+����%����L��2�s��,�X�L��8 U�C%���K�"ir�/��^x���r��s�H<���s�7�7�sRڷ&<�/�%����'_�.HH�;%��Ch1ޘ�Ф况l�[�J ����]���}��wM ����,�G�.�Ծi/%l�0��H\I}H���ta��0���ZP�b�x"�Y��G˰���!�����/�p���h3j>:Ѷ, �n���Ӣ���ǫ̚xp��-����3��pu!^�kT�l����È��w��7�l�c��[tZ�w�\�:r�^�J������^�Ǡ�63�3�}05�����?���R*&ʹ`K�cz�-mOS�T��*���$݆n� ̹�ʎ��q�����dMHw���cﳿ��;��0�aK��*q��m��9y1>�6{��X�x؉�� Q�h߃a����G͈������il�y�u��܌���p�s}��rϳi[T�@������yGAq�7.{,�~�We�J���U�,H�U�Vh_��ҹ�$0��Cm�O��Kr� r�8U�7�b��(�m���A5��<8Eᑧ�mb?���ܧݐ�5:8��=)��2C袯#�J��~����'�xR�̀~��y�������7�)�4K�6)�Ӄ���~��j�s�u�YVR"��b��[9F=U�kGR$���!�\;�#'�"�`� ���GԽ? 6a �����V�.�4"��u`.����4|���/�dJ�GH��@��ኘ���5f �xK�����(_4�9�l���G�ڦ��1�����d�f�����6C���M#���ī���|�Dk���3T_�F�l�a�a�Aof��Y�N{���\M� ��8���Ͼ�ޭ�P�K{�4����r�ɯ.�l��*l��ш� �0�w�f�-�^*��g��qA�B�W�������8��Z���"�Rr?cWY�넂���������ʨ\QbɽN8�eϴ�<|s_������q�e��Y�� ��"�<A�z���-iP�_^�����߰�7�{tx���#n���$��tȋJ��R'�,���9vn�"q���@�cE3�*Cp+M!��)Go�߅K�c�{Nu�7�ĸ������%H�HT/H�~���G�`!o���XCq�i?e�F�a0VE4=Z��s� ��#*��N��u������zXm��*f?�p�H�ʗ��שE��^�NX�ˊ0.��:W�?�s墋w"1x�n�`Q���}����"�̐�I���Yiyb �95��9�'h�B��b���p�8�+ILEj!��>+TM��p�V�#�`���n��c;�nUQvs!���1 ���#�/���'�NC��PA�1��e��r=��1+��w�ײ|�4�?�};����t��}�p�h�~��,��������P�d+�/� ��!N��R�]o:�aАrK������[��hTŦ£Y"(�[���R<��yf�)����>�������Rk��g�� �o�j��-x�JP���,^�r�P��a���YW �[��]��a<,�gw&��4a��.P��Ҩk�z$P��u���M6��G��*��p��IC�����4!G��wbo<��5�� �[I^�Y�NCNk���.I�����ϵ�t�{C-hhuE��u#�� Ŕ��{f���Q����'�D��Y�\_0Yk����d�r:�BX�s!o�>��[�]*�ׇw�Ђ]\Ypc���/Bf�����U��N�̲��+�����O��U<���,����l1룉�Pq1��QYUT�Il���*�Z@�� �������[�B��&�&<؋����8?�Cif�x��I �[��REuUhr�=^F����#hNTC_3Z���5z�%���� ����Δ�(� L*�>(F���������)7�c�"�U=�������,��Is�; �g*�ᡉ�ue�;�>�ZM+���J5<� 43�s��U\��"u �W"7��(� 5~���,����f)��Q���!3�O�F.<Ό�~��Ċ�G��&Bq��]�a����c���5���p�h/�`���Q���S%{Z��ϫ�{��Z]��l��np�FՀ��-�|���b����W�o���/����ub����8z.#>Z� ���鱲HT��yZ@�z�� ��8B�}T�sV��9N'dlk�6f��i�j�K�%U����梁��9+��>���r��%���t�/�b����I��B�v���� Ճ ����<Q�����g2���Ad�t?�Õ�!wӧ�=(��u�f/`=�f++-�F䗊0"���&�@���@B�>���B$�<�<��?������?�W@8,O����tH��*�=� �eH�������4[��)XN��ЩPI"��&��'ހ+�˴H��,��PV.�s� bqb��])�lA���4? p4�`K0 ���dB0�)����t��ӵ>�X$����E�V����l����Ϫ~Pӥ�d�w�uK��ryD뭢�8����#f��uҗ�US�f�tL:�a��!��!��<��`ܮ�#V ]��j¨D�ŋG�^�`��C��y�R��v��t���nk����g'��.���+�7��"���j4M{�5gi~���7}/&<�c�,��Ó�u���$�����y�K�^�sqN?A����;?\�j��pųx��`18i���r˩� ���5FR��~Q��t�8�����L��٨p���Q����G�K6� ��h�p�YV%�ф�G������Ó��<tg�W��c�lG�D7��6Ye�T�C�y�%-�+����^(S�����҅��?�@7s`q���z-����s��r)��ׄ���wB �w�!�q�RJQ����X����`��-+�@>s�˾�P)47�;�6��2����6�ϻn;�o�Q}�i31{łMV��!\X?��o6�Ht�!5���%�s/9&*U�%� h,j�d����+�4�t �Nј!"m�ѿ���q�8 e��[�Kh���h�8�)z��8�x~�$M�m:_�1�M6��2��=���5���$��3V���l�'_�7m��s�3枘I�~��)PWp�X��n�u���r�;9��/"=����u��+>�!Nw2���rq�X��k�\�?�+��c����(*{5�������$)�6`X/y���8��썟�c�5������\��$i�-{���@Ń2^�i8 �.�NBw�=@�-Z X>�3َ�u���"R�v���`W��ڜv�q���C����X�3��X�T���K���2S47>�T�yLd<s3���u�d�$��g呶��>���>$<�/�l��lG ����B�s�����,�$��Du���j=���&�:�A��YU��}��y���|��0K���D����38�Sn��-�I��;Q��&�+Qs7a�$�=J�j��kҩ
Static task
static1
Behavioral task
behavioral1
Sample
b7394e779adc4993bf887084687a8bc8a19cc220ab3da1121640eed820a0f4c2.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
b7394e779adc4993bf887084687a8bc8a19cc220ab3da1121640eed820a0f4c2.exe
Resource
win10v2004-20240802-en
General
-
Target
b7394e779adc4993bf887084687a8bc8a19cc220ab3da1121640eed820a0f4c2.zip
-
Size
4.9MB
-
MD5
bdb77e74ec41ddf18487ae3386bd4a4b
-
SHA1
3118c7c855cfea891a5e62e9b4ba705925c560be
-
SHA256
a4a6dbc80d424b91419ed6f57b87b0254a5e7028d552e2d05d9df5f5b593682f
-
SHA512
120ffd157b4699ca85d1daee471ad1538dfadd92c51a4191c53d8b816e1bf1dc54942ce908612ab764a609b3e3ce6ac600dde3d06eadbbc4034edc37db1edd38
-
SSDEEP
98304:es+X3sjEVO6XXJ0a8hvOiIbcYxcOAsMDPOP9Xu7Rk+nTkLxWk5p4y8n+p01KNmTj:b+X3sjEUwJZgvOfbbcOAVDw9e6+n0Mmi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/b7394e779adc4993bf887084687a8bc8a19cc220ab3da1121640eed820a0f4c2
Files
-
b7394e779adc4993bf887084687a8bc8a19cc220ab3da1121640eed820a0f4c2.zip.zip
Password: infected
-
b7394e779adc4993bf887084687a8bc8a19cc220ab3da1121640eed820a0f4c2.exe windows:6 windows x86 arch:x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 292KB - Virtual size: 292KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 7.6MB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE