��ix-M���{�8Yp[$��@��r�Ǥ�&�[��1�֩� l,����H���L���2?|�fEH�mE�ٯM���v�0�ծ�ʙ��>����w�]�;�<�x�~�K ;_�BsJ{�tm^�k~�a7�����S��{�@[@e�|��G[�:h�8x�G��b�}���!b����>�:T�������cǾ�>c�TG�rғ0|#��j=^@�2��'ZJ������D�,����!֧/�0���++`�D�q�XOK���WW�ˌ���Ȭ+���M� �����Tr��j�����K阪�DGP佪�Y˹QˈZ�.��|��`�g֠�Ey�+��9�XHZF�&Y�k�b�ĨO�b�Q3�����,�$ݶ���`UߕddP���f#&�V���D,��3���b�S�쉐�2�Ԝ�|�(�B��Zmq�pX�tYk�QJ|��a��|�ZH�"�-��1ľ�YX�]�}�� ��_1��P�ѝ4�1WPk�V�*�����L7�-'.�EᯩFL@)��Kd�x���O�<(����l5d�� ��E��<��UP�i���o�%�����D"x �=j�|F>�*^��D�M��Hx�ofT:��S%P_�N��O| w!)8k!'HD��M<�/,F��,�յg;�+D��~:DFV�l5FZ��-���q`��ms�[�̭b��X��b��[����p-Ѷ��<55��K72��9T�L8$����R��;�_Hs%�cu&���,�q䒭�L[��� y�N�ƺ̅Pg����3:�-�@ۨVtgch1&G�,�F����`�]Bn�1����;���ϳv����1�]w1 ����C����W����O0�t�8.�p�lH%#t���'q��'�%°r�t��:�+�H�nU��ɶ�E=8si�����+qh��%Y��եgB0�Ä�PjM��w�د�̌�fT�}��Ml=���h49>h`"�q4" �A+'��n����O��N�c?>��}�ղ���u� ����e,�)��/F�;�3b�4o��T��5^i�EM��}���)d�h �U>����ߎ���}<�k�D�Q1����H�me[�����;�l�U6j�q��D /���г���{��?�$<��g��n`}Q�{�X"SZP��=LgU���0��L���Ko��������'ʳ�`�|�.#͈��E���h�vS�urz&2��'i�% ����.G���k�Ҳ�Աf���T(���S�X�]:�c�eHy ��8;�w�A>W���.� �;w[�NP��n��)v� ?���C�4��4å����cR �p�����de�����"�Dq�i3�PG0*w� ��TU�aW%RE��Q�8d�d!L<%��>j-�Qxhq�,Z������_��,��0�Gr�`�0jE9��&��X5���o����g�n��j��+�e'�\�i�@7W�F�p� �{z��ݘI������{�s;�`�>�����5��`�<�xݴ�|M�ׇ��� X��c�l|�+G��Ǥ�^F���sr�����Ӣ�F~��N���X���n�������a@'�"}�����W)�)���=9�$����8mH���j.K2 �u+�V�:��#X�z��KB3Bw�ZA? NU��e!~ h=������F%Y���xQ�1��� "cڇdԕ�?���c8@���~̇��dCQ����0D;�(�èGi �t�e7�(q�P���op�_�;k�I0WK���P9��N|���ک�s^qr+^���=':ZC������z�w��q���ߚI�~%��icn@�.�?��O��p�����Ti8��˺dI����昲ʖ�;N�̉����1�;��p�c�I�|%��0�G��Z��wq����ﵑ^"�h�d�)d�22s��K�cm�i���-�`!3ڴ�*ggJSH�6� �p���#�j�e�bI��t�i|{��Q�-zX��xA���c_g=��!��h��uKg� �i!��B`�e�,�;�#�����J���.�~�j� ���R3�9��2��x����.ZY課��f �c0@y6w����U`��]������Gs6s ���I�R:~�a���F�ړ.ա����� T��\��p���ٯXp�Y��x�'=�'@0��OZ�h�=mz���)�9.��)�ƻ�UӮH�/��V-���T����[��|��L`�;g˄k7���Y�"8�������c��&HX��z�g�`��4e��@�wS� S�3�'��7��tK/$�N-"[?��H�,���L.����� �X���CPw���H|��C*`���n�,���Ҟy2sb������[���;v�A�p;f7 Uq��\*sc��A7��3�o=�@aз�SF�&�����0�������Jف�V�����c �(�j��@l��\�Z=#1���~�)3��D�%��g����T�=�ڢʧ�Q�dޤ�9����!p\d}���'�k��"��X��<$��e\;t5|(�Z�l��<���V�o]Rhu�lH9�P�kM�z) `���3�Q�+�u��b�Yo��"�Z�v�;!�:�7���( ���5��k����^�קd�U�W�L(_�'�w�����:�GZ�#m)���!���&A<Ck��u�~ l�9��aϑ;��~��Ix��u���R)�|� O쬒M떥�w���Nk/�.�-��C�e'��i��TQ�CE�p���1�����?�y�"�� �I�i����C�G>�b�S��eO7�n�4a�O/VK��ud���F���fw�����/���PMc!~X$��&��[e��U�|��&JF�K!a�su� �ǽB��4tU<>�K��s���v�J�����5{��>�$�1�h�V}-�U�ٞ�S�z�Fb����2���::�2mV�R��ԯ%]'�b��&)�9$/4��{s�6J��S��' �S�P���CM�A`%�-v���_i0�1/B�y[��\�/��.$S�<�/3̧у4O�w[��c�x�7����z��ۓ�]� <c���6�K6�]�>��K�k���K�����(�)�]��>Z��-=e\L����Cp�=F��
Static task
static1
Behavioral task
behavioral1
Sample
ead38fce547c6469862fb519732e0295a4c72159ad24b065a6165e613ebd50fd.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ead38fce547c6469862fb519732e0295a4c72159ad24b065a6165e613ebd50fd.exe
Resource
win10v2004-20240802-en
General
-
Target
ead38fce547c6469862fb519732e0295a4c72159ad24b065a6165e613ebd50fd
-
Size
8.6MB
-
MD5
daac772e21c3729ae4b4c83a7a48cc74
-
SHA1
4d4c02ede65e642b6a3d299c83f538b9c2486abe
-
SHA256
ead38fce547c6469862fb519732e0295a4c72159ad24b065a6165e613ebd50fd
-
SHA512
3b05c8888d0250f9281f03c37fbf48717722b8f39956eb2dde36e14a8678549dfb4d1bc002f441c9c9fb96e262707b12f88f93e7484e18f8c32fc0c69fba7ee3
-
SSDEEP
196608:KntEzJSR+wCfXMjAD+k5NL29LyxCx4A+pppcA3fZEdpiWyUQg:KtEEPAbq9LnxOI2y1yUQg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ead38fce547c6469862fb519732e0295a4c72159ad24b065a6165e613ebd50fd
Files
-
ead38fce547c6469862fb519732e0295a4c72159ad24b065a6165e613ebd50fd.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 2.3MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.4MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 151KB - Virtual size: 988KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 260KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 258KB - Virtual size: 260KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 297KB - Virtual size: 12.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE