�p��J�b�B1��V����'V�.7�[�2ER�{K���g8w@+�q�Ѳ �m���Ei�]j�My�#�Ã� i �.X�~�6dG���j�V��l$�J�����pn�O�EA, ����w�ރ7R�w���deb 4&�?2唟���:$ّ�Uġ�K�f�vijȅ,�a��W,˭|kWa�u�#�I� 3��C�·��¤��]N%�yՒ��G�@֨�$��v�BƑ�%H� $�nk��q�����'������}���ؑ����7M�g$}�ʼk���Rp!�*:�� ���<�\t�n�S�����e���6�� �"3]�>L���X���:��+�j +�$�����<n�(�#l��R�1l!����;/�%y�8qvE:��~��8�G�j۹͆�F�3�F'��s�D:I���aQ��2(��[)����h.� ��� �N�g; �ɋ�=��RZ#�dQ��QI0����c ;�����E\���9Lm��V�V����@����.�fm/0��U2�[N�]3<��f��U��X'�{�#�"zW䊧İ��� #Ȉ�YOxµS� ���%�q)�8N�ӜMxv�ݘז�X�AN-����t�毼����j�ՎO~�� 5�Y6�<�ס��`�x��;�[s�c���Zf�S�hz�xFƉ��-�5��Ձ�}����/������#=]6x��~3�͎���6��5w���fL@z,M��FG-6?�@�� ��fc3���l��Ā_�2w2�����~Ҽ�:��{��j�'�����ձ�ۢs�����h� +$Cm����E�� }�b��ư�Z"=G�z��-����>�%)����l�ٔ�?����n�k����m/y@���o���[�#����\ NL��5��$�� 1LNy���՞���2U��+K;n�C��O� {����%��2ǝ���Cbn?�~s"ɚS.��������X�g�8�{G<� 1�I�v@�V���ಶ,<��>y'?�4$���PW�]���%�?Sm�o��&�c�>��';O�?��&֎ύ��duR�D�.+��˩ 3�j��;.;y���!��������M7]�ۻQI���x;k�U��VV/vO]H�_�gm�N��V+yw6�;��|KX�������ڡH� +��D�S� ���'�R�+<ʥ�p؎:�þ�s����g�s3Mo�@���o�3�8�㪞�����|�َyf���C�]H :s�M�p�h�aa�x^���C�g{�k B�=cq�Vgh��Qڐ��Q~̱`b��Ѿ�������Kj��?P(�!��Ch�h���imFA�9���r�nlO35l��. S.('&�J�t�ҽ<�煤c��$Eso}�G��_x�Z�f�1h0�t�$�R�ET�� �+X�FiN �%���(��e���i*�zR�ꍦ����� �:�z`��]�l9�/��t���!Tg��(I�����Je� e9�7j���s�_��6��>��.�r��\-�|������m�d��/�M���a���8�1�`�AY�� X�k���[�JiO_&�k����Vƨ�u�r0R|�������<�d��/���ڮL1@<Y? �-�,��n���:Lc�[� H�(�Z6���JFk�%v����J����-St*�Z*mΨӘ��<��c(1�W�KפT�?6�#(�ן�1L��r���[Z���RC���G�h%|%��0�:.o�/�@�G�'�p��!8]�*�sN���JGO�`�_��F��ֿ���kY�(�=m��'��wU!B��g��y,�U)���J�'�X�s:��`6�e���лp}!Ԕ>Z����\#93�l|����Ɨa���dkvxb�O7g.S�0l�q�H�J���ٞ + �^%F~D�4{�>4�u�x<���0�?{��=����ً�Nk8��݇�i ���_2�z5`�����6f�H�MuVz�R*u�%��'oNŸ(��D�3u����d� )$\��v�H��G-��V��8ۺ����Ԡf����N`=�x�J\���� %����� ac�.q�v ����l ����>�ޑs���!��g=��&A�"�o1�\����<b������ݸ��5���>���?��?��:]A��A������/��8�������)`�/4�@ eھ�c��M=��I��"*t�aŊ���:���'�������'�Sd��0�{��`�=���_̾�U��#۾���`q�(c�[`[��������'��Z��u���e2/��!�3�P5&9�~����>ϑ"]$�Ҫ��=K�b�b�T���G��0�7ᕊ�E�g<M3��E��nPt����ۇ���8N��i��v%������X-Q�߬�"�Mn���n�g2G6�J�\��vy$+�n��������-�l��YΜ��[�7J���^��Y�{8-<G�N�v�?�i&<y��g'�<l��D$���T����P\�LVe�,�e�G*m7x0�*��1��C�P|��v�D��/wI�iE����묶��mU �)�%:���c�S�Z(�������To�>N�\���C� g�)��D�W.�N�FEQw�ώ�<i�T��G�yń�j�/4�Kع(_�S��?k�hDv+�)���0n�d��A�z�Y��e�Kq��z�ǎn����`sХlq�$�kH�U�i41`�X����5��U)�x���ڟ2���k�=�@�1�}p�6;J<�3r�լ�������ڲ���eq�jP��)^�d $���s��_�`�\iYk��V��(>�if�D%����y��٨Z]���[u��c3 8�Tu'�5��r��$�TRXc��,���>��jM��q��ȣ��1�U��CR@R���\6��n�ӌ�7�Gh��$�_��}���l]靨����A�Rw1�R�`-��{F>06. �� �/����m�nH6G��Ǯ��A���DS-�=�[��Q���+{���ĺX^COl�H��c3a�Ҋ6e�,�������=��_����V��}'�(�g����\�bl�K^;p�!C7V�g��MGi�K�ӦoFu�_2u���h)�y�� �(�\��n�C��X�����AL�iĻ��.� j��.�?��=�u��6��e�ei&���קK����A�&�8*�o��J�[E�kJ؏d�'��,�;S���[Q��!�V�)+�\wcYT��b�Kl_�������E�E������b�^�����������_R��҈������r1�`�q����/��9����8����ΙC�5���"7\d�B��`:A�.�NӌgB�L��x!-U�I�俋���1Շ��uS��,�&�(�ݧ�A\o��)3B���|�n/�5��^�}k�O�s���V����������jP�<m�F���2��fD��Y ��OWޟA�N��@�"=��U��b
Static task
static1
Behavioral task
behavioral1
Sample
ba1a30edad3784a5588b83be4defd96ad471ac9575f5c7be90e742f34657424d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ba1a30edad3784a5588b83be4defd96ad471ac9575f5c7be90e742f34657424d.exe
Resource
win10v2004-20240802-en
General
-
Target
ba1a30edad3784a5588b83be4defd96ad471ac9575f5c7be90e742f34657424d
-
Size
4.0MB
-
MD5
557a3cca5b9d963f2bbfe73d4bc9fb18
-
SHA1
22dbc665337a469d35d7c121a910f9d8de8398ca
-
SHA256
ba1a30edad3784a5588b83be4defd96ad471ac9575f5c7be90e742f34657424d
-
SHA512
dcc76d1edb69f17b31194074b1c35c6c285b7f874e3c4635b84551dc31afc4993192557cbef93cb4155f4228c4bf2c6eb8e0bedc3fd4baa543add909412a959d
-
SSDEEP
98304:TA13aEKxrJbPcPcV3izYu0QlHO/U3JqYWc7uLrKBZhKFH7G:Ax6drcPI2ZlHAiJx/7uvuhKF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ba1a30edad3784a5588b83be4defd96ad471ac9575f5c7be90e742f34657424d
Files
-
ba1a30edad3784a5588b83be4defd96ad471ac9575f5c7be90e742f34657424d.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 676KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 712KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 460KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE