��3CXxԒ���(rq�s���^}�[:29M�byܖr����%�qV .;�4�8<�c�<,��:�:쭼ύo���$�O��|�pk���,a�g��4v�-3��q�0U����\t�FCb3�Z�4?*%��Lӣ�U*5�D���Z����@��_nfc`���}�\���#iD�TD���tr��F��Y̐�c��/��8uF�[��"����C 1"��&5�s��������Y�;D��Wa0��"Bv��e���>h�x�G��]�txU�N��#up'r� p6��p1Y���-�=�wr�3�`'O�ܵ�5�poaȎ7ˆ_��%��ܷj��9�B#���h�9�G��V��F�Ϝ�;��m��*gF�B�7�>�ج_�W�n�60:$�u�����F��� ��z=�}<�I�l���>�a�H �4��0�R�L�?��,��e��. M�8p��0J�����`ۜկ��G)(,&,�c��CI�B��7��j�Y��qp��T���Q�����h �MV,�h:�ƈ�����o������ݍ8{u�8 ���1�9�Gk?#w L��]hu��~�*�dQaz��)�����>�|�bF��b �z$��2�����0��XtB&��DK�u�*��Iol���|��~E����Z ����P���1�Kʶ���J@5�Ɗ�5��- |�8��G+�`)��Z��- �NX[�g��,��d��=�H��/k?�Ns��s$�!�23?�����?��[w��{���%z>;� ��:-�:�l��Y�f�.�,'�-"e����"����R�Nk�QK�� r�K��4^����w�@`�,p�n�}d�b�R��-�Gr�J���ظ6��PF`w8�88r �T�_�V|Y����`w*�1��> W������!v����C��:59�#w�-��j�.WPbr����q:�����/q�?��_�_��lo�x�J;g������Bc{�f\�6��Z@YX>��;�A�~8���ThpP�HO�'q���n��T0r�-C)�\��>����i�A��O=���wc�@��>����� ���5����t8:HB�IvD ���+7���Nh���kQ�G;��O���l2���?)�����B!��p���J�:�|b$��*�c�6��u���4�}Ģ�QhS�G�b�:g[kX�ˢ���< S��H�7ט [�E�*ŷ\br���U���c���Y�Hmer|�"����{������LX��z��� :��.|8�� ��c�|�Y&u��.r��C%���D��<�6�|td�h�̯���G�_epZU�),f�����4�+�eK`�D~*�����\L�S����% ���>��.�SI����� �,5�Haӭ���0*��n���h�B��@�G�Gn��ȡHT9���z��%�ls)�Eo�Z��WE$������_$��#��.���J�5c��践LCa�ĺ����o�63Q�<d����O�+�O:lhi��˾��uK�m!���`ΰ���p����~B1�����)f�u���Rx��X��a�o�S->�I 59�'�,��3�nI1ڰe0���9�V��V͠���Yf/�;w���Z�x�dZtzJXҸ4T4�O�ߦ�6�S8_��,I1�ѦZ�c)2o����O��h_�h:�O213�����c�s��o �� >��K� �G��>��;�s\Hfڑ�<#��j�(�����Y���?%2����Ƿl�� ��z�5$b�.���y��!k"���>�����D�ߞq'UH�P�v=�`{��O�8�m���C:�2^�#�r'ᰵ���nV7�9+O�f.-wA�i�Y�GF��ʔLŹ�^�E��ѿ�I��/z��"�����[�t���BD�م����z��.x��Nf���Z,��Y����t�}��s�ӡ�=9_vcPq�#���k��"�Y���s�D���b���H�Sw���u����ӹt����z��� 9I�X�S��:�(��iQʬݗ�sLy��[�Wk��X�4:B�J�C���q}t�J�,�G)����]l�tǦYsӀ���P��LsJo���ȯ�+�_�<�q�I�e*B��|��Qv��v���g��x�v��џ�rS(�@Xg�P�>�TQ��%Wa�U�꼨�����/`�&���PI���]�֪�'��ɿ�?��<���J�4���i GL���������4彏����_����H������3�26 N��I-�]��������m�s�P��.t��Z� ߚ�4�<7����!M�)7g�Z�b25�h���!���^���OY�<�<{�8B�_���d�L���B��P�#h;�ԏչ���o�� �������]��}�p5Bb�P#��p�0� =!������h5!����6�;����ܧ��&V�R �LN�j����f�xqQ�/Omk�2��uo���H�!�w�Fݴ�Mg�ar�_���@�����s��'4��s�'O�b���h�N�R����y�qޗ'Ъ�,�8% ��.G1�U�ں}����Y^'6�4j�3�j�&�Y]�FM�.f�U�c��I��>��tm�q�B��<d(��P�7�0��k]�M�N���T���һ_)�]=�,���4Z�r�Z6W������Y��t�=���G�+�"���Z���I�v�Qݦ�v $cawr�]��A��K~=��4�����l�?����ꝣq(Ϲ,s+c �,���ӫ��DU/Y�qy8A�G��14�� 5O��h=`<��0L����vk�_ꁺ1D��Կc�n�⣑�pb�/�kt���~-��s��j��ajFםg���"����0�;��5��N. �D��=引��]���ͫi�0����?5�p��|���ŷJ��*<��*a�- ������#�zh�2N���3���_�=?>CY��^�V�h��Z �̃S,ܺ��,y��m�o����|�f�e�;O;^��5v��7 kC�ׄ�Q(O��I4�z%=���+X�S��ۘ4���i'\�߆�f�c�L�?%� �;��'n�z���&�ȕPЂA���GټV�%�\ W����/e��Q�3|����'�Q}Qs��n[�*����0PI�P��`��v�p�.U�F�.6�;��X&<� �y~��G����� K�{���I6"_j� }��Ǿ�J�7[��YX����.�������.��H��r�� ��ү�$�%{������2��x ��ܱ��{��o 7oj��m�!�D'��!���Gp�q��Uo1պ4@�z诡4�����c��R@�lp6�Rr�{���ׇs������0͙D!�T����}�P�ڔN�I���l���k#g�h��n����� 9tl3�������=w��bo��z����)�t�0tFU� W�0ߛ�ᯣ�����MY�Z�&uv�ЮS�^1e��#>�p�V8L<uf���Ҩ�Q� bE+�vN�f��.9}Id� �@�1�-��;��� (r$�:��i ��@:�ê-�����z�3�@H!�g���7�cɦB�/ �Ŗ7���y�lC���ʴe�~��3:�A�T�l��� � B�<���J�����]܋Bf���Zj�rZ�FF g
Static task
static1
Behavioral task
behavioral1
Sample
3898988c7d534e936363f56580b4fa51d94983dc281cd152721fbab298cc3181.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3898988c7d534e936363f56580b4fa51d94983dc281cd152721fbab298cc3181.exe
Resource
win10v2004-20241007-en
General
-
Target
3898988c7d534e936363f56580b4fa51d94983dc281cd152721fbab298cc3181
-
Size
4.6MB
-
MD5
2dd4785dd225182e8bb3b6bf08314e9a
-
SHA1
c93bcd28ee299ac56a43dfe9bb966a04265a9314
-
SHA256
3898988c7d534e936363f56580b4fa51d94983dc281cd152721fbab298cc3181
-
SHA512
becbad3969d60d8cdc8aa60c47e1d59adbbb1327a8ec39bcceccbeeac57190dcc76ea8a136869ab2820884eeb87a5bbc14011ddf9c78369534cde6f794eb6368
-
SSDEEP
98304:DQ8oOEnxJvMCJQF0k88T/Xz6YxDPz4w5iNRl9R9ccKpW4uGMpB/tA/rHG3mv:D0OEIF0ur+YpPz4sglWcKrunA/rU0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3898988c7d534e936363f56580b4fa51d94983dc281cd152721fbab298cc3181
Files
-
3898988c7d534e936363f56580b4fa51d94983dc281cd152721fbab298cc3181.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.5MB - Virtual size: 9.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 988KB - Virtual size: 988KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE