���ʰ7����NJ7�nF[�X ��M�%��M���UE >օ����6��4�Ah5A�E2����{��X�Ӛ��^����X���:�:�Ő�1�b�����xB�:�V���q���[\�kN����3Lj��&�vqW�.6����2��nU����]ݔ���- ^Jx��u����C+�Y���9u��.)��[ՠ���gt.ҋ�~Ϙ<��_Yڻ��V�K��q��_uvv:T�d*��?,4��QY�\��JA��Hȁ�,�9���ߊ�Yϸ��2lt1�����þ��H��ŊTĸC%k��Ҁ�D�I���1 0�e�#���nc��X+�}�a/�~E��hE����L��������R����8����M�EL[����.ՆSW����r��`�n�}�#��v�Vg"3*��������#A#~va��$�O�l|���m���i��|��=j��OE��[|L����ť��c�������L��]s�;�"�F�g3WXCju�>�'��?��j��;t.Kv�p��I�;&��%�E\(%�KV��m?��Z*�������E���ۯ�'峀�m��ț_�W-%�u���;ҽ�m��3�ڹ.MKn+�����l_����2�!ϻ����Y��ߢ�� ������p1`-$\�EG��K�8b��F�d{"��|1�"�9 /�S>�����gx)' t�ý"�|��꣫VfL��k�)���p� ��6�mUd��J�٬mG�o���qL��k{TEO3������|�x��sL���l�E*slQ�;:{�dnhg���S��v�Z:A[��?�D��������=��7�{�7 A������;Q��i�|�}�,L�]LN���ΉR� 4��� 4\j-Q��кކGJ��s\�f�e �s6BB� ��16�_Ū�_a��(�q~A˫���.�9�䤯������F���c��M!i ���l�<��o�m�&g��~ō]D��_jP�%M0��\;/!z��X�˟4,��E4۱ �XW��9�0P''nޫ'M��XJD \0Q�!�w��D8KZ��+h�B�/M��wN�P>�& 3�Ǥ3�_]�3t�,\�[���X�FC��(�s ��������Cs<t�v��/6C&�2�\��%�� �|Y*��!��z��{il��v_�|��-$P��|־ϴ+�;�R�cX�xS��u�"�1+�96�e�ښ�K���vըDza�#84���4#ߞ�=�]�g����Բ��pw�( ��c~5��l���&I�@XS��V42��[�M$��z!mg���)>ZkSU�X� �ɒ�Fi��n�b��W�����hli!���K+���xP����@t��l���@u��hp!C�R��h6d[?{)�"�v*��7�}S�N��e��o�qk�������Ӊ��>��F+�&��� Ĕ!E%��s'p���m]|"(�7{�I�E�9@o�H|Zv�3���e�p��+�1������O�gD \I�ڦj���Oܗ�fםm��B�_\�ju���W�+�!9�ve�e��5������J�S����p�O�w�g����-�KU'� +g���>td/�qyY35����c��7mT�ꘫ��~_x�2J�$zp�T�ì�\�Q��B�o��^Hi.��2[��t��-�G ������a�L/�&��չ�����H��<Z �������7iMt�fvs�#]�@c:4�k�l�yփzt�В��3�=�~�OMk�Yǎ�zn,S�t~�R�nr���/�mJ�����ȵ�������hC/v5W)F-��H�d��T�<�^+ �L�te *��-��d�����u�LL:��8X�3��m#~�'yܓ�Ӡ���=���! �U��T�3�}��]Ӣ��(�&����5�a��%o�?ܗ��e%F����<1�4mwn�6��j0 ^n>ò"����{��T�Q�7C���l�艝v��&��Ov���HǹA5�{�C��_������b�z}\���^.��5��R�ߥ>��\!mV@��U�9���ඥ�!����������WΊ�q�)�,F�h�o��+�b]ް�s��%����]Z�O�M�,@��&��L� �;��.�v,jө����ݔ]��hY&2*�lj�-���ܗ����&����ן���}��V"���%V�1��,H��`n��+� ԙ�|Mf�ק,��u�G��"�� Ղ":.����~���0g�����%w�G�k���п��\zZz�T� �"itbŸjÚ%�$�e�:�}T�s�N5�=ˈ(F�m��}����1c����Q�LU�7C���$`���[�eV@s�X�x���@rm���6�����:#� �x�o:Un`Q.�hs����� ��6�2��9�ju ��C�ⅇ��>�7v���T�W�Xy��o���Nx�Q��*-����[���Z�E�K���:X/Q(0��K�TrX������;_wkt��^����-o��1?����ő��om�y�.�)��w[W �l���^�^���pR�A!�Gرo�_��vN�����^!�+�s1�c��/y��F����|�졙��ai'����T/�m�EӃ�y국p@�q���k}n���ۏ߽7�Z�- ��ҏ�K�&>�M}�Br� @q��#c\���U��[�זT�2�t+������!z��3�� �����_|���T�Z��T�3�:\A��3���y3�B�m?��F���S�%�N|G�?����SO�)�d�A��N�eNV6=]G�x\)��υ ��kE^��A�X�[�/�X������&4�CzЄ� �4't���+�L�K�u1����9�ʕ��iH[���4j��k�����a�hTZ w�Ć�i2`�����l��;ø���z���W#G��(��Ps3���w>��2��ӓ�k�w+��_yb�ٖs'�Hg��h�$�����?^Xt����7��=���%�W�ڟ[�Q�J�ָb��ҩ8��C��4���D�����&g���e�'4�� ��g�E�b�zd�������d�']��蟄ua�M7Q�o�W�i��qæG����1�x�B8_����ҷ�`�?�I��$��=���2a+@r=��B�������U��g>s��noVG���2�83��^�$9�(�y]��諢|�т�m��wm��e+�%�<��c��{4m��5է�É��K1���� "�%$�oQ��Z���i&��M�R�D��������c��0��b��������%������{��[Y�����I��� �ǣB)`@� �v�~=�S��lW(ϡ���J��,�Viy��3���R��#y����B��K��8����$FIޗ�� .VJ6V���h=f�C;��8ۨQR��TGz[�
Static task
static1
General
-
Target
Dropper_protected.exe
-
Size
5.7MB
-
MD5
95f9265e284dbccd509025fdc368cadd
-
SHA1
a63c64dfe79d97aba4056539e1ae9905d1cf518f
-
SHA256
dd1d0772b969998d05d329411a3dec9ec52b344df956749dc9998f48107487d0
-
SHA512
18e0d2e959285dcc8b96bcb3dcbedaf7a8e868fb705f9d941ad5914820f17fd4a4d1889a713d032ffa65fbc3365635f7407b616f86b206406d31bba2e0f03040
-
SSDEEP
98304:d4Ngr8BHpJCLdpkaPDE+7sP3Nh7GsOSa5NJcHjJmZLXuDQn9ebtmg2bhWpxBZMxN:dV8h4pkaPDE+Uj7G7pNJqEKKitF2VWLE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Dropper_protected.exe
Files
-
Dropper_protected.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 32KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 204KB - Virtual size: 21.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE