�t����.`���1�A��| \K������T��?Y ��)����� -����!�֒M2r(��[פ�1�l�ye�m��í�:�0�4������&�� lI-� a#%�z߶@�OG\�� ��ݥA���$�>���~��=&�T��Z�ED��&�/�f���Y�GLE�S�BY*8f�1���+����}P���жY��D�_���y"���ᩆ����rg��"]/h�'zlc�]�U��뫀�G�럒��m諕{�z$���ht��`s�?O�&ܡ�]����V�c_# �� �>s���� �Y9�~ 4�#̠��Zn[Npⷙ�O����=��G��]k�T�˰��ԛ����`!X�6�*U˥?w��O|�bp�8o���/z`��*�S1t㘑��r�֯����5��3B륢���R��X�\�Y��D{lf{,�\�*��v��f�2��##������{oG�r��`�����_�b���v��;��~�j�9b��J�#Gq1 9�|�T�";H��������u_�aHa�i����"ݾ�^W���qa:K���� t7�8y������16�;�K�ܭ���8�ix��1�F�����9���y5��/��T���@�H��mz���p���9+'�!0:�lC-v@]�p��*p���5w�Ӂ=t��XS9� *���Ѽ,^�,����/�� =��c�A�K�����A�DjB_�Z|��'�P�8p�Ο�2������K)O�m���b�`�o���O���3(���4�w륈H*J��Y�Q��ō{K��������A���.@lQ�؆�~�4d���)�ٺu�"���Q�:uU�<�q�d-����:i�+��`�C"��\oz�~��./V�>�<7g6<m���a+�H���G�o*l\pK?wl��n���K&a�k � 1���9ç*�������W��0(z*�)�-Gw��0~x�+(O�^�ޒ��h�VX27�kd-���=�"��W�.������v�SzM�ҌH�C�Q�6%��I�Y�R���ǚ�a��P��)UM��WȜ;Zɖ����s�/k��v����.���S����=�Lk��G�Z �^�Q�����ٓ�ϩ��;������z�_�.<}!�5�4�V�z4�~���G�L.�Jz�X�}�ʰ��1V�Y���nV�/��3y@��]�����% C���<]��5�ӕ�<��K.�A�HM�`�8?�?�h_OՇ���l~�{T�L��}a�=��~���S&�����~��q����=�H+�^�w4�0/��g,Dp��\��̔�HyA,��-`#�q|i��������_BOq+��=��ٹ��#���T��%U��@�R����K����pxv1A_ D_����VQ��Rn^J��tn��ʜ{^\�L���k3�WJۋ��Y�YW�>��: _$w?���[�`��z{^�i��8z�'S�������>k�p(\N����ǵ2�C�r�#���"4k�#���������I�;���Q��(vGO�AP~ζ�W5�;�0k2Q��k�pA����A����$��"�E8@%��Ը4l�����KH�Of��A��1��83��Y�;�=���i�W�$bka+.w|a@�y�^�=ǜ9uښ��#�&��:��A��hU������a6�,��8������J{��v�{B����A�S#���O���������V�/;燗:�4�m��[�C��1eҡ�������c���l�o�?��M�R5�f�ki���[�}���L6wK���;˃��EDT�ݖ�й�����sB��OGЀ��"�"���]R�u#�&�&v�z49;=�V�4U6l�����x�� O�@�4�zֶ�lt�"r��L��̭����4GevTB�<��;��,��hz�!�V���W�����9q�1���W��{�˾�Ӓ��_ �z�:���d4=j�=�c��@'��am���+�����"W��">�,d��1Q������B1����,��ɡ����g�+�o�e��Τ{�m�W�����v� ��$E ���e�T^�{����������$Bvx~�ͧ�L���9tu�|k���5�IrN���.���6��u��(���J�m��9&��a��'���GMm�V�j��tzݦ����} 8��a���c�%���^4t;�g�rӪ*� xJ8��M �⻘���G��g��>���U�k��� g���ٸ��r�Ք��mg��^~��Cj�HVgt%��aKW2�#�A4iK�dgA��xG���a��=�����5�W��~�<ԩ��H�g�ݨ-��oT��Qz�N�\�h�f)�U�p�LV���`Vϣ�MW5�@(#��KL g�{�$���0�X?������m�i2Z=��ʌ����0�jIc3bF��o)�09O����&-��������\c�ѳP��*�I�h -*)p/����^U����U���Z��`rd�a������S�uh� D*x�L5-��Y6ўRƍ4������8���-��ą I� ��Kt>�)IT�� ���.yᨄJ�ѝ����(�:a1�Pb��y0r" O$����*���C��:����`�3����'�K$]����o�-`%���c� i0���v ��p��+���=2�2U|@7�;���`$��<�:Ι�Ö�`�p!�Kﳾ}'���q k$ Zք5�?��Z�B/��<�t):�ZN����{[F�%�k5n33�'N |�Er`�c3��e�<��!���q��x=�����K�ڒ�����,l�cZ����?'*��ot����'�t��#�}"�SY�5*��=�Y-�[�*���C����_�H�A��˯�^�~>b�KXKͺ�Qs��7=N�\��$���#F�/k�o�;�������� |#�nqp&��h�*Y�ڞ����:'ң2���/F�(Ju����h�I7��'�nQ�&S\����O&'�O ��1�u����������D��7���3�U�-�w�)8g���X_6�7e��L�����@,9�!��o$@���@�U�ە庸�� �3�C[v�}�*�#�Ud�m��t�Nz�������j���� �ǂ���y����Ӂ��[u��H#�6�h]��_&���`��Js����Wt$�K.s�ErUl���S�)�>�OF��ƜD�0�W��4�(���ߤО q�N/$���W:!���)�v���c�U҈�V��}�Eǝ����#6�DK`� G��s�_ ] �Nױ~y�C��T �4��֥L����FyX� ����}�8C�)_�;���J�3."μ�Sy��Ԡ�[������-��)��,�(�T��{6�[^ڨ�4�>Wu����������Z�)a؆�
Static task
static1
Behavioral task
behavioral1
Sample
f942d5a62da02fb646574af0259c6c2f16d338370d004ab77f5d4f1b59f9cf1a.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f942d5a62da02fb646574af0259c6c2f16d338370d004ab77f5d4f1b59f9cf1a.exe
Resource
win10-20240404-en
General
-
Target
f942d5a62da02fb646574af0259c6c2f16d338370d004ab77f5d4f1b59f9cf1a
-
Size
3.1MB
-
MD5
cee03893acd8cf955d1e44ecbc0883bc
-
SHA1
ca1c79c413e2196b192aac3544b9a7818327990d
-
SHA256
f942d5a62da02fb646574af0259c6c2f16d338370d004ab77f5d4f1b59f9cf1a
-
SHA512
fecdb2c44175cd591527a5c4613c01d82d80b71d2570fb138704454cf104344ed7748f93747cd621101f2d40521982aa93ed00a8a5002fc8f8900b8f7bc4b769
-
SSDEEP
49152:m4HMa/zj/VS5cw2ip+RhItw9lq26rWYNSm3Q74cJOJCuDRsv+RN9vzvWLpW:x3bjdS5RAYtK4xlSm3s7OHy+9vzu9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f942d5a62da02fb646574af0259c6c2f16d338370d004ab77f5d4f1b59f9cf1a
Files
-
f942d5a62da02fb646574af0259c6c2f16d338370d004ab77f5d4f1b59f9cf1a.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE