�&�9��������6� k�E|�n�V�@�67}�����O2�P�$��&O�-/~}��ɲ}1��цTg$��IEj��=��+��+���^O�=�����N�[a����&�/���ǃ%�����1 b�(M��|l�s-��s��%�`Hh��e� �c�/@��{�6 sh�N�R�$d�H���r�?��dZ���*��#��6�"��W�W�X��� jW�W���̏�*�T�;�i�w�l;ތ����3vH ���o%���P��,ӯ�A���������W�ΓX�`���v~���E��|��LUպ���Ə��]�^��f��+���r!���);&F?�T��,qi?�H,�c�şqM�$�`д2�z�'4J�o��c�#p��j�^QͿH1ץӟ!�b4Y.� � �U��{InP�#;sY���2�����(��B���<���X���LT���R� D��5�9ѲϺݑ�{�lS0��n��r��"M�0�0[�m����l�N�:F�:�������=����;�����1�PPu�Y �U%�f��W���͝-���ΌJ��"�����2���A$:B�r��g/g�G�&����+`$�(K�a>�f�ƶꌿ�_Q�`Y�/��Cl�j>FDd���������{:��t�\}�+�Zʫ�7'��4�"����L4JۯLP�AmB�|�s����]���Q+���{O_���������e9�=���jz�]��)���|o��S�!M�KҒm}W�����>�����8�1�1�!P��pfh��4��.�7(va���{�%��J��bZDx�Ԑ3ݚx��6������vf��ŭ$jCi�CD�ʰ.&|�����R0����p`N���4��-%� ��(���9Gt�q�A�𠰉e�w�A����L��h��/�a�ȫo�qLܮ��˲h�����Ex?�yqή���9�2Ge�[���]����;$��jo�4�gg54:w����f��V�?��E"�"�`@�E��x3����;�+/�K�䄋�u_���ZAY.��h�h�c�WЍ�uf��&.X����Ԩm4T$��t5����o�o��eh�/��n?��q�������8�ĥ���������z�k+�"Y��X�f��Am�A!��������,����-���J�r��4�E�o [���h���o.�+`�o�c߁�v3�7c1��%��B\�}:Q�����[q�9G�9n��9�@��G��n�����B��M�}��ӽ�¶X��W(f���B����R&����T[�S���7F�.�Z�WԈ��Zn�\�*y6�u-�bυ0�)�8a� �7oq��Ë3�~��<W��a��Pઙ�)^5��ߏO.� D�����U�c�9�J��:��]&A�P^�cƀ���Dj���R�^0ؐr ���%�bE�*� � 2��!�h�A�=A���S4}כ��1� �w��AV�D �Ic͑z�։?����G��!�ƘB�s����z�*� ���3���v�E SR&�3�w@����,*X�0{4��?�A� �+�ǬVd�H���חe�k�'/H*��6?|t/:59���Z|��GU�6��ҫ�%�Ơ'�5���dz@B�����bGI�(���ϸ�8����(�7�|w��NGx��Z����f�+� 7R���s�9�@���i��E���L��QK�Y�$��WՊp2E,S�ǀ�z�) 6�� �=x53k��L�8�e�}����F�%tsCj����>6F7�u>US|qW�C��#�.�cK�zZH���79�H�#{e�[�͉�$�f�|�����8�����W�,��ľ�:���+(}Sp��9��d�Rr{lT�:�M΄����WK 7�;��EhVdXh�#oI �����`|�ֆ+[�����ʟ�2'Ɂ�iXGq�_�i�� ������[��������uH�.��hN�%�]@����� ���ׯ�=Sm�1�=7�&���Av�^�N/���pk�7\�-�X����3�)#��`^���']�0(f9Y�O��vA�D�6:�p���+v(ψRV�m>?��(=c��6����`���Fq[�����G$��_��������W�-o0�-磉��[! 혼�\����̑ un��$���9�y�� �;�������$��&��)<����v�&��?Fw�{��g[��,�����j=���Ug;w���\XoC��X0�H������k�!�5���E��Bl�`J%�r�qH��N��_��������6NB�&g�W�*�w`F9���A�����BS+� �|��z�:d��XR;�j<�}E3x���c�-@�m��<-|u��#;9 �;�oY ��:�k�GB�w��b_�&D~bt0m�c����f诳�0Q�H��<���ۿp�QX����R���6�b�'ބ(3G�-���=a���q-�0��L|8t��9�u��(����K!�^f�!��� ��Q�Ȳ��3Q�� 3V�Χ�R���K�Xj��ȡړ�Ȓ-�:Ʒ���b��oF�BE�!g�{�����1����Y;��u�ד�Õ���EY��5�,��u�2K}���Tx�Iy�6g���ʗ����w�}Ccj�@ׁ8�����mњ�=��o�h�ip�YX}�0�k���1�0���% _�A�W�RjՎ3� �������c���/��U������El���2��9r ���.�� �aC��F|�N4�Ӌ��z���}z�.�S�Y�[<��#U��Nq�����g��0~��35P)ƿ2�q��h��ߙ�P�5��I��:�:r�~ �uM�C�#�]���'��6��T2�b'z �\��Bq"'�HS��x�8T�>�``����ˇ?��!�/��oM�eu L|��Ƭ��#�����j��c�Z� ոb�a+⊰��e! ��ٗ��"loF�u����ܢ]���EC=�0> l�S�eG����dY��K�iai�B\�rmY�G^��]�/�x�~�є�GJ��U~��{bBIZ![�W
Behavioral task
behavioral1
Sample
f8be6c49a383616977d4d206d168cbe571cc23cde1d6f37ba649ee0d808ab075.exe
Resource
win7-20240903-en
General
-
Target
f8be6c49a383616977d4d206d168cbe571cc23cde1d6f37ba649ee0d808ab075
-
Size
4.8MB
-
MD5
caf0b6ead72822c6404f80dda614c400
-
SHA1
2c794a82842c99d9f776b73855e10b5f0666c1db
-
SHA256
f8be6c49a383616977d4d206d168cbe571cc23cde1d6f37ba649ee0d808ab075
-
SHA512
15cd9174396289f2d2d48a58092bde1675b4094074b7df20753efb675724f60dfc2d1b92c551a53d7b8d91214a658343323baa4923bfbec57bdd28510482112e
-
SSDEEP
98304:9zF53eQCsvjYQRUyhwlDnATLQfQ582NzW2E2nMCIVwG8AjKAjgQZIouEqc:9zLnJv0byhwATLQfQC2MCPLEjgTjc
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f8be6c49a383616977d4d206d168cbe571cc23cde1d6f37ba649ee0d808ab075
Files
-
f8be6c49a383616977d4d206d168cbe571cc23cde1d6f37ba649ee0d808ab075.exe windows:5 windows x86 arch:x86
dbfedc155114e93b03253d2457becdac
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
UPX0 Size: - Virtual size: 316KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ