�X@ Y��*��I��/'p�6?��x09%���l�!���)�y�h�7T����<��?�Eʳ̥�_��F\gs�$6-ڃy��,%�6�9'�?����u�ߴ�۪ЊC��o�gD�u�Rg:����Z�r�>r�O����;�� r�j����� V�ݾy���������o����)wZ���Y� G���e�TM�k�/1IV� �B��d5%͂2��*3��y��*rꂧ{\��7C��|�$�W�q[�Y�*����5�1����Z�,0[4J�gP�[N���@��r%����B����A@bz�l����x��nǧ�^И�"��5����<��R�T��?�4oĮ9xԢ@P�b��2d)��+�lxA|ng`|�p�X���ɐ�PQE��r�&g����v㤫G�?,�ovO�=]X�����Y~�w�xl6�Dz��0iFǯ�����26B����r�� d���@���\�����s�Q,b.�p���TU__!�c�gC�%:"(ツ��_��z _}�˪����78��2� �W%�l0�if�=m�}� /�����y��I��j]�}0A;5鷣��� ��X�.����֛�l����)3(`�5ֻ��既<y�V҇ z5����I��0ر�O�`� ��Eþ]z�$����RFT/�����,��H�����L�������ߙp�2Ȏ�}W��:%�j��C���7��a)��5^j�R�Fn�(�Yܜ�e��7{�����HP͘��F�aU�\#����FNa0�p1��;-� V���Ȭs:�r���7ω�����;�y���9�� ?t� %Ww3��ݘ���r��{�t*���(�<�' �����;u�.��/��������U�C��F�-���O�Gf�|CiA�:���0�`#���w%�|�{ ��p�1r p��ն����P��\���<7'_� ����[[��r���r�u�8l%Rd� \wj���� {\d�YK�,������@��E���3���f&p�n���i"�?o�w*ݦ������.��c�%��=E�bz|J�QϾ�U�G�%)��ptq�����d���a�W��)s����Z�L4��r8B�Jjx��h�>Af�# �v�N���]��VD��,5 M4�V��ΓWr7�ҷ����t K�7������B��!6tñ1��`��u�L�]����w|V��x+��*��A�=�5��>��@�E|#_.�C���n ��-�K,�x-��k�}��"O��-6�Z�W��{������Q�x��o耠lFb���N�O�|��PV(5�ػ�69�2��ǔ�^��r�V�S�@��p����|6,�.d-d�N�A'��59�m���`�I����?_3���i ����J��hl��h�.��h$���˭��b�$�\�M`�TU}C�al���X��N�%��V�Q�?"�+���,t1��a��/�<3�K@>B�X�`����z�b�%M#g��$u�����͡�M4�G�Ψσ\���HN?�o[{f����- 2R� �� �F7bďa�����w��V�xT�Si9ftu�q �G`���}�d�ѵh�qC�RY����� � ij�]��Z�>0�m�h��Ξf5����`��H���� 6�q�'����f����fL ���=t~��Έr��p���HQ��a2"Jڜ�~��'��T���5AY��Qw�}~��[��~yo�&� :��c\ٹ���+�CV��r�GKշ������#�e'w�ơ�(k� ��t� ԯ��\峿�X7�ο��"� ��O��(�_!i����'U�[���Zb[����Ǿ���?D�@\�ӟpm���O���%�8Q�w�c�Y�/*[��I =p�O��������ԟ'��W/�s��͎��3hyԆx�Ԥ|Фh����S'���'���E�_c���S�)*�&� a��=HsO��:�R"�ve#9�)��Mw��@�AQA��{<Q����G���F=�I��U���#���:h�P����3)�=4OK����u��D!=W3]Ab [�Q����cT��LFU�������A �*C����9%)@��dw��8�y E95��:�Jyn���CF�*x�gl����_D6P9)�v��9W��k�3�� { t���ϜXgk����yW���$�G�x��o����)~�e��$�N����@?�f�$��}�i�v �&,�����/��.���Hw9K�e���* y+�կY�E��d5-O��>���|��!}|�����";�hr�^���K����]��.����~�5�Ҁ�^$�ց��W�ۋ.[d(&X?{�jy藝���v� i��k8�&m�z����9@��sЈ��&�58@x*��gV�Z�Z��&s�F:�,O�%��(Q�R{-�#u-�7Wʩ�X�pk�J>�u�@�u��Ƙ>���[S�����C�.̑2��>\�2^����ˊ������t��1��ON��(Up ����e��� 4X��>�eQ<}u��,5"\rd�ޗ=wO��=�lj�#�8�6�.w��2�#���鉮���u��21s�������l�1�)u^��R"�V|�s�ߤ�5��X�y������M��3�ec3�;Ul ﹫�٪�"1]���5�7��@QY� #d佩$Y��G��Hⲅ��U( ڃf�ha��7�[-2l-��yy���fv�5+��h}jۣc����X��E���L�����']R.I�Q-��l�@v>���1T�(J<������T���#t�h��Xbߪ�.V�ra�gD+�hC�v�m�O3Os��`��{ ��=�$ �>�,Y,�,��^?���`+]$6ޟ�$��@`�R얛tQ��~lj��N�9�R�� ��z���H��s,u��s)�]C�ϛ�1.���iI�7�~y� ݸ��\Z�+6�� s�^,0�ڐqW��R�٧N8���|�?8�q���^�>i�o1Pw�I�:TR�8Ĵ��fG� ��\m�j���u���������$�{�\�C��������kL�_lѫ�{�f)?����úp^�;ۥB�L�&�sB���l���]6wik��K
Static task
static1
Behavioral task
behavioral1
Sample
0ac35bd4380572f2587879283b33ea6ec9aba1e14ad93fe90d4b12041efc4f36.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0ac35bd4380572f2587879283b33ea6ec9aba1e14ad93fe90d4b12041efc4f36.exe
Resource
win10v2004-20240802-en
General
-
Target
0ac35bd4380572f2587879283b33ea6ec9aba1e14ad93fe90d4b12041efc4f36
-
Size
7.9MB
-
MD5
06b2181e06cdd35d5c932693414a49c1
-
SHA1
e3bbdaab7f165b930d4bbcbc9bc72178fd481675
-
SHA256
0ac35bd4380572f2587879283b33ea6ec9aba1e14ad93fe90d4b12041efc4f36
-
SHA512
23b42f24e3aebdf596c014b15f800ced4dc4f3d05ff8f5c7a1a035dc5c7d34458b54812fb04fb3f1abd7ce2be692e42d75cb5ef97a5d474d14b2cb8a6adbcbb6
-
SSDEEP
196608:GJJ1Ibh3Sy5oRDenzppWgc3UvF6ITDOsfffOI8DB:GpIxSywJg88F62Omx8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ac35bd4380572f2587879283b33ea6ec9aba1e14ad93fe90d4b12041efc4f36
Files
-
0ac35bd4380572f2587879283b33ea6ec9aba1e14ad93fe90d4b12041efc4f36.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.6MB - Virtual size: 4.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 136KB - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 15KB - Virtual size: 684KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.d23 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma1 Size: 3.7MB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma2 Size: 264KB - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE