�!�%��5����1������3 sz�O�xz���/��p��n��4W��+���s $�M�_Bk@t�4fA����-�n)eи����R/���'A����N���51���HR%�����?��Yh�"H���|��H4��Uڠ����4],���F ?��u_D=E��_8l��&Хh��4��cH�S?��z��� ���!f�暕�!�Zg��EV��>��H?�0D���t}d���UɈ�p��h�B�7����_>�f�(����j���H���w�D�����7bO���^��z���9�����M�Kz����bsW�n�åb�,��8�*�����C���ek'%3z Gӆ��zU"�Ȩ8��+%�ʋ�8P�1Tڹ*)~M��,)IQg��*�� �cš�ng���F��Lr ԕ<y����_�,�[rxE����+�W��h �~vl��fU���W���T���b5����l���:z2$,��σ��SKa,�����T/xW۷>.+���N��)�i6��l�~(�\cj=��%�����u�����x�$�K#��h7\=�7$�����Y�Du=f��CC����/.Q�ġϞ�~��ػ���5��K_i-U ��ͣ�����5+�����6\�E�1WC�?ة#�ۻ�6�g�3�26�������U� RCI���&4&�I�[���,=i��^�?�� ���(��0*�N��pd�]a#��VNrX�2�z�`����`��-$�P�vb~l �����cZM����7w����#��Ȏ���x���Q#���m~}l�������ĺAe��8���#�|N��5�QXp��7��v��"mTF��ɶ�?��nHC`_�>��b�@gE��|�ZN22�8-��*��R �)B+���h��#�j� ^G�+w���u��9��u�B�+)%��Jv�Y-�a3/��\�(~�f1fu���>d9ָ��U�|��o�3e��[����GW�����a* Z#+k�D�8%]EV[qXn/�[�I#�)�`PQ�c����?J����_��˧ô�%���M5����m�x�)�����M{&!?���'�5j����3�i�L�D�s��>~Y���[��<�]������l�}\b��ʠ�dtd/EI��$����x#�������&n�O���X����)�u�Z��؊����$dݭ�(�W%��1c�N��@M��,h�Ȩ���{Te)^/a��Y%�;D�n���A7���?}^Y��5����xS���.�,p p�L����'�r���&)|��; O�� �����F�^��M�� :_p�ʯmP|�h�ų��}��[�������+�����:9���&SD��4��M?��� bZS��ɻ�[�D�m�mۺ���^�5\�3�p�aѻ:Q�Ӗ�ngr��n��� r��M�2�e�&�l�N�/{m����3��r ���D����,L��uz�U��xN"P���&��*��!Qj!��m�ۉw^}�����W��_O��}�4|��ak�Q.^�oː}ߡ,&(��k��ҳW�m��\�UY�����j~P�UH�����.�/�k�^6Uo����(FI�KzH�ؒ���5�3����9�k@�����ߘ+���L�Q0&I�Z|�̜�f��Hx��S(��6& �������r���Qq�w3���]�Z���Xk�d]����S"Z������`H�Ş�1���0 Q� W��;]�sH����p@�� �exX�p���>�<�,f�-��k ݝ9�����׳�Β�yX#-W�S��U���N�[C<��4H�}.1c����nj�Q��:1���^W�̰��_r���V�)����T����TFafnה�i&Fd�ƕ2��sx?u[�����p�k��0��Ԝ��5��q��hX'�T����ɝ�|jOһщ�us\����d���F����L��{n?�LC_j��%;����,�Ըb�rl#l˔ z�.�P��d����� Rh`s�����dI..�h�=�HЀ;��� ����\z��,_�S��|��ڲ�f7�܄ g���kV��ς8��hSO���3d9�y0�6]i�'�H����58*0a�C���{� �%����3���\Lf>��lz.�[�C�- �� ����eM��A���O�0�@� ]e2��BN@D"0�U@e�z���� ��@'�Oͨme�o"��/!)v�W�X�9+� ��@���|���w��"T,pX�>Q�E���~��o� A�2��hUm�瞚A;�e��6�� $gE L��(�[�h����>�c�ER� ���G�;����| �FXl (�H��%�.t� #س�>���于��Wx��9�Rzm/i�v�i�cP+��|&WY+���������bX#�/I��M�2�ȇ?�ۧ0f=ސ-���w�s��G��H߆cz/��9,��f"LAM���s�M��%�=�pR|��u�%�'U~7ژcݎ_� �,:+�S�a[��5��ml2�A�A�N9�����m��4�l���J�XK�����\�?{����օ��.?Y$��Pkr��]�� ��Њ2)j��L�]�*�9=Bo1��ry��5}0R*��3�ꨞ�����~�*���.ly��S�X(h�֨��x���s�"�q�� � ����`��k�� ;���f5� �⚎���������Z�o8��UY���=�([��_��j��X��Sߛ`��[ۛ ���E�����J�-Q���T���k�|�bE��8V��������� ��A�%w��ʴ G$`YU���[��M�B�jQ$�@�0hc�D�Ab����Ӹo�v�d4yxL�o�SG�6I��-�V�7���H`�l�_/��ߠ �tK%��Z��ðs��H~��i.�՛��G�lj%!�s��Ċ�\�2���C��'�}�;���n��������p�Ax�B<'ߘ���i���r�=,�ϬQTC,��o�4���u�^.E��ŕ�k�M����_���/9������OƼ-�%P���Mk[Zza��U���JLz������:�#�s�>�������:��nl|�\ ����7��C��%�lR�m;� -7�y�ID�j�-�/��Bh�gnƳ\�6���`P�dJ��\ {g��&�������4Ŝ��[��vJ�q�yNH;t��م�+[�g3~1zy%��� o�}��*q�G<,Z ���`
Static task
static1
Behavioral task
behavioral1
Sample
816e70b1ca8ca7f15b270f6fee61dafb09a76103bd1b43e7b5ac789bb3af1391.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
816e70b1ca8ca7f15b270f6fee61dafb09a76103bd1b43e7b5ac789bb3af1391.exe
Resource
win10v2004-20240802-en
General
-
Target
816e70b1ca8ca7f15b270f6fee61dafb09a76103bd1b43e7b5ac789bb3af1391
-
Size
7.7MB
-
MD5
bc00e71da1de6d10999059a9a9fddbdf
-
SHA1
a0465b6f33bd724160022448cbc3a23b55558335
-
SHA256
816e70b1ca8ca7f15b270f6fee61dafb09a76103bd1b43e7b5ac789bb3af1391
-
SHA512
842ee939f7d2d733f8dc6d0192b57bc8e4c19167b9890d9d9283f998f4d9333a1522962e06c4abb1bc0bb8178076fc78cc2909c51be6c7d6350983dadb1b0a45
-
SSDEEP
196608:ko/ZLCBZHnUx4dwNJmO40twCOgf0T/Km1yI8DU:lCPZdwzTwCOjTyE8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 816e70b1ca8ca7f15b270f6fee61dafb09a76103bd1b43e7b5ac789bb3af1391
Files
-
816e70b1ca8ca7f15b270f6fee61dafb09a76103bd1b43e7b5ac789bb3af1391.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.6MB - Virtual size: 4.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 136KB - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 15KB - Virtual size: 684KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.d23 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma1 Size: 3.4MB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma2 Size: 264KB - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE