IdSG��R���WE��4����+�`b��X��^���j�`C�a�⯼��\Cf"�Ĩի��&(%Gn�����F%FH����u�+ޟ��F{q���a��5*[(�}��-��H�0�ht��'�0 x!jǚS\̝q�P�:5��d5'����2�-;î�(�r�j��� �P�T{'z�"u����ٿ����zB���|*! yLc��� ����!\}�V𨧺�F����m(Sou��?�-�4����R�H}NWp��2��D^��lI9���,fvak�� G��n���R���A�+Dx^����2GM������Na��*�ꁃ� �$@��ƣN�L����-HX�ܛ1�ߪ6��Y��#����wA�;�y��Dd����oL�|8Qd5����vk?�s���G�p����<9���Q�&��Z� $1&G*��U��j��p�K%�stT�4p��b��o��+����<�Ԅ�O�j�v峆�D|8��r�o)��@���B�H3���Z�1�2����E�y��� �����4�������0)]?��B\ȜB2e .q'5�&�v�g%�Y�Xy���Z|�C����H�ڻ2�C�,�YN��(7�r!��e�.2���.�A�1qߦʎ��}&a��{G0�0Q�TFE�1�r�Cl�J�9�Jp�:�W�i!\M�F���Y�,:������,�.�����_�}��:��f'�'t� vû�V��9�92�_�l����u�щ=��HezGW��?�qqT�g�����vˊ,��pKu��iԊ�Z����Ꮡ���e tT����aص?)��+v��1�3��'�挎(�����)n�/a�J-��\�f=&^N(,A��ޕ w�t��Ȝ׆H�K=���̗�އ�7KZ3�>���L���{��'gv�PP� ?�F�;D=h�'��Hb��*n!c��@9��.�G5T��H��+3wJYu�{E��8Ua��4�垏*Ŵ�9�~�5�-�"���>�deg��NMEp:V��(�� �֞'�}��Y�k8��Ⱦ9*��|����2S~�z����&%yh@K��e��@�"=f���d΄�U�Q�Ԗ�����jÛ��Ԝj��6��*�����H���9��ώ'C�$1����_%�M7�d�v�BxϽ)��,%������2��<]:�\FH����T�K�H�s3(1H�T�ԋ�g[*�:.$*�!��puh�]ff1�����S.��j-��D�ێ�uDh��&����U)J�8m�����dA�`��7V�fZ�p���r\3�(DBC#=��oo��A'Q��B�{�O��S��!Y�OE]��w�\���m�KT����rk�{����P�$K�1l��|�忧"楎��U^�{&@$U��*mG��6ͣS��AVy�i´հ �WƐ$���Wt$�$ �N����"O�����;�����K��#��X �8��\���� �/L�&`$� a�g�_�[;H�T�0��@v��oީ�K��7siҀ6�\Uҋ� ����u� q�kam6R��HϞ�B�R�458�أ���`� �*����C��/Q�����Ӯ�"���j�U�M���^�Y�^�lnx�נ���-�M�+�+��fʺ� �~��p��4������w�(u+��M>O������.Z�E���\�ٻO��<����pD��0��̳B0�~��~�S�ƚ���e ��Iz3T�P ����� 1��A�0�b�#�MϬ�Mt rG��|�� ����O0���3YF���棯�ӥ:gnZ|��4P�FH��떘�>�(Uv;�#W�����ḪV}��ݶS�l�*�|Ť�ie>�Lrd�=�����D���H>[I�@ۻ[d}��@�E�P~8�Z��2�VgXx7G�|��1��Ca�r�ۚ�#�����������6��X��'�B��>�Z4H+��4sҳ#�=�9�Tg�X1�7�š��܂z����}ٷ���]��w2��@d&;mbj��xն��,� �ʒn�d���dԃ��2�U;��P?��'�_��d�O��� =p�˾A}�Y�Ò{Z�����{u,����*ThOD��6�Cy2/)���"D�Jgsz!;>Ne�J;z]c�:��6����(i}Ɖc#]|KNT���Z��)�^a�c�H�l)ΠѤ.�l����-��뷵^�7����-�2� .%w��͂�Ȋ� �����&8�'��pϑ; ̴���D��#@N�v��w1=��_�� ���Ń�>ը��A���Y�bo����/������_Tu�~��/�p�r��"ݖ���� u�J�7Z{ A��2L��1�E�������fkӼ �>:�-���������jCT��� K���*�+f{/�z�����Ŵ�'_���j���x�F� ��K���6XO�G��(o�[�4l�Ber�����$;��B�_�4�ŕ��Zu9�oOÁ����`��oc�@&J ����%�AL��b��Տ18�;�7����L�������ղ�Gm��W��F��X�=6������7�,��l:]T0� }龼��H���6%4pl��P��D�!����_����\����`Ѿ���۔���#"�`y�����ݤ��8gn��A�o�jBȵ��%mh�G\�b���P*��:��v�#�q|'�Y>������1����ȓa C�h倓�#X&3��a��K�ҢX�&��س%�RЗ��g�����R|�y^ǻ�0�QV��z�'"W��}z8);n�0�j'����}��F��֭�E�?���n(�A�U9�'l�ʉ}���&�^��R��>K!םZ�o���h�wo������aN*���>�����}�j����l~Mx��T�� �.�䀸~��˭����m��Q��}M�6I�����ep�u�4�'_�j_[���j���u��J�)�K˹ь����5B_$�2�I���J��"���ǟ�{V�zrR�R ��4��)��R�l;y���i�ҫo�t��A�w�U�$�f�2�����m/(���D[ ���4{��Q?�ف�ϙbABܯn���e��9�dĔ�#��;T���+6|L���~ ����ț[�Jڟ�+��T��Oؼ�A��u�Yp��+��56?g@�y�� �ȆN�eW �@.VVl�HO �т���.�7�߿ۄ\�Ä� CF�_R`�����d�!��� 89���k~G��:��e�u�HT��(�R}�S�)���Q�4���~��s�����mD��ΐ����o$���;1JQ��aQ�-���w*�Dd�ƚ�5��R5@��-������J���1,��ˈ!S�E�Dj:7����L���|T}K�[ XN�}!���oT^��l�,�L��f�?~��8�?Q��*Sn�k� �����(Ru��ɊB���+?�j����寴�9 u fT���SE���c���ՠ�B���b�#J�ߢA����
Static task
static1
Behavioral task
behavioral1
Sample
f6e84aa7dd44f897f3c5ad8d1b8c3095440db6343a2b1c6ccbf3b0e8e0a50d36.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f6e84aa7dd44f897f3c5ad8d1b8c3095440db6343a2b1c6ccbf3b0e8e0a50d36.exe
Resource
win10v2004-20240802-en
General
-
Target
f6e84aa7dd44f897f3c5ad8d1b8c3095440db6343a2b1c6ccbf3b0e8e0a50d36
-
Size
5.2MB
-
MD5
cf010e3ca31ab6be74ff8164378a6a1f
-
SHA1
de95c9406b6a7491c89d8916cf1d32059aa8ed74
-
SHA256
f6e84aa7dd44f897f3c5ad8d1b8c3095440db6343a2b1c6ccbf3b0e8e0a50d36
-
SHA512
a19e44fa84f5b59d931a2f02ca8cb1d4d7c70eb60ff224f4fbaa798352fa6a0c72e265420deeb8a34e766d9da7d000fbf3dcff6be7561a524253346dae545fb8
-
SSDEEP
98304:kYBCS8jZYHii3mF4VgHAQJkWWgmt95CpLR4evj0GQB/X:lcOCgmFQTQ/6Xm0z/X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f6e84aa7dd44f897f3c5ad8d1b8c3095440db6343a2b1c6ccbf3b0e8e0a50d36
Files
-
f6e84aa7dd44f897f3c5ad8d1b8c3095440db6343a2b1c6ccbf3b0e8e0a50d36.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 480KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.5MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE