}e���X�a�<3�]N�B���@��7��C��m�|�:mA�wH�����[����*S? fhko��W�8RT]�P���i����t�1G�/���#�2�&���Y$���E���5��J˼��A�7-(`-���=�yPx, �^u���C���`�SQ%ewQ������*Jܛx���ʶ)�Q�@�0���}����!G��Q��Ga˩2�LqmG.��K����Wo�' 2����W�e��t-�{J�[�C� �^��q��������Bp[��{>Kɠ�����t�^5���)�u���N$���]L ¢�[���f'i���:���6�������Һ�d#���:�2 ,>� ��t3���'�:}p�ưƆ�hT���(kf�@�<G�;��7&m[�/��G_C %VXv&��^�uZק�z��"��Iw?q��2�إ�YK�@���1r�`����Е��Ԑ�IZ �r8ۮ�SgUc��d�F���$ptsO0� �#9����`�P����2v��廱ž�� 8���&2��v.|N�d�44��H`m5FS�Ԁ� =ri*;����SpWgL��D<�B+���I<�Y�!1":ͷb*l�x!�p]z7�KlGVa����*��qo�$کI@��zik��d��������.P����؆g����+(eE��5���"�~��b_��+þ/%$���o�k�%����7��R�Q�RW��GQ
Static task
static1
Behavioral task
behavioral1
Sample
fff8c30d879767858353416fde0fe0a2dfc45ef651e860956942496549add9b7.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
fff8c30d879767858353416fde0fe0a2dfc45ef651e860956942496549add9b7.exe
Resource
win10v2004-20240802-en
General
-
Target
fff8c30d879767858353416fde0fe0a2dfc45ef651e860956942496549add9b7
-
Size
4.9MB
-
MD5
3a2ebe4fb57d94ea3d4327790eb43815
-
SHA1
024f0be3c1bc1de0335a52d85210a84b9769bb10
-
SHA256
fff8c30d879767858353416fde0fe0a2dfc45ef651e860956942496549add9b7
-
SHA512
4a7ed6c599aedd81a9f7e711e14a1e70e18a50051bf52f2bbd48f50151037c8abf10c572d678bf40766bc15985b203dc0382d49e0fc7e7acd62dd10e87cd5f6d
-
SSDEEP
98304:38RkWHh546nNb4ggPb+NVHAsM+6rTXg5s+IqoOV80coNEyvpID:sRkS546nBHJA66rruIROG51Mp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fff8c30d879767858353416fde0fe0a2dfc45ef651e860956942496549add9b7
Files
-
fff8c30d879767858353416fde0fe0a2dfc45ef651e860956942496549add9b7.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 403KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 87KB - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 768KB - Virtual size: 968KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 151KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 297KB - Virtual size: 13.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE