�5V!t�&���|l"�aL 2�p�hK���!p���-^+��5�:dtB�4�fd�����T>/����X|�� `�j��B�����LN�FK�Kh����x��QlU@Og.�i�ZxoX����=P��,�� j`m�oR���}��f�|A=0��у�$��eR���M�`�q<Z;��KupB9�N��J�TI��K2;m��SX��_����R�!{�/�<n>����^� ���>�oq��0�<�5 e���q�w ^��^��N!R��-����(n�|��y�m�|��%�<���˱7�yc`��2��В��nT>�v�;FѢ�2T�&�̮�F�7�`GI��к>���t���`���6���=�5�Q�:�Yہ~�XiԆ)�:V� ?p������-�H���+z_�^#�G��>�o�K~/���L���$0i�Η:�ۑ����{ ��緒��co�1��#��^���(��ǥu�Wj�OgT@�Ҫ|ۿn.c�8���8�FTZ`C�T��m�>�C*n��G:��\:2?���Z����ݝ����t$W2z8��?(� ���Um�跢��}� jWg�6j�f���U.s�r��OLeq���0$\���cИ=�)dT_p$���G������ ���o��3�נ���?�� =�a�g$�鎒�\�Z�4暘�PN�y�hBυQlG�AP��e0�P���Fӊ����Բn㆓^)%�o4� %��(��9�<����E\R&����yW*�~�,�1��/f���B�� U�~���ʀF��|"� aBA��)�Jt'�,����6��l�����L��t|F��lp���~��H(�y�5ݘ���%�!�W%?��z�*�@��X:�U��;����ѨנkĆ���)D�α)�l�C��� ���HƯ|��$F�����9�@��f�()tb������� d����e�e���vk�������h������kJJx��g��%ʋ��$ND��c��[>9�=ema��j�C�B�2?>���]ݬO�X�� >�B�����i�l\<�%���>Ы%ÐE]�倲W�Ħ���AD"'&G*K��n]�� �E�ٜ������'*�y&mQòN��q=�s<��B^ ��OQ)!��.Y�^%j��j�-�J�����sɱm٣��u��u�x����/6a^�Ҵ�y�ϼ\�s��3�,[9���ʐI��e$��"��Ռ���ܴ���#)���U����B����B��Zc� ��N/,!�{��>��x<�y�=Z�����{����Q�r��'��%��`�l�tAr�H픅M��ƒ]�������K;`ݬ3\R������A��E�W#a���/� ;>��}W[|���b����jl�F�B��5AADZ�Y��s��?*Ll�^@�v��7g���< 0���#�+c��wZ}���}=�� �(�k�q���2��`�_r�A�i� �E����_��?�����4Uv����}R����C�K[��l�d��_�6/���w�f�R�nI�C!%'�^#��ͳ�ygMlJ����2)����2�kQ���}\���X$���:,�ǔRA;��7LcY�x�k h�,���I6s"s(M��_拼�8k�-5� ���&�Ě�� ��+S� ��O��������& ;��P����G��ݚ�"�҇S8=�Y�)H���9�0�?���2dT3h��01��ا6��f .;z��]2�M�������|���4[�Ks�4�z��.d5X=��á'Eg�3�"{����Nw2��d�b��\�g�()���'��� ��O�| �W!�Z�$�����xԓ55�ƶgf]iF������@f��N��������݈��/N��� ��F���%�#���`�wM��������a*�%�s��9���ƾ��*�.�^9Z�<ŏk���8syi��ޝ4Z[�P�$7����hp\!:�B(�Ƒ�Yڌ�%œ��� �o* ��ϘTh�����,h(k(�9x�@�l��*�}$�)����H���^j�Îam�YX��Z�-��B��~{�a���wo��̏u��?5�0����K����H�������1ȁ������ ��%�> X-^C��}K���Y��E��s�ƗάP����'¦W>{��k���B��c3���Do���ќk��K����Y*.epJ��w�Nࠫ���:�AԂc�l���9���%N�G�������_f�H�xzԘ�,���Cy�g�Z�6���~������y?�X��L�iA�G�)u����G�&P�ky���fJ5���3t��$���*3�=w>�ڕ�,`�q����b�/T1gRin1B?�Cm��2ϒC0�RL-7�J��R&���IkQ��*f�!J�����Ne��Pa�B� ]�S}�D�e�7~���y"�*#���x�A��^�p�!j�(��?�h���e~����v��Uٮ csا��~�t���y%|������ㅵr2�8v0K��j��W{� �X��;��G���9��`�@1��OO�O�Ɣ� ��/Z�Gf�Q#Cfc&(p���,�/�dy��J/���j1� �:N�렞!�o���yy:<9j8���AM"֙�C9[ׁ^�И�M��]�6~y��<���$,�O5�q�)|�m���W�>�<~��w7բ��*�&*b�����e^&��17W2u�b1���t�I���T2�q8�*;5��8S�r���R~N*,���y\�t��R����WX�q��$0���rm0%�#t��X���f�Y�yj��r9m�h��F�ځ�Bc�|�~�{���i�����������92��\��o;'x��C�^94*��S�s|�FV)r�m�+��\f�yơ�7ȅ�D����ބ6��mS����+Վ �ř�&AN�B xpʦ����r��������k���N�#W$�ُ���&���Vgh�]���1��`9�T4: +"x�x�F�)Di4ʳ��>����,�����F,���{8L\�OlS=t����<���-�u.4 ��V�A�_�(�&kn?(u�"ϦL2�a��l�Pm�K�0��|3��o���̀pq�}p�=O��(ׂ��B@��(���K� ��P�b�ɟ*�zD�l�5(�7��A4ud�z��� h��,so�ގ�B~�m93<�`����o�D��x� B��6_�.W��"Mi[cV��L?ͦ��'�#�a*v�=���ou\Ĝ�/(�!4݉а1�����!��]�/ ��wv&�+4�����gM��W��!st�+��e
Static task
static1
Behavioral task
behavioral1
Sample
293223d58eeaa40550ec3e8833ce7a544333abd3584d7074a60e1dc26682683f.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
293223d58eeaa40550ec3e8833ce7a544333abd3584d7074a60e1dc26682683f.exe
Resource
win10-20240404-en
General
-
Target
293223d58eeaa40550ec3e8833ce7a544333abd3584d7074a60e1dc26682683f
-
Size
3.1MB
-
MD5
1f85c2e89850019fec2893ed783e40b4
-
SHA1
80dd8409ec1a24d63bf076a3636449a5132606df
-
SHA256
293223d58eeaa40550ec3e8833ce7a544333abd3584d7074a60e1dc26682683f
-
SHA512
e3af07d05d6bbcaca1c2fc0259bf65bb5ae7a13570a9670f23edb0736500e8ca37bb8a2aade745fd19a2f64c8b29c3ce575c09dde473385829a190a83204a9e3
-
SSDEEP
49152:6yvtPsPvbbR2HHADFNpqCeAOu/OQnzBN14FYe3AILLQcik5TfEk:TvpQbbAUFZeAO2zB/cAILL4Ygk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 293223d58eeaa40550ec3e8833ce7a544333abd3584d7074a60e1dc26682683f
Files
-
293223d58eeaa40550ec3e8833ce7a544333abd3584d7074a60e1dc26682683f.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE