&<h�M }��?V@�/�!Z �GVf�_8�8��T�~r��6�>[D��Mi˺��wv%�?-/}R��M��Q�_���.����3 94+����7���aGr��D��&���ꋡ�?D9����.�9,�U�Zg�4`��CM���p��9����b�e��.'j�xI_�˿h���P>����X�m.��0��Y|/�nZ/Z���L���$X� ����@c�D($�4��5G�k�����#�}O&h��1�^��QC�?���_ @W�)�I��|s�dUm�.����$�c-$��'%�Qv�-���A_RQ�ypd����@$-\��vt=��A����{���Y��ŝu� 5�`���*��#��1�&�'�p�7��1V��K'��+��_� /���oK���S2���6�k������d���g9d<c�K�~F��qw��,����CK}��/���}3���'a�,0q�;`�|��I�������S��lmy����(� rYHGhÂ�Q�lo�b���dcJ�p���(��b")�P>F���4��^퉵P�t�٠N�n��L���,Q^�����?=P� b����-��Ǭg@���kia��/U�y/���PtZ�������/x�B�Ţ�T(����PQ�SB��&�W�C%W�%�` ��RU1� g��fW��o������M�nH�� ��4&�����}2,$�Xz'��ޫȀ6b������C�� TLY�y{����A�������n��?�/��r�ӝ��x닾�q`|�h���KŔ��qY��������q-�,��Zr�� �ow�62�7c�.�Q-�|�����c$.R����C�?^����ao�V��E�1��>�ղ�qRT����VR�x� +�+����g��I�������(m���w�� iyO�_�z��֚$sL�G�ˠ�U��FO���}��a�g}����6����[�}w���gò���M��JaŶ�&"��i�����=]IE}��� ����jޓ��ip#f�6)�`�ّ��^��䣺����9KO.k�wȭK�߉[�ȵn�zN=�!��FCODA���]EN�G�}]�̬���|��:qJ��B�EیR�_+��s�+>(�>8���ÂÕ���8����0��4�Ww2������G������r��a�z�6�B3B���H؍$ů�V�3�W���K��}���C�k�W˻�~&�۾ e�' `ub���Xnif���a�yݳ��ܦ#�bA�8�K��z�����u����uH���[��RyD���j�(�������y#����q�z!�<����B�ԯk֣֊A�$F���x�5����o��r�"��c�.t5}���֜��e�c*�j��tv+jo�kD�$������n�%F=Z?_�<���ʆ�������f�6�эҡ��+'�fmWv;��(��3P��@��a�6sCZ3����r�:���g��d���{�$ޭ�����L}qt�&��:(U����Öw���fB�_�s���:����� s0��c[�{�˙��D���ǹ'p�G<�% ��q���W@�𮀤���ALٛ���T��b^_vL|D�����q*����X�u_�w�Z:�3q�����F@ ���?�1��"ч4�+S��8�N[Ќ��i�|!%*�n@X���Rk���K�r#�#�� 忚�X���$4��4�/�P|}������fU�Wa�\z r�4�'��"6l#b��c7g��p��,�<�z�݄NLHE2��=<���,�0��C�U�wZ�nΘ�f�V�K ��������������G���y���Ԫ��Qz���|,���n�AA��4٤����)��JUwÏUzl��W��-XSQ��+8��A��c���Y����`(��H{K��!��D`5W���1І�t u��6�g��ӭk8)Ր�~�#Q���X:��Ws\��X����� ���Te��t� !�21������#�H���}+�2��o��tc$����g�ćr<�q�3(=`���)[�9YXLmT���w�2:K<O��Ly .�\��t�n�'��Z� Bxnd;}�m�ipn%n��qiHr��G�|_p9=��S0���:��i��a7��J�����[(⮑,舊�ExpO��tR�|,��m�.\L� � %8���شs\�p:�A"<�qE벟�@���}C�%��O���ۗL*8��#o]���N���� �uXnH}���x�O���k��2�n����9Y�xlup�N�|yS[���X0����xZ~'�K*�vc����$�:��v��3�~e�]w� ��D �w _¹�is��ru1�"� ER�)>n�Ac�P>fb@�f-Z�i��3�^ܼ9�K��)�k���f1�I9_���hDm=b`xwR5�\߳���bVuki>��d|��9Yf���˄�E }3p���e�@�L�'eߍ/Q��u+�S{� P�N*ܴ�@ ���X5��?'4TJ�?ܦD��G��H;�7V���~*ү ���z��FQ������A]*��<35�����ɨ*4�Ō���^�Vh��̧�a��\�mn�� ����$NԆ��9��2z̺i�D�P�ݏUCF�{��3I�B�"�KM�NH{�b|�m��}��a�4B} ��{tM�=��d�ڶ������?#�����FᒲZac��2��W��7����u��k[d��ڛ��Ȋ�5;��g�z@ �PGG�����Y�T9�BJr�4D�Uq���PS��RԠw�A��� �Y-��|�[ѩ��`v��'e8"p)a�(t��8c��#���4"("�[����4o$��[a�_�r�=��b-8�����ąxv!��nvv�#N��%\�kp� Q�����F�B�)���{�ߤAG�w�� ��pg=.�w,u-�6u9�xGQK#�.0���[��ۂ�1��8�1��{�?�dj7jX����<�:{Z�%��y'�-s�&�x��~Q|=j�Ga�v0{&����UD��LB� }�`��Hs������f7���t*T2}�:�=Ό�G�����[N�oC~�`K�l;`�7��fG� �*x��Ϯ�k, ��7Ӓ�� ?�Rpl��u"Yuc{����4 .y��i�0}sY |�� p�\���X-K l>PeF�
Static task
static1
Behavioral task
behavioral1
Sample
f63538f18e29e83784eea2e10ddc3e23f7d851032d17be9f27b4e95021559d79.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f63538f18e29e83784eea2e10ddc3e23f7d851032d17be9f27b4e95021559d79.exe
Resource
win10v2004-20240802-en
General
-
Target
f63538f18e29e83784eea2e10ddc3e23f7d851032d17be9f27b4e95021559d79
-
Size
7.9MB
-
MD5
23fe764a436cb6dcbff53ee4801b7d60
-
SHA1
814195f622808c57afe55526169644d24c882238
-
SHA256
f63538f18e29e83784eea2e10ddc3e23f7d851032d17be9f27b4e95021559d79
-
SHA512
b0d1970fa920270166ec366632e02b8de3a693b9f6cd986e7dd1d503ed16181a2649055d824cf157d763e062f87414884474d21c50852e2d0fdb094b2a38624c
-
SSDEEP
196608:4G8dssXfxCrE1ljXJGZgvvnNfZ7rXI8D:+bvxfzzJG63n3/Y8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f63538f18e29e83784eea2e10ddc3e23f7d851032d17be9f27b4e95021559d79
Files
-
f63538f18e29e83784eea2e10ddc3e23f7d851032d17be9f27b4e95021559d79.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.6MB - Virtual size: 4.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 136KB - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 15KB - Virtual size: 684KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.d23 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma1 Size: 3.6MB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma2 Size: 264KB - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE