�!�%��5����1������3 sz�O�xz���/��p��n��4W��+���s $�M�_Bk@t�4fA����-�n)eи����R/���'A����N���51���HR%�����?��Yh�"H���|��H4��Uڠ����4],���F ?��u_D=E��_8l��&Хh��4��cH�S?��z��� ���!f�暕�!�Zg��EV��>��H?�0D���t}d���UɈ�p��h�B�7����_>�f�(����j���H���w�D�����7bO���^��z���9�����M�Kz����bsW�n�åb�,��8�*�����C���ek'%3z Gӆ��zU"�Ȩ8��+%�ʋ�8P�1Tڹ*)~M��,)IQg��*�� �cš�ng���F��Lr ԕ<y����_�,�[rxE����+�W��h �~vl��fU���W���T���b5����l���:z2$,��σ��SKa,�����T/xW۷>.+���N��)�i6��l�~(�\cj=��%�����u�����x�$�K#��h7\=�7$�����Y�Du=f��CC����/.Q�ġϞ�~��ػ���5��K_i-U ��ͣ�����5+�����6\�E�1WC�?ة#�ۻ�6�g�3�26�������U� RCI���&4&�I�[���,=i��^�?�� ���(��0*�N��pd�]a#��VNrX�2�z�`����`��-$�P�vb~l �����cZM����7w����#��Ȏ���x���Q#���m~}l�������ĺAe��8���#�|N��5�QXp��7��v��"mTF��ɶ�?��nHC`_�>��b�@gE��|�ZN22�8-��*��R �)B+���h��#�j� ^G�+w���u��9��u�B�+)%��Jv�Y-�a3/��\�(~�f1fu���>d9ָ��U�|��o�3e��[����GW�����a* Z#+k�D�8%]EV[qXn/�[�I#�)�`PQ�c����?J����_��˧ô�%���M5����m�x�)�����M{&!?���'�5j����3�i�L�D�s��>~Y���[��<�]������l�}\b��ʠ�dtd/EI��$����x#�������&n�O���X����)�u�Z��؊����$dݭ�(�W%��1c�N��@M��,h�Ȩ���{Te)^/a��Y%�;D�n���A7���?}^Y��5����xS���.�,p p�L����'�r���&)|��; O�� �����F�^��M�� :_p�ʯmP|�h�ų��}��[�������+�����:9���&SD��4��M?��� bZS��ɻ�[�D�m�mۺ���^�5\�3�p�aѻ:Q�Ӗ�ngr��n��� r��M�2�e�&�l�N�/{m����3��r ���D����,L��uz�U��xN"P���&��*��!Qj!��m�ۉw^}�����W��_O��}�4|��ak�Q.^�oː}ߡ,&(��k��ҳW�m��\�UY�����j~P�UH�����.�/�k�^6Uo����(FI�KzH�ؒ���5�3����9�k@�����ߘ+���L�Q0&I�Z|�̜�f��Hx��S(��6& �������r���Qq�w3���]�Z���Xk�d]����S"Z������`H�Ş�1���0 Q� W��;]�sH����p@�� �exX�p���>�<�,f�-��k ݝ9�����׳�Β�yX#-W�S��U���N�[C<��4H�}.1c����nj�Q��:1���^W�̰��_r���V�)����T����TFafnה�i&Fd�ƕ2��sx?u[�����p�k��0��Ԝ��5��q��hX'�T����ɝ�|jOһщ�us\����d���F����L��{n?�LC_j��%;����,�Ըb�rl#l˔ z�.�P��d����� Rh`s�����dI..�h�=�HЀ;��� ����\z��,_�S��|��ڲ�f7�܄ g���kV��ς8��hSO���3d9�y0�6]i�'�H����58*0a�C���{� �%����3���\Lf>��lz.�[�C�- �� ����eM��A���O�0�@� ]e2��BN@D"0�U@e�z���� ��@'�Oͨme�o"��/!)v�W�X�9+� ��@���|���w��"T,pX�>Q�E���~��o� A�2��hUm�瞚A;�e��6�� $gE L��(�[�h����>�c�ER� ���G�;����| �FXl (�H��%�.t� #س�>���于��Wx��9�Rzm/i�v�i�cP+��|&WY+���������bX#�/I��M�2�ȇ?�ۧ0f=ސ-���w�s��G��H߆cz/��9,��f"LAM���s�M��%�=�pR|��u�%�'U~7ژcݎ_� �,:+�S�a[��5��ml2�A�A�N9�����m��4�l���J�XK�����\�?{����օ��.?Y$��Pkr��]�� ��Њ2)j��L�]�*�9=Bo1��ry��5}0R*��3�ꨞ�����~�*���.ly��S�X(h�֨��x���s�"�q�� � ����`��k�� ;���f5� �⚎���������Z�o8��UY���=�([��_��j��X��Sߛ`��[ۛ ���E�����J�-Q���T���k�|�bE��8V��������� ��A�%w��ʴ G$`YU���[��M�B�jQ$�@�0hc�D�Ab����Ӹo�v�d4yxL�o�SG�6I��-�V�7���H`�l�_/��ߠ �tK%��Z��ðs��H~��i.�՛��G�lj%!�s��Ċ�\�2���C��'�}�;���n��������p�Ax�B<'ߘ���i���r�=,�ϬQTC,��o�4���u�^.E��ŕ�k�M����_���/9������OƼ-�%P���Mk[Zza��U���JLz������:�#�s�>�������:��nl|�\ ����7��C��%�lR�m;� -7�y�ID�j�-�/��Bh�gnƳ\�6���`P�dJ��\ {g��&�������4Ŝ��[��vJ�q�yNH;t��م�+[�g3~1zy%��� o�}��*q�G<,Z ���`
Static task
static1
Behavioral task
behavioral1
Sample
fa1eebd3cf076ecc27894b45d1e1caafaa035d58f6480ead45afaa83331fdac7.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
fa1eebd3cf076ecc27894b45d1e1caafaa035d58f6480ead45afaa83331fdac7.exe
Resource
win10v2004-20240802-en
General
-
Target
fa1eebd3cf076ecc27894b45d1e1caafaa035d58f6480ead45afaa83331fdac7
-
Size
7.7MB
-
MD5
607804bb523b7461aebaf7ad7dfdadfe
-
SHA1
5e8d33e767f9fd6de8d14be7da15a509c0262835
-
SHA256
fa1eebd3cf076ecc27894b45d1e1caafaa035d58f6480ead45afaa83331fdac7
-
SHA512
0b453f32d4a6ccecd04d38ee861b6cf7a2a5c9a8c07f5bb760509f3f6e86709cf753d4ccb008b844c94f9a7366341769962823dfbd761d1e9fab6f0dff1c9b87
-
SSDEEP
196608:ko/ZLCBZHnUx4dwNJmO404FZ+Tlf0X2/61eyI8Dq:lCPZdwz2FZzGx8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa1eebd3cf076ecc27894b45d1e1caafaa035d58f6480ead45afaa83331fdac7
Files
-
fa1eebd3cf076ecc27894b45d1e1caafaa035d58f6480ead45afaa83331fdac7.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.6MB - Virtual size: 4.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 136KB - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 15KB - Virtual size: 684KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.d23 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma1 Size: 3.4MB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma2 Size: 264KB - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE