d���*g�2yp4j2! �CJ���Z���z����1���z���2(���[�r�eI��M���T�ܩH���`0��=�R�˸��� �N�DO��S�aB��[��ш�tf�Q�Vvy���o�^�nS���]�_���gvbUڼ�@a�0y��y�]z������q�'{+����g�� �,��e./Aa�J�����3��<B`O���C~���Z�M����:e�3l�ɺ6�����}�V���x*%M'����.�����h�}���Y���s�N��^_��y��T�|��I���b����S ����u�����Lp�.�L���C�Ɣ��i��tpw�j���tư��F�V��d�y�>/������Ր�"� ���lcF`ϊ�$ٰ�6��0���|�6��I�a�O����s���pc�B��=���x�5�m6�<ϒlN50oS�� �F6H��ëV���+�vH��;�c%��"��k@�HY�����v�ŬmZTR�-^�� �Q����4���lB��l�����/���ū�(��� �=�h'H���2Z���k��p��NE��lr�n^���ec,Q�̚�G��Xb��wܾ+�ːO^��Ү���=�N5���&�Hm.�Y��^x�ud:[�p�~�����Rg�VK�� ]tU� Y}bm3E@�gT?����g+A ��DlD�eb�%���L?'���mqq�!l�H� '7�=!� MnN`N��5�6���2�˔�Tq�a�s6"ֻP:v3PeM^����,d��+�ů3��L}$��/��9���\�Ϧ��N��P�~�M�K�m�6��^1!�Q�������w���L�3�\�Bjv�5q,A.�*��.9M�.l#����r���g���2+c����%c�������a]��#s&&��0|�w٢>湋� �L�V��*B�hܥ�Lf�3>iϺ>�&�Εz�IUۚ~��5�4KH�lO2C�R8Gon[�@39����e�[^J<=8�2��f���*U�R�WN����a�����jGZ������~����G<[��g��5�k7�|@DG3������*�� eS=>ͺ����Ԃ-���������]3��&Oz-"��8HDs�;�h���hB#�� HP�Ae��ak�D����=�V/�;5�o f!Ζ����/��yQ���+�y�p�M���O���vޖ�P8���ⴒ����[��=��AC���o���p�ݭ��R�H�_O�C��.V��R)(����a"��� ^:L����I�A��*�d��Ni��o� ��p\�,;�|�����v6�D7S��o�Z��9�����Xa�X�;&kO7^$fZ{灛�$&����Lgl���u�ɇ'����q���e,P���|���t*�濢u3"�-ss,��U�Si��P��ng�M9(��\��!�*���St��dtl��mn#�f��>ct�^]������; K��^+�]g�S��g�a�rMt5����"u���Eʟ���(�6��tDp�y��vWi��^�� ����v�d����b�|a�^���<}��T깎9$W��=��B��z�+�%������ڊ4E��G��vg�2�O%'�;˓����������2OА���<2�Q��a��7i���!�]��\A�u�j�T�As���R�EP]<λ��''�$q�H�Lm&+��ڤX�8��wrL6�cUe�aT.=�j[��l0���-M*}�����m��d8_���&��%�yT?�E�a���q��n�њx���͍t��8��L��M����1qde�Rq�?�s�͌t9�� ���o�-� ������A�6�9�Y�-�Ae�w1����������p�U���J���LԲ<P��O�Er���x�-B8O+�M�:@�>���vA�@Y�qF�*�n�88��Ԅ��x��ڸ`n�N�o)ۯC��iPʲ>�ZJ����b��ryk�^��vn�s�6�S.3��\@�������f�@����tO�\aĒ{R�zSW�ж�cec�ldRS�C� 4�__Bpx�]�@J����t�3EZM�CA�z\O��?���L3�V�A��}��j��:g�SԦ[��M2 ��t�IJW�O�i�7I�1�GCJm�C�k��b�&�������L��~+����a��A�nW#s�_<�2��7��=�������%�z�C7vr@���t 6o�sf���P�#�UX�_s����³�������&�@�r��x�A�Aa��A��BH�˼��� Y`nR�$Ϻ������~�&\�A���!lV,2�*��;�5�M��WPʓr��"T�cW]qb4uo��[��b{���AV��{����`� �a�����jm�������?�H� >�����(�������Py�Ck�� �&��恂�a&������]�>f�O*)��\��|S�B'0f�؎S���i�]���B�TwVC�k��Ո�I��W���\��j s�y��n��A�#�'a���9a������)�m�>��1�Y�����a��������OJ~Ed�� �%Aj 윥�M�=�xn�6���R�9�~\� ���{����H�O+�'�ރ����Y~��6�K�N�*{'�%i _�7(���������=�dv9�'�W�� � �����8A�*����l�r�<W~���MN0�ᤛjEت� P��X���B��ǸƴC�1x���qO �Rs:pܺ�% ��;�m�76������=�= �%����%�G���D��PA��cq9��b������\�D� ��<��|�8�O�#U�s3�af��|/9��7�;Dj��B23\.�|�ۢ����I� ���E�a�T�Bfb�a�����b��q�0;FR`O^oډ"�$�$*?����u���XG�n��B\p����~gI�͊94�ֹ����'nXOi� 7�@��Y�f�y�� 53�qׂ��ȦX��Q��To�I���P��/={�`�1��d��&Z�R��e7 �Q�>��Ēk�k�W���<1rf?� /,.�^O*�l��1��
Static task
static1
Behavioral task
behavioral1
Sample
2156998478a9c87eb60970bc4c0c2870a4d840a91dfbe2d91a9c579d724873d4.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2156998478a9c87eb60970bc4c0c2870a4d840a91dfbe2d91a9c579d724873d4.exe
Resource
win10v2004-20240802-en
General
-
Target
2156998478a9c87eb60970bc4c0c2870a4d840a91dfbe2d91a9c579d724873d4
-
Size
3.1MB
-
MD5
13ef0822745c1d48ee23598327ca0faa
-
SHA1
a9c206e3826aa649f4d640f07d3a5cb617570d27
-
SHA256
2156998478a9c87eb60970bc4c0c2870a4d840a91dfbe2d91a9c579d724873d4
-
SHA512
4fccb3b724ffffd63fc98be918122535e52bbc4430bffc0e483146c2047c5a637f91bd8f8bdd9e55a56ce3ce15fa62f4cb6895686fcee26bf9dc64d6bba05599
-
SSDEEP
49152:hYaVAIih6VJb1EuH+dbKPE+GdizcWOr2yLpebe5wURczqLDhnwxEoWEJxX5JFHhx:hHTfEEsIE+Gd81gj5wPzqxnFo3lFSb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2156998478a9c87eb60970bc4c0c2870a4d840a91dfbe2d91a9c579d724873d4
Files
-
2156998478a9c87eb60970bc4c0c2870a4d840a91dfbe2d91a9c579d724873d4.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE