dLG�hY'�U���(�Y�S ���@�pV����)4� Ll��J����Y�����8��݊!:��Z�* ��H��{�"�|d��g�Qc� �Y<��{~��d��IBA�9?a�H����$�+��d���y`l7�f��'�Z]�_ �,���d;6�@Hz��%��ú�]^��_�3~�Q���ʓ�T5�!a{�3Sݻט�)�}���lY�~]Az��r�܌$����#Nj���Yw!��:Z\�L0�:)G�'L�Zu�h��l0cfe�yR�7�0,K����Jd�<��u�:�W�q����"��~���=q��3��vW��-��B��~վ��>������L�!���n�,�F�S�8Xw���Z�[���f��_h����jC6�&�y̙q���ItB��A�����i��� ř�\>���ے\���]AqvE��;4h��������p�u�2{Χ��-����) �S�A>�� �3����s�Q`��`���Q�C����͗r��[email protected]�w���I9`9s���?�<ӭce�\��6�>6���M�FKصt�+V��g�4�������"��e�:'%�*��4���~�Y��zJ����M�Nh�=�M�C(�Ik�� ��fJUl�Sm[��y�����J����&��0=�+�gE �[�P��x>qD��@�k���F�x/ �;Xq�! ,��y+���v}=��A}�Ջ} Ą��^�GW1���Sq����h�f"��F�ڵX- ���# w�]f�4Ŕ$�}�UP��T��ȑf=��륭K��oŨ �h2`��˂���^���J�?>���boə������z,SvO��U�����}�LtoX^��ڿV~`��G���Ϝ)��-:92�������N�2����]��,+>l�8��c�p�O� r�=�U�Ũ��>���i;��]Ҙ�z �E]g��<v���.�H!�Kb1�<���al��(�j�Y(�6�lZʈ͓Ћ�~�c�P������tҮ�YJ��E0�G��H�����V [3W�����p��O�F W�у���.�F��L`>�(#M�Ӓj�Ph)��1����?'��%KA"�G���SN��3|K�Q�Y�!��z Z�:�����<I�7{������eC� ����0S�"|���O� c�����ca6)R�1|���,y�R,lL�$��h)�PM�{,b��$/%�#�l��S,k֤�HY���k�����yu��`��ܨ�/13 }�v���|F2階�$)d�e�04CXTA�����t]�xK�(���� ��ic����h=�d�H*՛�P��k�j���ɮ�V�r���o���]�{���^�k�"�:-���^�&��أ%QM����>eFc�z9��@#��2�!��l�;g���:&��?��mKs��r���XkZ��s�;�Q2�*J�����FS��N���Ń/7�]�IE�L�s�aqd�[*Z��{*p�:3�E�(���f�R5�ԭж�g�Q��d:�̗~7r�ь7̓lbݸ��p�%���6Ɨ9ܮ�dဏ4��P��ڂ��9.���x�F���lg�{���l�on�&v�%��8`�����J��6�j��~|��f������6ҘV4��\���}Ԕ��`bc�����+�L c��QFE�uk ʍ�6�<No�un� Q)*AA#�g��#����u��r"&u����l��b��d���/��^Ӽ �<~�G��Vm��������>�T.w���S4��d�Hq�����$/��0��#O[��j��C����L��b(.o�X���4=lU#ǿ���tX����De��S��T����=2��̯,���7I?͒�R��^ןK> �h^��Z���G��RѺ0��P������2ZU����.�]���pp�f='"˙{4����9�.z�ű:��%�f� �:�8����F� �S<]����C�/J��Y��5!W�0E�f*6p���Л�2H/t�������Yh*�{��� �p̄�2�{"�:`�$R5Y�WG�Z��*�2 �S�\M��_�m���v��o��,Rm}C0%�JPF�wڬSF�ㄛZ�]B1���[���1��źv�R�5u����$��\�MJ��m���Y��˽=��XX=[+�.\[�i��9����xB:_̠P�j4�_RT�ē����_�4��A�,�v�ׄ��+ ���۟�;����@��ڞ����GI��v���kd�]jWWQW��Z�?_b3�bI��\��Z[�Bd��w+oPf5 L�U�؈�����n�L���9�&��.Q�[�_�f�i8�ї�����2W�Ű9Խ9{� |���/��@���=@^/����bio�������f��÷�L��l��G���5���?/��/���J�Z�s�!�uW��!���LRujҷ?N�[�ca�h��.b[����(R�7���`���V�d&õ�`�G�,S�j��jDŅE�d�T#�h�&%�����k�_��4�X3� e���W���'���=�ʹ�-<��Y�3�d)��`��1 ��'Qm@���z�8�SIt���'@;$��\Z�}���T�?�s��Ԋ۽�(2��*Z����xGQ�`�o�@� �N?<r�]�W&�e�������(c����]7E�C�/]P ��Q�B0 J��^��F����F�� �P`1���ݥ��u��о�W5֞P Q�����q�8G=��89�%��7U��e�T�>��n�w�UO�� ���qX�V��.�t�.y�Ra�<�u����l+��-�\mbc@���58��l�4�P'ǑF�X�bo�}���q��2\2f qbX� ����" �l\J ���8�!���=��48��$���X��pw��fհ��=�[�A��ii�X�g�,@E�,��b�S�\�v�=�>��ᆧHx����k�]���'4e�,v��u�7�dD��0�zR�0�v��Ko,��[�2�=BE��T�Ni0�{�Hn[����� t�&b��IP?c�����:]�g��_���38����ܔ�_d#Р�-G(5�� ���n�L�'0�9+gP���d�$� !� G�T��%�y��@3��k�,@kB �S������h���8<|4Kf��tl�o�������z��s�������w�^)J��O�L�*���ޛ�B�1�Ɔ�<��K�����߾HWSݡ"�Z�]�r����M�2�9s�V�_�L�b�\��U������e�A��b���\D�C�,�^��$l��7���!��f~I�]ui����V�<�Kg@�V��a��!�]�&k�(��P�H��_b�&��q���O�_�Qr����5�3"4y t�=��b��K'���&�;_�q�Si����-cB��q��^w!������a���fV$���ԏ~q���Բӳ�9�H��Q�"|��R4���������*p?Y�P1y#p��!lZ ��<�z�A�s>b����\� 8.)��<0A���l���ӟ�(jc����.@�q6���R��!}[��@���sឿ� �¯��j�y@s�n��4��`��=���� �
Static task
static1
Behavioral task
behavioral1
Sample
c3f7a8f5d91a7d549b2ec959fc2aa021a74ca561911a46ca52281d3227300d26.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c3f7a8f5d91a7d549b2ec959fc2aa021a74ca561911a46ca52281d3227300d26.exe
Resource
win10v2004-20240802-en
General
-
Target
c3f7a8f5d91a7d549b2ec959fc2aa021a74ca561911a46ca52281d3227300d26
-
Size
13.8MB
-
MD5
c02129c3810c04a97ffc79d1985b8a61
-
SHA1
34abc7eb74f52b4861a9c6754212d27fe6dceb06
-
SHA256
c3f7a8f5d91a7d549b2ec959fc2aa021a74ca561911a46ca52281d3227300d26
-
SHA512
efe2f63faaf4ecaee420441a8042627f295276fbff1b31a30d7e613d004fa5a2c2ef340841d1a0777975e88042e6ca7f95732f13e7296c46d4fa7e5c7b1f7208
-
SSDEEP
196608:8vdjoYVGjjMlxUr0KbSXcpE2cbiISo3JO5U6oO8Y6CJvUr5OtUzCKkbYLkdF59:AdYMlxUIqSXar5U6oOx670jbFz59
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c3f7a8f5d91a7d549b2ec959fc2aa021a74ca561911a46ca52281d3227300d26
Files
-
c3f7a8f5d91a7d549b2ec959fc2aa021a74ca561911a46ca52281d3227300d26.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 2.7MB - Virtual size: 11.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 236KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 11KB - Virtual size: 804KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma1 Size: 8.4MB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma2 Size: 264KB - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE