ڇ'���6�h �K��.��C�y�'A�������w��)�ۚ���j���a�զ�+�9�Ek��/zk��dz�a�j%h����W�8����]��lQh?�8f��w����/ ĕHZTU����b�����}2�ZlÓ�f�]����PQ_:��'0��B��N,Qٌ��ޝ��*����\���@#�r�]�ڊ��?��/��'<������k���#��f}��vD'���m�ݺv(��zF�0�t��dCa���*CL��6P������"dg��x��5ȍN�)f����t��(͎�G����+q#0��F|��-��k���l����Sa�vt����Bj�-��#r?4�QJt�J[��:��Ԁv�&N�{��m����)� 2��i"f��p�"�p=����,��k��#<�F]na��~Wams<E"��j>�ؙ�%2������\遛b�d����FDrc�\��%�sV2�3�"��+���r���]�I�S�nb#|�,��v�c&</h3�-���c�$~������CO�>���u����V�JR����/c���tɠ��V#&��_��� �+��Pl�kP�G$�������a'}��n�$巩H ꎑ�9_�=@�uC�u{��l2���2��������Ko�n�l���Y:k��l[�R�ɾ��a2<�\�����o!I��7M��8t�s���p�.�;���Uw'5�S�t�+�{}�%ٶ�� 6tp؍��/%�0P'�]��1cWQM ��l�*�P$v��1��D �S��IC���z�y)��]�~<J��9t:��f�����d��:-㻜�,��T"#z����W=u4=x��"B`��`�l��r�^Sg�"3��E��$%R9w��?`bY�����⪉�BT�)$�X�{� TQ,6�*�ms�,:w�'���=~�8r��9>����� x�b���i ���O�:X̙�˴g��:��[�F�JΝ�qd3�ml��|'"z���6(l��=��U�Q�QT�Ŕ���d+��F&����}��T��1�Mǐ���EP��н�� �v�;�1Sv�z����M-��2JnG�5�K�ЂI-� ����=��i<�����I��Ѓ���8-��L���*���}Y� &���{#`|'\ �KT�'��_i��1<�+�f��b��t{5�i�nTam6i���O���K�V��/�e�Go .�Y�?��a$��I1�aJ ���X#F�S�:3�mg�+ !V��>:����x=�}Tek�I���+�5�>嵑��"�����+��t�@9�Oojq�4���?L�8.E;�O�ўht��F]+~h�:t�@Ͽ$�7 ����I�R؊qpa�Y�v�ww�v8y~*6�j*� �}�YM�\J#-n���lG&���������N�?���;# �1��x&�b6���ѱ2c�R�fI�~j���ޏ���Sm��h���MCt��v%�����/� ϯ�=n[փ�y./�4��.5��}��7W��MV˚�ᴐ:�F�^�P��T�.��� N�r�l�%�=(�%�����p#_�۹pAV�oO�����ZQi�����6���D�E��F}�=�'���;Z�A��b�J� �?^���=�1Y�X���-�o^�>�O���=J[ �c}�'mD�|���'h��H �֣���I����B�m���5����������fe�������w�d���"5����COs?:2B&�:��T́� f2����o 'zN���l��� �����|yy���R��f�2x���O�I8��� ��%�եX�}ؚ0|e~�֣uV� �#�}+?b�!+Ű��*���u=4����'����G\�7����Ңz�GL�w�X�K�m�]+�;|if�����i(�发�Qq�wo���Y�?�ҿ23�hʹ�H�']`�3G�W������`�Ak���e�&]�r�v����FHj^J���Rh��"�(��[M��a�S��e����Ml�4t�֥��PUb�����1e��Vb�2ZuB��V����I��&�8��Y�Sp�}�M�S~��"��5+7�Y����o�R�*��L�}A]ߢEh$� ���nת��@/�S3�/���SZ���`�A5��u��� z��د�(�n^���FvU�_�ȟ� �JHf��Ym��.~T�����i��m���7e�צY�_�t4���^�9�"�wDb"8����f;p�ئ��V��b9�������ptYɺARʔM�1d5PN�������d���\��͌��`��_�-ƭ�> �G�������.ӆL��R`��K�RD�HYԥtF��櫠Mx��H�d�������� ��|;'�2��`� )L�Gĭ�Ooی[�c[Um���4<��Gj@��`9���z�A8���wI-1,i{`��%�>,B�ڔ���������2%t�#�a-����]����'y��q��Vh+��^�e��[_��A�3�>R��nyM8�r�5��eT������h��p��y"OO:I�DN�#5��&�<���J��k���}�ز�Ȱ���Y����Q2!:Z�{`�g�;;���$�Xb$���N����l������i �5W�;���UP9hX�mw'3r��۵f��O3=�����~�>�B�,�0G�(,m�W�*:���}7D��A��k8�fh��7*�^�Lf� c�<=�E�Y@��ч�)�!4���KC�V�U��b)��L$w�Q��9��i���^���0��,�XVA )u4��R.*�'{�Y��Of�F�M���q�W�y[�������9���s+�>�������A�{\�3y���t˝XQ,oA?�ς=�k��F-�`y�-}��8s�,Z��ـ1�1���-��>`B���p����#t�=c��������^�r�r-'W��HUHn�I����� ��.�d�\%��U8 ��h�QJF�٤�q�p�ϊ����*��m����.d��HU��
Static task
static1
Behavioral task
behavioral1
Sample
3e11450e312f76a2754101d8d3dbbcf1e56f33da307eaad3e091f07f538de847N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3e11450e312f76a2754101d8d3dbbcf1e56f33da307eaad3e091f07f538de847N.exe
Resource
win10v2004-20240802-en
General
-
Target
3e11450e312f76a2754101d8d3dbbcf1e56f33da307eaad3e091f07f538de847N
-
Size
5.9MB
-
MD5
0fab599bc0e1e387ce27bfb77f37dec0
-
SHA1
0114c5212a14fdddb6f79a7ad2b674a21bb71ad3
-
SHA256
3e11450e312f76a2754101d8d3dbbcf1e56f33da307eaad3e091f07f538de847
-
SHA512
98dd3805ebdc41305d5e09726a3e0d95f3916612f72226904224784fad733b598cb10e2d218d4d06d2f5ba2cef2aca31dc9281e657174ee81f08c60ce7fb87be
-
SSDEEP
98304:HIUmyjCv4Hd/gk19Y2rJJxRax7fu8F+qpDP+9iJ6gXCPtAmPIjvRHPWCRvqd:XmKw4Hd/3JJLU7fTFvpbwhgyPumPIVHa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e11450e312f76a2754101d8d3dbbcf1e56f33da307eaad3e091f07f538de847N
Files
-
3e11450e312f76a2754101d8d3dbbcf1e56f33da307eaad3e091f07f538de847N.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 45KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 17KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.7MB - Virtual size: 12.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE