�Z-���lk�kl��7�A<����>H�ʵ�#��c|����@����:��qM�t�t�;"-��v����D~d�{AW��*`���H~�3�������Ňİi�c�dWG�|�������4;��՞纳yyS�XX�~��c���0�BߥN�f��� ~RP#Gi�i1ZXi�i��m1;z�)�j����*��;20Ip��fr�瘍ϑi���K`:E��]��WaA1)5��U3 Ls�B{�#��wa �l`z�ц����y{�g�����/��=�nK?��C�����p y�D&7���yѰpix���<���{�JG����/~�j�n�l������� s��E=Q%6k�{/�2�QM�#���]�8x_4�0���L\�l#]�y�q�����V \md�ц����e����f6���:�XV?���w��ϓZ��H��讳�Dz뢝\��`�U&Y���˵ٟm7�& �/T�~6��2:h�O�u{iA(����{"4��sg���Wg��./���*4����X��k�~$D����4��t�Z��) �L��J��������L:�:ھ�]e1��3o��'#��o�1�����}���ܿ�?�K��$� �+����.��pr�5 �*���E���~-����K���}R�F�iM���8�6�/�^�4E��h�}G)�z;�|��G�,a��馔�N����z���e$?�V�(#M}��&N�ʽ��"� ��ThJ:`�T0EBz6U���B�������m���pR{��,ΧT4.�m����Y���YW�$QV[xp29=��կq@l���&��N'o:��^����-K�� ���J�1�C�BrQV1��I�Q�I̘fb�>������"G������p��8c�� fACj��=�f�N��� ?n��p����WX�іY��J�ij��s ��N�bWu�G�Br$b�88\#̡����\q���̕��P{ξ>���.p���.�����~N�d�I�Q�+���� n V��7d>N����D��.䊡|)��_��i�������^`H�� ���,Lys�rHT<���*s4b���Z$[Dn+RV�!�=��^3|2ȭ{_�Y͈�������& ��ۀ�\�'�6�x��J2�'h�9 ^�p'6���RfU�� �/��N����G�P؝��/,ʤ��� NH?���2Y��Ij%ZLJF�����9�7.�%*��%(V�D1�Z�<|"6��[��;U'�G[hֵ;��~۱?Hc�0� ���Є��D��%5�����"��>��Ռ��w���=IÅt�CPp:.�{Ö��B�8R+�Ȫ�G��Kk����g�7�d&��}�I�MV[��;ꍫ��A�C?��M�\z�δ*^)�cP�+�8=|V�$Ȥ&���?�8x&���7�?\fTY��p����)�����P�P$��y?���p�|>��6��8G�Bu��z`OEF�d�%5R������5�\ÕWH���S� �d�0'��)���_���� ��L7�z�������.���X_z`�����E�Kbf�!�7���� %o�3��$U�\6'����4`����O���'�����T8W/^I�HhV.n��o��F܇� It-�n�h�� ���7)�ִdD'Y�����n�&ۻ��?9M</�����\�b|���P�x�"����[���G9J��fM��]�_P<"�������O'Nyk�9u� �W�-j9��p�߅��·�v���V)���rK�Kf��'@������]{��b8���_,��5o���Z����8�:�5����*�'�A�M�Y_g��em��9�x��T[C���K�g7D�$����l�;��;�# �GlC��P9�k�OG����R�����hѲ���2��X��\@\|3��a\���_��o"Ѿ��\�D� i���?h������G�J��e���*@�W��.%�� O�Խ�&4���ԣ�� ��v(���]~fB��~\���%��iB�����#�=9�'ɨ=eA�L�.�� qWnX Jۗ~���z@�r�^16�Ƥ���B\��-hHdz��,��Ph��@�.p��1jK���cp�������# �� i<;�U��L�7K�����ΖW�WW�P� �h�����]�g��u�(��|���|ۖ� �XH��Vc�Þ7��U,^_m���ݬ���U&�~p�d�@�5. h��{��1�x� �#\E_�(�U!z�0��t��^t���0��/F�N:���H��ȕ�iyZ������-|��L<����/����o���mHʼ��Y�Sgo�+���#@�)W8��X�4{S�" ��.`��J�[�'�A)v��z �2N�SB���@ �+�9�,�9�?���{�@�I�a�4���K� ~ Q�a��F;��1���~���^���qS;Z �Y�mw^�0�8WbR��D�hi�N�D% �hY� �R'�&�����5�~�R��?������y��}��[`�R��z����P0:�{p�� P���2�Q����0ȱ&.���'No�A�e�d�y�_9u/�wY���g5\�R{����)�̄v��'IK0�ŋ+��eOKL6�<K /YE)�h=\͑oo��8���v����;������ţ.��}$�Tk\��+G�ϱ6ۢ�cf�O ��BFY�t�n��2Z]����mH[>(�`�{�hȦ1��"I��&��.)���+ލ���Ǭ��Sz����d�[�l��ɇ9I%S Ȉ-�y�e<ۦ����%6$�9�V�J��QS��WF4�&��FL�Ũ����|LOS��t��Pq�C�4�w���D��%��A�l���<�4�+����k�������W��k�)���diĞo�v��&�K!�b�v8����'�do�;\&xV?C���N&9�m*����QI���0���{ %�S$]i�ƙlO,�2ڜ(�Ϻ�7�q��~�r�ܠS�����8E���uƚ[K��1�2�˧a(]<j#>�p¢�l�y�]�7hձ�����v�q�mVP۠�����E��[ﭯ�s��e��"ܶ���^�>ay�[l�F"��/���[DhulOe��1MV� du���j��F�Z�Y`�v(Q-X����8v�*h�oJ5��b��/���j��xV@���$Mb��o'�_O�ճGe|[���js�������+��h�����I���DO�ԙ�����خ���f�H��e�Vހh�ĔJ�2��&���7�����<e�$�Ei-uiXb���o�,'�����wHt{�ٗeb��zC�*i�S�E��;Q�X:�_,�o#���s2���$ :҈K_'��_/(&f�o:eo��}`ߨ�H��x����|�]<R����;!�k�~YxN,$���\3X-Z�R%�} ^�*�+{k�mrN�f�+ADTS�1����Y�Ǽ�ɮ3��M�"y�������"��OH�$S���p@ S7d�5��k�C6�%6�I0�V.p}�xouOp�h���wV��C��z-@B�D�J CgPZe�̭��E�Eh�f����VE�'gbeі&�
Static task
static1
Behavioral task
behavioral1
Sample
d049cf5eba347383b765fa5283d7488b264e3b934079b73c446a730fe3391951.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d049cf5eba347383b765fa5283d7488b264e3b934079b73c446a730fe3391951.exe
Resource
win10v2004-20240802-en
General
-
Target
d049cf5eba347383b765fa5283d7488b264e3b934079b73c446a730fe3391951
-
Size
7.2MB
-
MD5
acd3a3fcfd3b65e6b705b9087a07663d
-
SHA1
52424c660cd277697f45d7157ac99e14ea7f7f62
-
SHA256
d049cf5eba347383b765fa5283d7488b264e3b934079b73c446a730fe3391951
-
SHA512
3af626c8e23a70b2b2114ae379d55d5ad19b4dee133a1e5dbde30ff9272a79b7f922a96792dfd5fc2341b125ebdb5947fdd4a4e515f0f1c6e4cb53be170bbd07
-
SSDEEP
98304:4ltqp9uwQRZ/tQ/ykxuHIDQvCn2RC5nOo9RFqf+Qz03XwfF1gXnMKk0:ity9uZRZxW+LCn6C5Oo9TqmY03XweMS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d049cf5eba347383b765fa5283d7488b264e3b934079b73c446a730fe3391951
Files
-
d049cf5eba347383b765fa5283d7488b264e3b934079b73c446a730fe3391951.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 285KB - Virtual size: 816KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 98KB - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.6MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 848KB - Virtual size: 848KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 297KB - Virtual size: 12.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE