>mw��^�J������ f��`輆7�k����7uu���[�Q�+P� vh&��"-�]��R\�*a���)[�uʤ�����Z|�������)^�`w���D� ���{����������4=! -� ݣ��8��3���8k0Pص���b���W*��=nE'�y�3�?���\j?\�6Olvߧ���B�5�D�.�' �)� ו�ff|hqw���֒�vT���_3�w��Ԥ��1մ��J�8� 5������9��=κX����p�J|��V<�"q��H���#� ����Rw �9��(��i�Mr�_M��T��L� *��j8,�a�mA�'WB�4��\ܓw������;�� ���e��3���6��Q��� |֛���};2H��\��8����n2;���K�� :\�.�����d?����;��9!�ra�B7��m�@e���O��ӎ���5U/9�E������kWf��ʆ-��N�G�A�Ő<|�����mH�W��s��X*;�q�Q�l�)a��$�]N����������Ip��t������h�a�E/���hΔ��v�K�)�Y8K9��mI�0:�hk�m'��BoI*��Y�{��ŭ�g�qc�b�/��.�w�8��� iJiL��fz�\t��Q���Έ�C�����g�ƍ)� ���b�h�@�l��:Fo9@��|ͬm� @^xu�������\-�C����HfL�DrT�J,��&�>��3~.���|, zhK�ibE����yM�V���Գ� E&���<�^`�V�z��1c��/�qo�D��|L���خYsx��,y���|hX\1��B�� `�k&�IE�;��X��T�^w�nY��!�UEF����?�doⲚ�c �7��;���a!:����ʼm���7��1��P���������K �VMä�P����b�@Z&�ϹXѸ�ikQ�����^I�Űh���������;Q��1��U�O� $� \�1-�����o�BE]��T�כ�Eq�D��}2�$�&09� 05��rsZ}���TgV���� ��+v��$8�5�@*h(�Y(��|��U�njM��y������M�b[�0]��A��SMD��4�?�}�������h�h���������ʢ����M��bj�0�d��qǨ�^��k����]��pv�D��-��+�ܘMC���j����9�(��Н�.J����8@���� y�����{a��[�l/��Թ�ý�8���`ƀ�q�!8\RMW�ݖ���D+NH�:��N��w|�a���ki�s�ʟr�x̉&��^�����V3�h�資G���~��ἒ2�i��n���;u �z�� Tr�8��#8�7A���y������P6�ޒd!KY{�Qe*��Q�jGF����@�s�3z�k=�v���H�Hċ�K VM(��sl�Ld7�qرT�M:���1·���ո�ɬ$g�K����`I���{�4����f�)��״�@�4b���T[�p��à:�n$y%W�?�m�ez8�dA�h�t�PSm��A���o��0���;�%C�߸�W'�QPcῗob���#DclG��b���?�����D9ů]��9����]��d��m��s����"���<�.V���p-���u�n��w)��ϭ`�ސ� ��\��V�OV���!'�p-�0�B %��T�#�ڐ�����L�c]�5_LM!����{���7�%�=�H�Ot�j��;a��'������Y�C&��l�E�i���l���?U���ן��� �p��=���2fh+�oo����GXV4�_�B|c�1 �m�Bp�P���?R�]�<�����_J����ү������:�3�2���� �+�zX�t�fI�����R}v�����[mXJKp�Fb�-�}]�Nalj۰3���R&?b�~RQq��d����*ŏ:y�4�=q��q��88��g�V�`��@y)e�EU�Vip.�%|f�{[j���[���.����뤱�HI��-f �~g��P�!��״�I��=D���� &����ư� ��\,X��Lx�6P~�n9ߧn� �A+\z�CeuU/��/���7�_��Y$cKzl~u��+��V�`wP���v8~.���`6f_�^U:8F}H��mWۍ��1�66���>�@Bm�X1,-W^=jĜxD�����P�a���لǃ�2[��xgt-7�嗞�D��@JA�B1��m7%���ׯ����������U��d͜���!���I���������1�+"������f�s,�U����� �������ʤ�����Z�jee��������j����)Y�`�T�ֆ��Ƙ+����NKa�ueBw�q�g� f<k�����?�xA�Mg�D-��N1�ڗo��#L7PN�F�c?Ls��|b �� ��X���mS�Y�>Y|�K&'�>���9Jhp�]�:��,�֔Y��Y�T��iGRo��?J8��HC�063M�� H_]�wϊls ���-z �/SZ%(�q�ydWK���^(E��1���;l��=,~çg���Ԙ���m�ͯs�Çv�}��s��1j���<�R���t��Q��M~M_��I"M������s'g����i�M��k"��b�qS6S��T��+"�'b��<�F��yT�B���Y ���#�6�5Pp�@e��V���E��ϩ����g�@Z ��+{��sc���\���X��?0N�0����[�#���� �� .� ̀�w��5�P��ڠk�)�/!':��;��h1�.�S��ٶ�Y�S ��d�v����ϸ栗�� �� -��|���m\W�UK�%�n�l��u*GOp ���.a@;��ʓg�h�k �m� �MM�6�GH�N�����`<��Q�2L�N��-����9������^!��2���V��:r*`h�:~'S"��4�)ȊH<?M%݉���^�)� Vg[���X��F[���غ�十������KE�����Y"\��� �hA+���t@nf V�n9}�쉔�A��k��Q{^Y��p�uFJ�~�8�̡�x��L �l�N�Ս�ߠr���`x�荠���c}��WI��/.J+ ��2��|��n��}aLPID��Q$����K��S2r��R�����8���%�o4�"����ڴ7�*f����N%�����cSk��5���m�����{nNs�����6r���·���I�N~����e�`�I���E�����O:���l�
Static task
static1
Behavioral task
behavioral1
Sample
2aef4cdf8846df0a35071e56e41c732b6259fbd2af6a288f81c9ce0fc1e7bcc3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2aef4cdf8846df0a35071e56e41c732b6259fbd2af6a288f81c9ce0fc1e7bcc3.exe
Resource
win10v2004-20241007-en
General
-
Target
2aef4cdf8846df0a35071e56e41c732b6259fbd2af6a288f81c9ce0fc1e7bcc3
-
Size
11.9MB
-
MD5
51ee7c8663cd612fb83b3b6e35ff8277
-
SHA1
56bc5a66bbf1f4ba483b3e8c7b28c3dc48a642a0
-
SHA256
2aef4cdf8846df0a35071e56e41c732b6259fbd2af6a288f81c9ce0fc1e7bcc3
-
SHA512
e749714d4a5246dc77ebd0e8189bac5c8915687c0bba8fa827cd6c91d5027e0df43034554c5e9f85bf2bf9bc7d700c9c884533d1df8e0a0dba3dc6ec5665f53d
-
SSDEEP
196608:vSB2RFhgKUkVtFpNAMNwJGOV7JFI1xIgEcCrWpUhUsYbypZhQIY3lB6:vY2VTyMNmGO3FMxNCrWpRMZM1B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2aef4cdf8846df0a35071e56e41c732b6259fbd2af6a288f81c9ce0fc1e7bcc3
Files
-
2aef4cdf8846df0a35071e56e41c732b6259fbd2af6a288f81c9ce0fc1e7bcc3.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 2.3MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.4MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 151KB - Virtual size: 988KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 148KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 297KB - Virtual size: 17.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE