yD^�kA&�Lx�������.u��{jL��Ν�@��V��M�N��3,{��A�'�Ǡ��m��x��%@^�筲��|�|���fqo�����t���L��c�@�����Ɛz��5&�nX�B�� ���Z�����*(�L鴈 (�������� �eT�� ys�|�߳�@�T/.�CK�Et0z�ؓR� �^M��C~'���&����N�"�SG���4���2;b-~��l�lc�`Jm�8(]�:�Sc "бF3�2�(�ݧ�~�g�)LrX%�� �L���k�.v�v&���̌�/LQ��z��"9>Ua|Yr�É�K�2��}��u�����+FhvE���ZB���'ai�^C��h�BN�����������d=Q�.)cAv����7r���,0�������F�����9[J���5��.#4��&��D>+�����w'�g�</6E[����3����=������� �G#P�pn��V�ߢ��^�92/�;�#�8��F�0C���t�u��Q�M���%��@����j����Hַ��e������D�g;���,<���������I;�������\���#�3��n����K�_h��l�Q�d펯�WwT�$i5���ߏ���r=Ҁ�d�k���%���T�B!F X1Qxb+�7��0 ��]��L:u�0��T��/�e��r���g��ƔeC8���L����k_��֣���{�{�N�ZeFr;��Z�Zn>�d�{���q�0 �9�h�M�vu��f�i �G�?������=|+c��'5�2i���f+y.~8w�nȗ�m�'�����]9�7��69�t�Χ��e�+��㩾u�t:��Y�0Y�f)��#t���y\��y@7nӒ�m$v�$�Q_ֳmZJ�F�j̶& ��KI��m���n嗢��F�,1��1*:ù\�-t4��ijFɠj�c\9�Q�h���N7�h���*��&A:�eD$zn��0��tS1� ��TQm)���5LrHY��vc���1S�!m����:�d$��#�W���z^�\�u<��s@\�:���A������Ҙ D]K���T��uZ��'6�D��D{+�Mԋ��b�آ}k%&N���x��.��(J/��g�vf<7`��t�Q�n��E�+�؛�F��m;��V� a+n�=,�?Hf��wU�@6���-��B�hI5�������`�N�]�l�9[��ءB��}�Z�x���t��ޗ��Up�� �Bf5ki;[O��cz���%�r�(L\UTtô���=��?&7�IP��RH�I�B����i��G鑁$:,��[^y��}0y:�ZgHH����i�5[� ޢ�$&� o�}�M��"�yU���J�f���(�._�J�Z��܊��ͬ%u�v��(�kyD}���h-5��)��d�/<G%Q�n*�(��Ɵ��w���!��m / �K�_��N�K��Q e:O�^�����N��K�b�����3��[g7�o$���~�p��ZŀF�S�/�������¿�s��N���]z�c��ӧ� T���(;�q"������-���_g#d�8s��B���Ꜽ�t��2(tO�t,�����H'Z�>�T�Zc;����%&^6\��X����ogn�.��$�H��:i���R��G�_W��G5��))�M����k&�d��s�*�u���:�|��wU����B.*�%��?�!�D`"�����e0S�r�\|@Q���{���#�Ҭ���?��V��Y#���*���Z��'�:o�t�+#1�O�п�5+OI�n��5�,Z@>�,K9� B�y��o�q��䣻�Z0z�/�s�1��ƤL���_��ac�ca��HD�Wh5ֶ���n�c�m4JTb�\qxL�O�y���8�c~��r����8u�(i��/��L �d6_Կ�9)YTd��� A�ا���@�)*�B�Gr�����-�ms$�nŇ� f��= ]�0R����&�~��sY��U��w3A@L@���S��'����b-�6ŗ��"�@Y���j��~/m�����j�Cj��CD��{� ��5����lwݜa�CB��>�N?ߑ��_��%S��<�ā�w�M����q�xZ`K���G!}�Xf��X|��)7ak�>� �2��e/8�2\���a��N ˋ�s����� n�f.{?�=#�1��dǹP���0�|OF�a:���������w�R�b؛��hq�U�e���\%g�y�[��˦��E����z@XU�Q<f!~�����b�T���2?l��ꭓ�Q�MT$�&�hS<��K�9�1v���b��xЏmanCmS��UpB"�]w}]P��z��bKs��;Cp+��5�� �`ۨ�tv�=%��S]�QJ��!F�U�k �h���Nʄ�L��^j���� L. ��-i�5D����ܝ�)!����VwG�`h�ݵ�OӤ����P�H�k���0�2� G�)��w��D��z� A��%V�IKg��@���m��Q�E[ �Z�c��=��t�&�3E�����d��ĭs��!U+� �\2�5ʷ�F�C��#7����P�'*H�d�j,L"���:F��ĭ�xQ�S��u�Ƒ��6���1t�o��a������X1�gI�}����q@�q����~��U� ���5�ߵ����qU"}��@ �y�\ɥ*��p���iV��8�����5G� 1����$�.//�-����_cL��jT7�U��F6���k�dc�KIKI d}������/���]&�P�D��|@C�#{o�c7vTt��k���/�����>.� �uq�d� ���SA��=!�L5��^�4��jLv->r�YH����<d���4Խ�J���3t� F�9�tlj������]~{i�> �c#F�h)I�d���q́��p�`�5[58�1>�ލ���%<��~A@��Pn.��x�����)���6�5��u3���{����_����m8?�Gԭ���E�C�6;t��XC��o[���������"�Z�^R�\��#�i����{vI�1�^f�1$|��l�ؼ�S�gG����^���G�=}I���5]�A~د�z�<��=N��H��"]����,�����I���Wg��۫���4��p̀�/+����8?��.E"f7h
Static task
static1
Behavioral task
behavioral1
Sample
e64ec56bbaf4ce9b423fa94b3d0880e0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
e64ec56bbaf4ce9b423fa94b3d0880e0N.exe
Resource
win10v2004-20240802-en
General
-
Target
e64ec56bbaf4ce9b423fa94b3d0880e0N.exe
-
Size
3.1MB
-
MD5
e64ec56bbaf4ce9b423fa94b3d0880e0
-
SHA1
059ee1612bd26c7067c6cd9ea4c0ecc1738fe048
-
SHA256
4ee12e24f09084d14c46c25fb0da1f994d2ffa2e65e5870174d7e022b6a3b7e2
-
SHA512
51548d56b151a8bdcda09472d51e343b774d95b091853f433f9d7707c5653f96a7cbdf5b327717554cec26a39abee657fa1992efadfe6cd271e5e4b78a23ae24
-
SSDEEP
49152:GMcFU4+MRii+aLjcw4VwlrtXJGWAUfO/GGMuu8+LovFrrkWxov6QCLIwsVvC:GBTRewmwr50EWDP+krrktCUC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e64ec56bbaf4ce9b423fa94b3d0880e0N.exe
Files
-
e64ec56bbaf4ce9b423fa94b3d0880e0N.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE