#��z��OkL��t�GY�cޅ�<�4P ��'jRqDNN�}S�crY�T�F�:�"K���N��ܘD�Eb�FݻkkӰ�z���oߐ�X6z��Q��.ix%���j���gH>Ч�8����<{m�ڵa�-N��_}.�LxB`��8��V�r@Gw����UY�n bI;���F�r���7�1���9sq)�ф�v�f��g)lfijfٰ���B���I��X�:����q�Tx� Z���l �a���u��������R}��f��N�3��R�Q��Mx�� {Sl.@�O�,)�_UP+���`�A�:'��҈�iC�/;/�%=��pֳ��� ����H�PR�����U&��sn���ݾ$ϝz��3� "��@1v�{p�d�d3щ����M���]�6�r:�I`�Fsm��]m$�'W����M �o���ՠ@��Y�w \̗�p#yV����H���Z�'�P���k� �����D>��D�u�tj-A^;I��������tZc�td_���ہ�n%���2���I�����(������I�Ep�0��~��CMYjj��k�AO52��բ�=G���l�ըDH1�1�W$��b\k���\��k�i���!��)gՀL�E�F������i�]�Sk�=Z�.O�.�ry��.�*9" ���% J�B�D� k�廇�:��NC\X�4So��^5�9�^�h4gU�,�-�Ou�v*��Eu����z�pc�u���`c���K��XXR���w�� 0�|!8@���T��=&�<o]8c����]I�C>�8����z��o��O�5��s�>�SBK�U�:�,:���ٚ&܇�g��������x�f$Q5?;�\`�պ��Z�0�oK��v�1��JW���2���&�(ĉs��v�[�@�l 4jp�V����YZ�h%4η���q��Uq$�fq�?x-F~�?v�>�[|�c�nn�ާw*��"�Z��:���~��m�P�f-4��<��a��Y�z�m�z3�$��s�N��4nzvS�7�J�]�%{�m��Tm��0�F�&�A<?1�,�p��b��͠W�M���TiLw�a�ئХ�6�(͊�a�L���[ �3�%z���W�x��[g�J�����<��s���M����=��(h����w�~�C�D[������:6�L^���j�#�5-(��}�Ȭ�pTXַ��dx�)F6L����@P6�SidP��ez�r�ϵ>;g�)R{l�8�ş���cז�C}ۙ���#��o��}�E*4��:�9߲)�.v� �i���d��~�-��0�ֵ,VD2�8'|�@�����s4TRqχ��ኸԫ�X���O:ߌ��O�C���B��M��J. ������_A�ҤC�%=Uŝ;��K��FtLp 6����T۠�F� ���Ux�f�Mn�2Z�b���5�}�M.,����:N���"��|�~���'�p�-��Z8�{����ܹ����=���W��S{�R��L���s����#"����?.���;᧩�r��W��I�9@ֶ��ٺL��J���\��\��+����;�"��3��/#% &������b֜H>E���(�[��{]� *�N����s���5��ʹ��qc��[_�����S�d}����7S��kuQs���g��Ci���x����:#��QE�Z<�r��~�O���&%��+%�h��e��*6D��3/Zw��^��NY3~6��xӎy�u�@8�����`��[��d#%ŮVH�ݦ�Q���������xcY��2��F�07��R!0�Q�"ܑ�ţ7[)�FUޒ�Vi�m��S���A!EM#�^�`h��%������jjr�ir����\��5�QM��h# ���W67�59�嘧q�H���R���6��<�1)�"^~|� x|�ҷ�K�N�V���Bl;���b����£��2H�F��32'9+��� ��|�M@md�36���(YLz�`������l��$�?J��������;�����1.�2�RFl�Vۃ0y�����d�NCE��\+��+G�xu}��Ǻ�]�����B5���m��Gk�g���c����3��I���n-������d��I>T5��&�qpK�@�v��2`�ʚ���@| ��5�c)Bt�����}\����m�@�"Uq�R��+��t�WËOc'�j���� �������^���ZSG�5��$�C��]m;ltV���4<'�S�.�]��3�� ���':���@l+��U��Lu���+�9������NĊ��野�W��;�xg�L��A��oSr���Wa��������FЀ����<���RX��h��L�� mM�N����^�0����ţ �_Um#�rO3��N�^������3�X�~8�R|�$�Zt�T����a�0��A[��ʯ9�:ˋ��ȇ�t�Φ �tXy�O~��Z��3�F8��;�zJL��*�-��%4�\Y�#Z�L&_?/x��D��ym`��V��H��9���?��x�%�R��_=Fq�+\���]�mۓ:�价��I�B������v���=���uB�}�I�Ң�8;�op���VK�q�r�Q��E^J������p��\-n�<�X��^}dʲ�^�U��x��˂t��I�����N�8h^s%���A��t�o�f�Xߙ�i����q�y����Lb�=a-�ߖ�N�pD�\[r� ���c�ծ�D� P���<��e�ދ�wG����2)�*����o:?G[9WC#���-o1�-Nn���4/'�6ʺ��59�uvʥ�9 ��+w�7�M�-gR d�N��M-K#��I��9��+���/ �h���"�Qy \B�!���Eo���j�br�_>�p�����Z@:[gT�A�?�a}��ܑOc���A�����������c�2?�ʔ��u�pX"�b9[�<aG&�L� �� �T��Eѽ+G�q�!��l�FS�{����wd��T��?������䁤eb5J�z �C%����'g�e����e�~ � ԥ�nl �D_�۵ɒM��t�����Q��MY\�tX<������@zk���m���<4-}z�$����N~+m�� ���k6k�K�9�0R3�_|c^����9uC�d35(�|8��!�`��x�y��tJȸiNo�Ĝ�Fc���u�VA�T����x�|��� e�4p�L�u�%��p
Static task
static1
Behavioral task
behavioral1
Sample
f6220e9d324aee79730a70368b3b349ed2ad23f1846dc222639f2b7051e39b72.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
f6220e9d324aee79730a70368b3b349ed2ad23f1846dc222639f2b7051e39b72.exe
Resource
win10v2004-20240802-en
General
-
Target
f6220e9d324aee79730a70368b3b349ed2ad23f1846dc222639f2b7051e39b72.exe
-
Size
10.1MB
-
MD5
ea28c8e970bb656395398b9ebc88e8e1
-
SHA1
d5f45c7b1fa70bd1740f10ca12e5deffefb1cd2f
-
SHA256
f6220e9d324aee79730a70368b3b349ed2ad23f1846dc222639f2b7051e39b72
-
SHA512
f5367926a378188f45bda8a03d5b83326761d0bd19ee0ab149fd505b05001f21ff059894e1a0369f66da6ee35f840ab04f1a9e90fc31af01d9b05d40b7909f17
-
SSDEEP
49152:9J/E5ZVrHr5f8KMBBaC/wD0TQZQgavdIt+gbwcJUc8vJldI83Cg9BHFtXv:9IHr2jvwD0TVdEFAJlO6VBlt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f6220e9d324aee79730a70368b3b349ed2ad23f1846dc222639f2b7051e39b72.exe
Files
-
f6220e9d324aee79730a70368b3b349ed2ad23f1846dc222639f2b7051e39b72.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 59KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE