�>�֝��`�e��V�̶�'1c��T-�=e�nW|�7(�A���k��7<��I�j�:��I��*��E���>ݱ��TL����� ���D@�x�qZ��|=�+F5ܒe,`AEy�#�oj�/7��@Q���yaىp��9�u嶫��2�P>ДA�]b$�r�';��}C�����}�z�C`�"&sY^���ä/?�〿G�&P�}�^n���� 3�5d�U��%"��B�>DBtV1/�JB��x �\c�$�M�>jrf�'�JcSYv�F��.ɕ�_;�����:����[���BG��Q~�!�Ҝ'�z>����O���K�{�YŃg�~��aY(��˓�n�C��{� �j#l�ˣE]�!:�t�gi�>��<�d{�bd3Ƨ�7xC�s����L�A}�4�RƦd�A7g~.��f4P���n��yd�|�?��RՒ��:9�گ��x�k���ư����3�e��;��8�yX��s.�-�܆ofzW%hs���9�L���[��O �#ɩ��`��3:�M2'��u���wy#R���e���ͯ�$}ֹ���Nr����F#4�A�����`8s�K���G��{`�z,�?$F����W8Z8��Áץ��#�|��E������Y�6�㸧��iTIq����v+J+�e��|�4�"��2�e,Ƭ�ll��`v%A���{��qk����&t>5:��Y�X�PL��ڥ�����$`�|�f�F�v�M� ����#�X ڨ�ٗ�J �pu^��^�/)�W�Wcvxg�[����O�\�W���kn�^J �as �nӀ^Y����΄����#���j�7������+r�L�mؙ;48��������^�V�%�d�� ����e$�m~�L8��t 'H���p��K�<����ep�6�FuS�~ޡ��?��H��Kj�XR~.�h���MH��B�)�ww�7�y����UFep�1��^[4f����t:�z���B�\��0�݃b� ���R�'z/�[��J�xy�T<��Wa"�ŘV����Eg���M#�G-؏F�2�Y���ᾐ�#��qDzf�Ω�5靓�b9mR~(%p̳]��i-UF�����m�6Ԉe�;3 %�h^�F�2��Y�����`K(�S�{}��,y�h��[z2�P������̇�f|J�`2B��cĂ*(�I�M�[��ƫ9�)�lfel�;<������ʵW�O�l���Г�XS*�dz`)3�89V]n�ME���2�m)� ������w�8/I�����(崏aQ�̚j�N9�Vo�㣧p0����oOv����y��<~�kE:*���| r�[��-+�?Ƌ�F#I���h� �;V�l��)��ae�p��R�_�9Q<�R��c���Z�2[�{���p.��lى�3g�0�$ך�H��i/���4����$)�ÄA���hiE�MP!h����t~�A�>�9�4^�%�{�'d9�,4�z�Q���2����OS��5N�"> T��Y%X3~ha��*����'�7���y}ɥ���B^`ڇ�ΞLT�{2yҳ��Ly�'L�$M����=�����]K����NؗY:�{�+��Y�V}�J�Lvn�r�;;���3j&�Ӊ�i��k��~�?a����CJ�h��ߠӟ�Q#�P@*q��Z4D�;WY�W�./a��q�?��ѿH�=�d��v�7�'Z�8 ��`�7�� ��A0��$����G��a��-�!װ{ �tP����&ٱ��2GS�z��t��)��l�4}�\t����C�em��PG�C����v�?��Ft��@�:4�RW|WT�2i��X�� �)�]���+��.y����lt�4�S.&��w>��+��U��E�'#�r%ȷD��Dz�7��c����B���.y�|Ƭ���ռb��> Gq<��P�iĨ �����м98-�:fZ�T~%����d3�=�0�V�A�}'���U�ۼ-9��e% @ʾz���/��֙3�<�B �d?30�������߹�ݬE[��-{�^�]h[1j�AqF@�3�~�D�^����-������͋#��@]����ݘQ��!{`9&��P�LFI�Q�Ԑ>k)K��[%4��=$��q'C�8nf�'N����O�&�i��#.:�q��|���@�����@����^�x��#����N�͉Ӡ�1�W ����j����*���Yr���^�� �0����Y~tY!` K���^� �c�������_��!48ɬB���JP�6& =�\$��:m���_(�#�����H��nZ�G-{4�J���S �O��B��ѷ@����V��.�=�At#<k��;%y�YX~�u��rK�Y�F6��Q�p�l�W�>�װ��ȅ���Q���0����6���C�dL���d#���8����26��J�sA��늀�B��nD��Q�ˀc��K�7�i���t� � ���Хu�:��!5Y�_�bI ���:K�YԠ��q�l(�$����{l �:���'���<Ē^��)h������70B�q�+���PI���I�`��z���Pށ-gO�ƶ[�z�x�@PHsq�|jx�k�祴M~�9r����^��R_� D�@+�~ɭ�A=АݲA��8O$��%=o8�?S�lo�a v����S�ܗWrv�\?�K���P�Qw�;�~����� �p?��I־Z�'S )��O�����̆���T��ǻ7�����n'\�7T�x{�Og�0$��)��b\C�|g =>��F��xD� M&��6��ΣgE����i�kq�0O�Q����M�֗Z�T�e()?,M�"�uܱ*�����ͅ�I-$��cO.���]���%,s�DydNh���폵�����饬J�����xnҸ$�_�Z�������" pp���D�x"��s;�]�A�t��=@�+��1Ẓ0m�̊��I������v}����� ���i�L�Ŷ�%"�jC����e��O�EA,���Ҝ��{���dBĘ�M�.V*��ܽ��Շ�3#�L�s�N�H�`�j��/�SiS��%�P���[���d<� �=F�D��D�Gm��
Static task
static1
Behavioral task
behavioral1
Sample
installer_S11.18.exe
Resource
win7-20240903-en
General
-
Target
installer_S11.18.exe.vir
-
Size
2.9MB
-
MD5
f97afe2c15fb0d24f9ec74c73e19344a
-
SHA1
a081dad4c0ca356b20011fa5590ca35bf32aff2f
-
SHA256
6d0119ee048b00c7d167a6c63f288911d8c5fd5334c1d50135896834bd79756a
-
SHA512
dcbf04778d11b24fd794549a4a4d800b35c31c51aadcda4240a237159ad550efbaa541efe917e1a3647c454a15e3d3af06f0663aba7241a8103f8366833a4f77
-
SSDEEP
49152:NOpptq2d346JrPO+tPvx0ANe1vsG+cfx52vktBwEITz83zo6TDOkDbnYrpILi2re:Nq3/jO+tBLE1UG+UEktB9I3ylZPS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource installer_S11.18.exe.vir
Files
-
installer_S11.18.exe.vir.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 300KB - Virtual size: 604KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 240KB - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 28KB - Virtual size: 236KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 204KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE