ռx�hObGٵ�[c�8kG�%g�\\�Õp�GR�dM�X�@���P��Ϥ�/�3��:��\m(G���}vU��^aI~5��Tr�^�;D0����p���,���?�z/?ZE��֡���� f��rP) ����7�"(G��Z��fs�]�s�%f�� ��,K����xE��\@�MJ�g �����( ��e_��^�Å��<���#ǼO�L���X���gUL��l0�N� �k�S�j@�Iy����F����]Ooat�X��шy6U�㎚ ����L#�O������tZ�kc�����=��=��F%{nt-TϺ�����/��9��Z��p��_f�Bb<P�2&�`���(����oU��ɝ����w������A�Vˋ�K���݀����l'B�@h��Jx��ዧ�sf�k�W�N��@�P��rQ��ÿ���H/}��\g�^���������w�Ph��{jH�����x���ŋ�H�;x���y��s����k�� ��_C��qż���" A˟�H����W�"E��?@I�9*;HE���h�\�%�'��v�ξ���р�f?����N륗�9�*� ��SXt�yd뻄�k<���k?��i��-�NU����m���[8Nau���kC>�p=�|O�)�J\�#uQ��JBܹ�����j ���d�c�gb�� ����H��6g�ڳ�������(l��ٺ��(�W$�d�H��b|��T^�I���ch���/3�n ��=P����A�W�#{K[��G����Vc`;�vHyÜi�lJˏ7��@�:S-{�$Q�Jx��B�s L��RU�ǻ��FH�^Qi��N �r����ߟ�BI����*�F�u�F]���$jEP���䑷�S F@ƚ uɿF��P��e��ƤQ��9���'����6��=r�oHܐ��@�7���䙼�İo j���yg�Z ��x�BP�)��̲���]Þ��p��iϙJ���$�������$oz�mz�������J)�T�KI�_�':dX��)T��s��I�`@�����dt(� �g�[���g�7r~L�I��fYu�4QO�yb��}ϸ���y�Rܜձ��b��� ����f�+�?������~7`Oo�"�4�aG�L�����Ie���;$���e��U���� =���<��I� �������.�J��#�4�Rf����)M4&�8r�dǹe�H�na�;ǻ�UafDֆQ�[�p ���l�p~�S����$��M��L/�@�l �Bj8��gP��yD�=7���mD'�u����0�W��{������p4-D�~����Mz���z�-/gy��f��HB$� h��D����8�-��7�qIh���&���Xk}���$����t���ό�<��N�A3��_;˕��8}�q��?��hu�C��/�tPj�u�D�&�jo�_"�>����~b�ո>���rw���n��7���4�:��&P�j�2L�O�Ql���ZΌ2�mi�8�P~�t�ö�E"���ޠ�,�V����_�\k����h�B��k7�ZI�4��_�Fv�#Z�5Z��Ul��U�_����w��2-��S��[1�nk� W�R¯���Sl��jz��RIqNp��t���̭.��YOS߃�:���ݫ�Qɦ$��Y��j� �/nPW�5�m���k�HVe0��艞t-�8��i������j��=Y��Nh�C��4����@BՅ�^��:|Q�\V���${� �u ������sH '�ơ�i�T��3��+QA&pܼ�������t��ǡ�� \$7E���+$��cu����7b��O{��L+ ���D���Nt@�����������&d2h{� x��!-JE��s�o;<��6�Ht���x��d��"}ϱOF�����x�R- x!�(%L���6�z�[��&�u�o:�*o? 6S ��d�Ӓ��MB^�L��ګ6eb��sf >O�nVL-=��3���q�,Uϫ����s�����~�s�m�Č��R�?~��2�~Y4��͡?#<�e��=x�,�t2�������^��qk�u�4u�Jb����5� Q��Np�J��pgN�ȸd�d'�{�no���@�����j>'|��<y�^��4�^ޙ&��KK:^a���!V������K~3�HP�1�]��*������Dg'�<wu ��_�`RD� s��˯�`�U�K+�J�7�0l��T�Ti�Z_�T���qa�B��qMhy�a�8�]t�j�abytTG�.���i�[G1P���ck?P��K�����D���ְh����Ƃ���9+�UNx����S��Ou��h!"�(��1y��v�zƟJ�ᴹduژ�W+�O��Z3���Nw��N��*'(qQ���i��PeD�����. lqvF��{O�qzt �x^���`����n�T*�\�,�f Ϯ���������P���E\ү?$��Z �L�.bw�/H8���������G��ITUS"�4xS��^, ��ԑ+����g*I�V�D� ��X��xS������y�n,1�{������h5�K�� ��#L���!�/?����o��L����x+�"�1��쁰���̐ʶi�G����j�24_�o �e�!ZW3T�o��wusܢ�o�͎�h�fE�uBv�S S����1UMx$r[��[XV?I�L;!7V��1�z�����ԆN�(���l�v5���C��(Q�:Q5w�!h{w�W���{��r��NMA�)v���ݨmy�h��U^`���>�_w�i5L�����1x?y*�,�y�&�I���yj�i o��>��tJ��� G�O�}ڲ���P,*mM����([�I7'�Z[^ضu���G�:�|��bUگ����e������7-�R����mF*Y��|+vv��dϛ�\U��E�g��B@��+�"�tBKE%��U�����?zX/h�� �e�r�w�.����o�K<��^U��MI��^�ƍ��!����/�4�c�I��wjnԊ��λ���6H0�+�zΞ{p�% ��2�y����Imt^C�~8`���k=E/��te�'�@o�Dw1�g7�H]D���M�楖D�٪�Y㷫�^�iT8,Rd�@�K��IQ���fQ�;~����M�m�`��j'��P�R���?�����8k����o*�U&�><�`Y ����m�� ��yf����Tl�o*���m
Static task
static1
Behavioral task
behavioral1
Sample
5677ed2c8e5b618278524b8c3ebc265515ce6eb5ac55e9909fece9cb621c557b.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5677ed2c8e5b618278524b8c3ebc265515ce6eb5ac55e9909fece9cb621c557b.exe
Resource
win10v2004-20241007-en
General
-
Target
5677ed2c8e5b618278524b8c3ebc265515ce6eb5ac55e9909fece9cb621c557b
-
Size
7.9MB
-
MD5
82f06cf6d2e12c262699d734fe231ca5
-
SHA1
a656601ac638277777c3d463d11f93e18d4e784d
-
SHA256
5677ed2c8e5b618278524b8c3ebc265515ce6eb5ac55e9909fece9cb621c557b
-
SHA512
b4f275b44193cf9096f3fb30536fcd54c83e77fab2ddf67ddae1a7491b064896725fcb773a6f84321872c3e9b96585990bfa82f0f34640038323a8fafc89f299
-
SSDEEP
196608:i9/McpTmOe13wtlu+ApJcbkMtlWgz4qg9M2zhHGHPAOAI8D2s:iNnmZTcwglT92z+Ao8P
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5677ed2c8e5b618278524b8c3ebc265515ce6eb5ac55e9909fece9cb621c557b
Files
-
5677ed2c8e5b618278524b8c3ebc265515ce6eb5ac55e9909fece9cb621c557b.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.6MB - Virtual size: 4.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 136KB - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 15KB - Virtual size: 684KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.d23 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma1 Size: 3.7MB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma2 Size: 264KB - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE