�S�*'<�0��O���#�QC�\��Y��J�:�G����`��j�eR4D�#S�P��ޣY0%���w.8t����D��� .��tQ���M�t$�w#-zG� uT��~C� �� ���W`�����[�-cA��"6�5K&�V��C�Ȱ}z�s&�k�������~bݯ2�u遈�����^:������d��P!��0.�����Tnay-��ku�˧����R ]��@�h�f�c��np�N��W����Qq������>� �AHzGDu0@��Wəny���xj�O�Rhp��ձ�@��L�=oG���8zV��˲�+�Ɵ���X�K3�s��x:�&;*�אv�|�,I��_x�B�MGi��c�m�~=C���;�J���[Aj�T��L�+J0�ؓ#I.�W9*�iw�X�����0�Uth��m!@m����4.���KU5_"�^�4��X�����"��_=��3f��}; ���Ӭ�!��:���־}O1�r�✇�,��u�����.�"4����,�����P��M��da���MS����pB߳��_�G��H� �6E� R���Be]��9i�Κ�<\l�v ��[:�%��7�N�����+ͿX�b�CZ2��L `��F�7�N;�gy�X*���F/h�\�$����hd�6������7��.�� ��B�ŨUv�>�_GS���'B��xʞC����)�� te�h�����voy(t�m�����_���́0E�� ��ݧ����*��</n���,~�����,����ϩ=�b���j�\���g�X�ؽﱁ�O ����vϣ]��\X��c7� cH�1�����:N<�`��pP�"�1�`�<�0xD�O��\o��6X��^��f�ez�%)z�Wq�u5"LcF��@_ڮ�p� ����YhW��!"����k�����v��\�$����n+K���b3t�[]���b�Kr �f-{U�(�s��F�ҩ�?��&�'1)O�M�����|�b�WlB�1c�[���y�ߘ�����c4�g� yΜ��8č�/�CD��<������<b��W|qe5��jwzqo�r�9��]#���:�n�<��o��z ��BP�����x(�s}����&i���2��fZZC�jF�'��� c�wD�~6�ظ�c<��G�ۺ�D��YHyL>���s +������3�0�>�T�Qr���K�r ��lI^`W�2%�-.�ü?/z���^HV�2� &��������Q�i����^��l�1wno�VE���YIC� P����^�$_��.���S lnJ`X)aq��K� ���Z�8�4O5Cױ�֭���hU�$��ē��:�8��͘2�R�f� �4{�X��E���j���`Ih-s�\ىB ���mov�ܤ��z�[`��4(?8Y�/�*r6�{�-�YwhQ�C�x�����7M�є��x�����rxM��0�t_���,���y�y�**��H�S_<����-J�S�����`ȸ�KU�3$�e~���'��)�B�}LZ���[=福��%ɧ�Y�9�c������aӇ���ͱ� ��4.B�B��O�=�6��g�wm# i�n�c��V��e�q�C��.T�u�TS�̃������u78�T. xn�O"�S�UGa,�p�ny1���)QU�7n+88�t�H��!0��/8���n>� ����_�4��v['r~�C=٥�V�4�]�:B�7\�� (ˇ� C�'Ҙ�yQ�`@�N����70��PC�7J�%�p�7X��/9�2��u��Sf�E��)�9��p0n�Bl�s1����� ��U b?��C�t-�foE����9d� D��A��:���X̚���IX7>���{y�g�~M��4z �)%=ݤ`��{nİYM�{8o0���UB�'�U��/烡Z�����L{g%����Qm��"�q �&m�o%����t�����S+C�6F~��jW�"����6��¿��Y�~P���J�Ě��͇(��!f4���b '}#Oar&���v�S� �3�����0���a����>pɎ�6;��'c�W�y�U����_� ق!ɜB�/�R>Uc����NM�xXK��kx��Q��ο��([�"��A���&|-9���9B�rkJ��k��|���H�q��I8v�Q��<|��}�̙��ӯP5`s+]e�郄��(Jcf��� c?����%u�-E���4�u���7\� ��nJbY"v���\,��RK�)��5������u��3fklV�6-7G+���t�uW���[XvS?PF"�36����k-��� �)(夫y٢� N�ցЮ��Q%(�Y;�L�l�>¼��� �w�]H�S�9�R� �_s,畁V���!����E��3�z�n�S6xϐ�:N*/��+���W���d Rc=���!�eewP�4�]����q`:�}�Q�n��%�}Tc�6�n��<���3�2~�$;(�T��~�L*a/- ��[pB�/�nT��5�����s2�Ȩ���ۑuj���J�m���;��,_�-���D�J>ʍ����<��P�|s��+�k��*۱,=���P�E���M\�z7�w����^�3V�@���ɚ�u�^��I-��������Z+s{ږ,�ʪ.Ih0 1o��W���/����mD�2j<��>�1�T�AKN�������h��A���Т���V�g�k4�����1�7�u�q&Cx� �k8]�%#"ޅ�>�'u���7�G����<���/0�����k�u�V�W�C��j1�ݜ}[�P*��(��%�,�]�t��d�B�������ґ�UF�ư�����2*h��N*?���a*"�op4/2��`�XH��b3�(��JX���h �]=�����1;��KsDž�.�B������`��S�+��4�_�H/�������[0��6_���9��yDrG��㱺�q>lHn�AC��N�ӫ"T}w�|����D�S �����"���dz��8*h��-�T~y�T�%&����������ܕ$�9vX���nP<�2 �.-W����D���V��n�J��|�Z%�](�HK��#���R��pp��٩������Ă��ǴM�����!fk��_�G��8�FC$m�_6�9��ؑߎ$p��~R��I̫ #Q>^�Q��b�Y�� 6�̫�����(�j���#*����rl(���L�F�� (d���k���#����ߡ�~�vY�q/�p�t����p��YM�K��B/�S�4N<��������@'��<ߨ}�m3�\jø8u���i! �_�}y5m���g���]�D:vF�m�y��an(6�Ԕ����(������v�m�C8c�]�˜˓��3�68Z������&.pt���v1zڼ��ĝ&�o��n|F���BҰ��R�d�22�o�upj�U2����`����聜���,�p���;���̌�����t�f�^�< �\7�%0x����x�L���84�3u��VF8��������[K��"�8���D�� N=�Z �pШ�,����2l#|\��T���Fm���z�d����ꮽO��/��E�_O����^�:�����$I���D5�����2E�c�R.h=�]��\G� Pi͈P�`��$��h����?�&UTGWx��fM���ˍ]c�X��}�.��ҏ������#"B�ƅ���k�M���o��.x?��ہ��8 ���B�M��:?�l ��oC%1q"β
Static task
static1
Behavioral task
behavioral1
Sample
38fcc74154cd9ddf5e99f2ca17e23050c2645edb78d8ba7286cc5b6267aa7b15.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
38fcc74154cd9ddf5e99f2ca17e23050c2645edb78d8ba7286cc5b6267aa7b15.exe
Resource
win10v2004-20240802-en
General
-
Target
38fcc74154cd9ddf5e99f2ca17e23050c2645edb78d8ba7286cc5b6267aa7b15
-
Size
2.8MB
-
MD5
f006ed31acf080166e76f7840cf098fb
-
SHA1
b1bfdab21bd3efeba5b1c54eefeb5311431ec7d1
-
SHA256
38fcc74154cd9ddf5e99f2ca17e23050c2645edb78d8ba7286cc5b6267aa7b15
-
SHA512
73fe3f13edf96bd51de89358ec20b886e1d0ecf16e5f30ca190837cb4b99623127dfe732adbc0a77ccdb3972c4929b93cf84d2f9158cf31a281a908942cb7153
-
SSDEEP
49152:oOgaf0oLcBrAtRjeMH4EAR93LYzzuX54/oqE2OTLsr:1X0kcBri09EzzuX54gq+TLsr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 38fcc74154cd9ddf5e99f2ca17e23050c2645edb78d8ba7286cc5b6267aa7b15
Files
-
38fcc74154cd9ddf5e99f2ca17e23050c2645edb78d8ba7286cc5b6267aa7b15.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 437KB - Virtual size: 944KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 73KB - Virtual size: 216KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 9KB - Virtual size: 247.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 182KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE