�8$ 2�����/�4�8���A�l:G�d�͊��[-��G��F�ٝy���7B�_��&!�!ɤ�F���������n���۰���ҏ,�Y�!#2A�]T����s�mk������1�U\E G��Y[,�����g�}���^�Bp��u�z�vC�2/߷vͿ��"������#:q�;F���3��d8L�bSmn������ũ?c����A~ +3���%f�pIf���v����'���3�)iǰ�E+� 0����?��қ.��&5(��N�IfwӍS7��ZIU�c�Ë��x�� �Ÿ��������̐�#{�º���ĺl8���J�>��+,�C�����h��� ]a�$S�JS�K��7��� ���㚆����P|A�J���}\nt�j�U��>{d|�E��\���=X�W�l�?�[:D�"�SN����Ow�ٔs��ʼ����;�F� V���{�Vz荷���{+��D��@ �İ3� ��K.������/�h�Ձ�}�Xd=5`S�5�P�[�',�5��jO ���y�J�羃�9L��6�6���H�w� ����9�.>-V�z���:�'Z�9�X�g��+9��lE��iX(����]�b�F&���aT�?�_������|�.�.#;�\�FZn���̵^��v4 � ?o�C#@�lS���HOװ?�[nmr���AԔfga ���$��ϕ�����<��qr]�5Z�� �z ES�l:h`i���%��PXW�Z��/=����|�Y��� -0?���������G ��z���~�Y-�pn���#��ܤ�|J����j�� ��4�E�-����g��^���x2����$OU�b�<�Ѯ��\?;t�[JƇlA�b&I�rF�>���-f����USs ��������a�x ���[�j6n*�Ӳ{X�_a� �nP ���&m:7��r�S��Ex��������w��t8̟/��~�a��k{�8"~�\��[�y&�Wp��YB�Hn�~�{��z)ߜ��i�R'3A 5�u�C}�O�gk��'���%mjհ�v$+��ֶ�'�(\<N 뉀��uV�oV��o]�� ���p�����^�^��qx�h�}���`�R{S������X���2�� ����Ӏ�G�Y��̈́;�#�ԗ�4���$!�f��߳���̮ʼn�����J%I�A�����S��8�$�j� ^���O�ć�tG�������Pl\Z��y�V��8�O=�WC��'��tl�f��B�u�r��k0��NB��z����9���� e^�Kk����Oȝ���Է�Lj�R9����X�W���KY'�9�^ 7��0ᑫ[=U��".��_�_���������/�YM�5��߰��:�}� �WR��ֲּ�ăc��i��m�D����RDv#��C��"� u�8��_j��R�����YC��Ӑ~R�ma��k�n7v�+�� Me����_��"U���u2�+�=uT��,;�A�+_ϯ��^nໄ�xA:���U C�./7�\Ŷ�������އ��+8����#�8���@��pA�W�L���t9:���n[��;���B�4Ⱦ�dٴM�Z%���� ��l��������V��+�`�������yN��EQf�<��نA���)���ej�0O7˙���K���/�\����@ E����s�u��"b?@���g.���:+�ͅ�X'ۓc�\G��6��bAA�7f�K톋�5`�E1�R��������*�#~�o�kKÐ4b�ݺ��ږ8���Ck6?YfG:�߭< �a= ӏ�y�L��fe%D�~�_ܠV�(�c���ljF8��t,�AB��Y�d���2�uU��X���/}�(I��W�w?��)?r�^���3�4����H�Z����3О*�w���S���EMy^�5�5&2���\�F1a��\"%�3hQ�p�h+1_������+�ۖ]Oj�O��N#F9~�E��WE�Z��\�(c��S�G����P�^�~��,hһ�IZd@::374T�D������M�<��" �5,5��W�;�b^!Ybs��EאJ�ʵ�����hfl��GW�7�ϝ��!����fD�� P�e�15�I���F�&��'rv�xJԓ�l����f��6L�*\����F#�@�;�+c�eM:NQ� t�����H��b���)��an�ȿ���~'���� ĺl<�T'�zARqi��-?>#�ᤇ'���!$ �r���o�Kx�H�Hm7�o�o���r ����N�;�5~'-����q�8���j].��}���1a��⼺/p+��i]}�L�g۾�k�]�Q��z���B��ě3#�� `�zyT!+��ե�)���8�IcRM=ɥ�(oᨧ��-z83�����ܲ�*�aЙ���4��./�%{��y�a Л�V����U�K��w�eL�f퉎��Hy�%�p������b����.��� ��T_�u��I��:����ݐ�9�J�g������9��|�M��E~��I1;��s�]ic�0��ޯYc�tq��:���vm�K��d��0�u�42!�gzj����?밙���XZ=Q6�ȑ)�o���cO�߹�� r+�������ԒK� (Fe �ճ�����q5�T�Rx�7p9��帰a�D��XxԈ���%=������{&��ޭ�N�1ϊ�.f�`>z��IH�,�T��-�h�-���"m���4��g�=�m�ۏ�S����GQ��Rɞ5�>��wx�E�;0�����y��(:MFAg#����N�\�����d�u�U� B�]Y-of�qY��ď����C��7��0��@��pH�F����mP:1�g��HB�N"��W��T��{�� ��UN7>=�p���:�E�'l-���K w�O���mY七�[ �;L���b�U�R��M���{ڣlj8�&}%�e��*4�ު��d�z��d����D�az�6F�E�t�V�/{�LT� Bʍ�����a 3�/��^ojj� 0?�G$�M!��u�~|^Nl�f����I�{wھb�i��E.�$�b�������2s�I�ct�ts>H��M8?�zU��8�#��I>zxÍA�i�H��N�>(��5��d�ܿ���I��N7%������MT*f���^��!�XV��1����})�"6���Ϸ�!��Ʃ���E��iO���C��P��WSvB5�[a��NB���� F4y�O`h�Ʊ�N6������QY�R��:�9�
Static task
static1
Behavioral task
behavioral1
Sample
e35c9cf6648a818b97486bdbe6780beafc5a3d03af96e77746b3a3487018db55.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
e35c9cf6648a818b97486bdbe6780beafc5a3d03af96e77746b3a3487018db55.exe
Resource
win10v2004-20240802-en
General
-
Target
e35c9cf6648a818b97486bdbe6780beafc5a3d03af96e77746b3a3487018db55
-
Size
3.9MB
-
MD5
3204dce12493e819d862cdd37e8d4882
-
SHA1
cf438ce6d89b8248cd434317e603f1192ebc1732
-
SHA256
e35c9cf6648a818b97486bdbe6780beafc5a3d03af96e77746b3a3487018db55
-
SHA512
32b6112f28dbc4b7766fd8fa5213ca6827b387bb764e816067adf184a17c67a34398d5c414051cae1d85c85fe388bf3c75b3e9a6eee8bbdb3c2cbdb118bb44f5
-
SSDEEP
98304:TssI5bpax/z76lHA+dlusZoh7ZkOCLeDCV:TssOFaBz76lg+dlQh76OWwC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e35c9cf6648a818b97486bdbe6780beafc5a3d03af96e77746b3a3487018db55
Files
-
e35c9cf6648a818b97486bdbe6780beafc5a3d03af96e77746b3a3487018db55.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 328KB - Virtual size: 696KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 32KB - Virtual size: 380KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 204KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE