Ef���D.�J���a��u\Ҡ�eXg�+Ͳ��CE����J�{�F��f��!*��� �*^m���}����}�2b��ֱ!�۹��y���]�_�� ��|U����Nԭ@��t�'�MT� FE)t��v-U��,}�q�5�(��t1#��G�<����GH{�j �3Q���.A��{�o4���tA5�e^1$�ۃ 8EH+�X�oN��>�Qd!"���t���I,�fq��}M�ز&�^>-������T�#� x�m'Gp�N���J��C����NvL��b<��R�KL�YT�~)�� ���f��i AR�b� �Ț��P�ӊբ�*�� �͍]Gh���E{0�����, +8\��x����ZoOt����!�*�z���cmaaػ�Cپ�Ɔ��\���}�"�hpbJH�qc��R1=�2«��g�`k���\mE-���m(K��I�h����N�?���-���d��#�d�vr���UWmk����55t��7�&���4�+�B!UR����ܤ1.���!)�`é�d5n[{�n`.4�0�E߃|!y��繶�#�A� ����\�2�Zm�iwmq�kg�U�X�tY�A��JK.�(����&W�Ԥ��vZ�O�G��Qu�y �����6C:3���8�b�k������H��W�@���P����ùMQ� T����h^Y�+bY$��Ws��$���K���r���l ��Y�� �9z�wC��9�u|J�;~���1�ube����N%+9�v���]��+9�ϪqQź\Qz�u�1��8��6�gq~�7Yt�n.�3r��2<���}by�)���������Og���9����VJ9>@��^�P�� �fm��r�a �����v�7#��@�g6n/{����� ��u)t��3B������.nu6��ٗ�,���q8ꋚI�$8�,�CY[�5��4��EW��2�],0��Y���d��wld��$���_Y�\8SZ�q��'�`��8{��?���IJ6ey*��Q6w��2�䏨��Ɉ���07�?G�����"�3�[�L���P���B�@'��?���ĥ���}��i�N4iG?�#aVP �f��:��V���\��ӯS��N9~.%u~��'��㔳���9c:ors��br�l���>PP:��S�%µbRMэ����D��%?��G랬�+��'��1���_V$)}��6c]CW������[]�UWg!���s$N��h ��TV9%���&X�R�����dVZ(rR�i]�l� ?w��8�������?�$�Z �k+ �y��5Ϗ��a�������zd�Ɏ���x��gr&F��'^�"���5�F�D�H�q�P�@�Fr&�<'p��z��4���q�gWw�G���e�:��l�U�<�� pަm�O��+#��)��up�6����(���p'���'OrD����%]�L?E�/�U����S�[�X�h�%D]�zE�Gvu忤AѺC��9�� p�H7ZAq��7*BF��RWQ�y`7���<�K�h�.�t[j�Vr �}d���bD�D�n���;��Ju�Zw�z�yR<�ؗ�>�zxQc4�p&o��rp��%!�>N$���RY� �'�4`������� s������� ԉ��p����|k�����'�C��6w�����/�v"�6�S�0Z�τ�x��g��;�h�$ q�o{�u_.ċ�<o7]�����T- i`qH�J:���IQA��<�$���el^� �,�����~����y�b������ �i��vyN]��}Tm�v�w�d����'����]#r��{���0.�T������x���0{:� �6�҂�#V�`ț��,0�7-j�V��uy4]�6�� ��+I�� �dٷJ�o7Xz~+9ex��;��Fx�d&�^EV�B��t&��R�t�_yD�g�͵�uD�.��+�D?Jtewfٚ��I�*��l�D���_".)�x\M�t��ֱ�G���AB`��u��M�Q����g��)�#H{�}��"I�aO�@�ެ])5��|/q�������Mt�hM����Pzj�t��1z��8����ߟo�g�� ��'��d��q^� ���Z1��y?@��/�!1gU�Fh��O�����M�� ҼdTmh_4��i�oqC��8s�c<L���\w���ܭ�4]�G.g�` ߘ{�RX��CPRB�� ��[���P^<���Z��R�&2Q��E��wT����aRO�P�6^�1�_s�)�7 ���lNH�(����c�����+�`�����Âߢ��%�� �p͂��y��>g �',Ы6n"�������ݛws���-N��A�10��T�m�q����� G�.���ۛ"{�O�n�s! �:����&��ퟲ�U��Q����J��(55��(����9�1���+u���R����?fF5�|Y����J����|�&�P�w�m�ñ �y>qS��O�v�oVI�@�H�1Gk��K�7.T�w���dR�v^94������I�'�;7@Lc�WEk-:Ρ bR�m@�0i ���:�:�˟�6ӎ�����~�`�M�?��ߴ��i��8v�i&�O�� �U��u� ��J\4�ZՑ�$E~��S.n�q�O�N2������Y��d�5c�,=BK����b����B����ݖ[��������<�P2��,4�_���G_ق1w����֛�r�Ir�Ԣ��>:��1R�$��J�ߗr�Y�a�FE҆hePj31�<��{w��H.ު;ǡ�q� ��^�:����(��i�Y��r�s��ݜv��z���K����<3e��=��Dƛ�������<��7���{�Ӷ?���.(�������UJ��L��@+�2�v������l�5Y�I����a��bl�K���t��6J�&����a*EL����ꈆ����u�J�˕@�FY3������+ٽw.��W�h�N���XMQ;��L-�a�UF��sަRa�β|�v /��đH)aFbf����H�|eL�J�����c�T���9*5���O����_k������DU+�rrCC w����;g.�s�!�� ���D��4� 5'����4�iՊx�@���F�/ĵ��v���`�`���z�O��!��*��_�U�H�c<2̂q�{R���Nb� �s���dOU� ��D����]�]�K� ��YOp�8WB�{��1��,��'�&=�aI�����[i�ժصdv{� r���Y��w��|Pq%�/_b���הI��͑�'\��}�-������b�Ҿ{8��p ����yd�M������@oV+�<�E����~�;,���+3�#菖Z������5�d�#�[)��\�����4���m�>���u�#o@Y���e� �|iy����f�@_i��AT��>�Nd ܚ����Z*Muڭ� ���-�@�0퐑=�6�)�Uѐ|����Ը���:�κ�g�*������]s5��),�ʧ���}��挽Wc��wq
Static task
static1
Behavioral task
behavioral1
Sample
eb97052899bb8e9d32865a2b3269122252942286618387278279d792b13dfd72.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
eb97052899bb8e9d32865a2b3269122252942286618387278279d792b13dfd72.exe
Resource
win10v2004-20240802-en
General
-
Target
eb97052899bb8e9d32865a2b3269122252942286618387278279d792b13dfd72
-
Size
8.5MB
-
MD5
8d53eb752c4c26795c3cc334c9a64611
-
SHA1
f1a3d4a4a1110d616ad82bdb64d98b011adc00c7
-
SHA256
eb97052899bb8e9d32865a2b3269122252942286618387278279d792b13dfd72
-
SHA512
f501f8eee32ec863aa061be6fe07e382e38adeaa20b110792310f457af4591dec289145a7f10b6aa5023d5143e773312c5c5a4c078286d8604feb689db288e99
-
SSDEEP
196608:qa+ZIGwdfbWgPfZ0nwsiBOCaepkvxEcBqc2xHFJLc04ylx40tk:mZIGwdfjhTsigHvxE9c2xH/crylx402
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb97052899bb8e9d32865a2b3269122252942286618387278279d792b13dfd72
Files
-
eb97052899bb8e9d32865a2b3269122252942286618387278279d792b13dfd72.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 2.3MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.4MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 151KB - Virtual size: 988KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 147KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 297KB - Virtual size: 12.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE