H�%����K��f�nC7�q�5v�����C���5�k+By�43[���ϖ�!B�J��z_�sm[��ď����չ�|N 0K�FH:�Lp�ڸ;a�ӝ��o>�w`�;l�9����eq�YvCv��۽#�]y^�^��Σ[�:���>AŇ�f�,l+ <����;:���.p�����v�֧��l%��#Yu����%�#�&�O�k/Ֆ|�����[^�uudOD�͝Mg��ٝf�Je��Y���������[E;����nF�/v�-�'�@|�c�N�a�R ���������t�y0�b���:�4�k�P¼�`}�2Ŭ�y�A!��X G�ޱ�� 0��C+-�eNi��z��fU�ح)n�#��~�ж������͈�������6 k�F��ޕ���6��$!HL�Jd�^� �Sn�z�q#HuM��1t�>����W:n#������KM��ᢛ�(��y���ʾf�P��7��������I}<�)�����<��� ��l_6%`�[&0���Ӓb4G��F��"p�����}�t�O-)�-�tV h�F��&`zH�ʎ�ڄ�A��ݲL�lN����>�`Į��!I��3l�ヲ�>ĥhq���.�c��.CxN���D�ǢM"FɌ���w�ᄿ�<2&���i~u����J���8�zM�f�aN���}��r�3w�<��㓿)"���Q|��I`<������b��N�@NrU��ޣ�=���4[����S��$ٲy3�̂�ڕh �U��p\� /��#�eHC���Y�JK���H�n��ͻG�\��kj���iV�d9I�\H���K��;��&���Iof�)J2��}�eGy�\sե{=������\-8rf�8鎪I:B-� ����H����y���V� ޚ��\�� q�g�@������Y���������Sv������� ƃ��z��ꬺOQV�j���y_��Ǥ�v@��{��Ք�5��b��jp������1�O� �W+��?[m��F�(�#x�(����U� �%���<{Y��H�I��d��y|��&���T��na'x"��-��%������PQ�z�����5W�=Vt�wkD�1���@�=���9���e��l%O��)��/[��?\���9�D�Ȭ|�r�+,���w�(;FP�x�.U����� x�h��UmJ¨F�� �G,�]��6Lr|��l���:g�Z��c���/I<��s)���~]�= ɗ������n ���\��W|e�S���އC��TaKgL�ea�<���z'&�^�ICUs�6~�`�%�73� �}�`��|�B����2�+��D��M��D�3&���Sˀx��y��v:t�nӻ��ƣ�DiOc&��$�� B 6�%�BW;Uq������21�R���MF�ܡEn]3fq���XW��� ,���-,�A�ۏ�s�c�LOv_���AsL �Kz����u��kR�*�A��o7js�2M�E��#M.�<V:�2�z�o��&�������ja�2_�=�N�vx��z_;��w�h-NJi��g�]�`Sy���5�U�Ŋ&�Ɨ%��;.��*Һͨv������D��,m[��8lc#{�+p`��5t�����~J.qI�˹������rx/���>�3�Į<�ۓ��|�,�Q_�J�8��w ~�`�!4p4��{L�l�,?�����q�Gv���c���U٭�9���h��F#\�����>MRF,���T85����AO���H(s ����J�m{�/~yoG��@��Ў*:b������&z�ki����H��*�P�ש�n_�H�[(�슺ߠ �>���;�wx�=D�SH��~�RIuF��J 0���G~�Wʆ`�j�܀] ;��k�Fc�!�9��X���z��_${gQ4�J��C����A��1���c��88Q����i��I��3��U�=+w4��qa���������|��OI�����C��^~p��!��ņW_1z�$=����K��B�cYP�ܖaAX�\f����'�)^�U�ߪɩ�6!F��ֶŬ�h/~��:�.W�����Wõ#�h�5���C�9�9T�{E'��'\߉Quy�����}��� �S\�X�U"d�D\�R�(\Enz�K+�ѻ��ٳZ�~0[�Ԉ�L|v�\�pv��Ȃ���c�_��n�uh��Ҕ���,�r_X���h��2�B�\̎�����@���� ��8ܸ�.�8b�����[+�!�&�2�՟3�o�O,���`����g�y��_?$�v�k!.cε��F3T���8wi:�&��$ASv����\*T�C E�c%� r��X灓���&˖��fe s�<�A}:.}\hi�n���e!q����I�#�7Q�g�����32I�xr��?�� �k���x13t�s�+~"n4>cۯ�a�Ҟ����;˷�zШ�E�v�b���H������6�F�,:{W��Y 8�����p>{���n��]�������Uk \X��8�)!T\K����1N��1���dߚ�s� *�R �G&ޢR}����y�ם�G��� Y����k���^zpTa,��\S�ΰ|:����0��H�����T?�4Lw0C�1����X�k֕�;kf纶�=�����{eh�����������q~����0�������t�u�!1��+�C�-�@�P�k}jaw��l����9 eZfH%��� ���iۺ�P����^_r�WfNρ�+��y����ۦ��/���_�V�r����zGnu"U��=jC��JDm��r6�� �[�����YY�/�����߂su�w4%[Br��X��&Hk^�TJp�M����ɿf�ʳ�]>%�rJ����嵴̱k�%NG���loq��̣ v��G9iu���$ ��z�[0���k$���Օp�|Y#���qJ.� Bp[y#%��S�@�� �,��_��O�ߺ��Q�!����N��y���[�l�5!{x�_~e*V���eI����y�Z���g'�Ν��~��w�tX"7M����f��<����uRM��i ͪ�A��鐴�x�����G?v���"I��+��ү�r�P�bG�]���=G�GQ~�P��墬%r!gz�Ф��֨4��[�wB���c�%� ���|�������˕a �K���k`J��f��(�3���2�T ���$�RA��;�~cǿ�Pe���E-c8�<T������@�E�\:׀�)͟���3@�k��2��/ R��,@0����6�ML R�����DRؓ*b��I���$G:ʼn��]�djy^s�R���V�Z��k{�Vd�੭UGU�o��`0#��lU��D�*������ꡎKʌ�e ��R�j=Z��\i��_i�U#\1�������/�uX/JDEgB��&h4�1Xz-�)7Y�d��*�|xN�" tD�9K�<���<�c5��?�|�W��80GM�@��o��G��1a�,
Static task
static1
Behavioral task
behavioral1
Sample
17e72120cdcf6678223d82d58c51e3ca72569a34404dbabca95464241e3a582e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
17e72120cdcf6678223d82d58c51e3ca72569a34404dbabca95464241e3a582e.exe
Resource
win10v2004-20240802-en
General
-
Target
17e72120cdcf6678223d82d58c51e3ca72569a34404dbabca95464241e3a582e
-
Size
4.5MB
-
MD5
5d1c1e768479a7972c7c1ff0e768169c
-
SHA1
7b0fc0c9c96a05197c4b73b54ba7c370ee92bf21
-
SHA256
17e72120cdcf6678223d82d58c51e3ca72569a34404dbabca95464241e3a582e
-
SHA512
832e8f06485341e223c0ab22ae70f374073be4fa61eb80eec411b7f9dbd3583907bb9dc9274d1f429a4f7a46d4eacc7b170f9402574966443fe0a7c022606a31
-
SSDEEP
98304:oJuY0Ko8zridkkpUSavFEZr+PSPai5M5KUG/j0fzQxUykwza08Vm4M:ejo8zridkkUSv0an5MER/j0f/jir8V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17e72120cdcf6678223d82d58c51e3ca72569a34404dbabca95464241e3a582e
Files
-
17e72120cdcf6678223d82d58c51e3ca72569a34404dbabca95464241e3a582e.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 521KB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 395KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 14KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 39KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 297KB - Virtual size: 12.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE