;��a��'ny5��.vS��a���=pa<嗛�:;JM��QAU��9�BY�*~V�]�P��Q���W���Y�2%[dU���x����ɺ�?���mn��R0T��Ա( �^@}[��]�6���ص�����=��M��$�U1����?���G�4U�����n��)i���$��q���\kaY-���IH��ԣ�Ul˚0?���)Kӕ�uLbT,�b���U�r5g�Wk���v5ǘ3T�du��hub�����sA��@My����q�e�T$�;�4vA46��x���7� R��������O"J�km���8(�mji~c<��cMz��CI���Y{�J�5���ұ�G�`��(� ��H�Yd�Վ�&[S�F�����Ԛ��d��S!����U�MSH�f%Z�K���,��匥��a��`e��G.�������"%����>��k�|;��!�݅$�;E��LA����hXLd��U�#���I?�0�/�l�/KC�Fs��)eG��-~u��kE:�]y{rY�Ӛu�ٟ� ���OJ��Z��Jd5��{��)K�eԎ��%�1e���s(��{p�-�E�A��ɼ�M�x�D+Y����)�-3�J+c�,�?����!0�Z�@o�����\3"�.�w���hE�J��>�مx]�)a7}C��4F��'�J5>���.����!�]�[J����6�)��I�mR�XC^>�#�����x��J�{�m�� .��1��E잱��/���g��CIk���aa��� �Y���>9ħ�����_��oBP�e �<>Fϳ�jE��۷��W��2ïn���+ކ ����G�w��[�I�^�a������;�4�e[˅��{�Z�)�hy +�<8�wW���� �E';�m�V��t���C8oN�U^���ՙ�����i���t��떵�ND�tX��� S+OZK�O�e$��}�.���qK������o�Y�u�G�~S���o��I} �ȁ[%�#�qk�56xQ8���Rh۱x�$�lk�Η�R�� ���O�ݧ��*�9ޏ�nf���އyJ8���z�]�!�����e�+݆��C��%k�K���QP�FG��W#��@�i�t�h 8]�J��G����8r~�ڵj�PϦa�Þ=��5�1��U>7-��'}�m�G��S{�R���")�փ7�������nY�сG�Q߯A�zזWC��ε�'kc��Kwk��u�����$��ϳ8NH��>����`��v\G� �!?��,�����[����4����%'2r�mM�)uR��Zu��2��ب��->��(�����i�ު�M|��r�ߏ���EC�ӆ��:z.��v�̭ |0H����x&���Q$;�ku��4 �pKg��� 跸!��i��7���>Y.�7�cm\1�tF�@g�qUgY�5�� �6cE��`RS�����)}�|�y^����� %C1�|��p2�N���3H�{����d���>��4V[���b���y�;A����י��z�1� ���>�m�f����]W�8�Br���u�F�-�j��48���6�r����\4����r<���!�-Ե�e����n������B��� =��a@���|���r�I:7O�+LNeC2`���ӝ�!��3x���S��P�0c ~I��Y->2@1��)i�+3�o[:��%&��>O����t6���l�*]vxVQ��/J1��,o*K���JRSv�h;ә�<�suHM��0�R��br�ss��w�<}��C��&:�%�.LŤK�X�s>�G���6�Q���& yr/��/-��j��<��e|���xܥ3N�1�aN lM�h�����F쵦��.�pw^��7�� ���4����ny���+R�Z�z�� E?6�W���B54�̈L�� _��j�5}A�hwm�V�� ˲�C()<�T���v���ʭ�]mK�ʙU��qk)�&��I��� <g7��,jzv��|8���i�Y҈�l��e���a���İ��a����������R�=/�к�]u�k�9���u�B��u$o�<:� �� �#�Th5�߆g� W̮p���4�0W:tO��2{�K��!-��Q���V���Qb����w ��žu<��2��t�R��25��n1��y��叢�G��/ɑ����Y�)=�U�H�sP�j,ݭ̙ ���P꿲h������,�U)���?����[[$s�� �����٪�;#�\��bX�������N@\���Q�AsR�j���24�"����4���g� ��Ll��]�&�:����\n����!���d8A@*y�u����yHe��Ȉ��&"w�8̚��r��&���kd��U���f���������8�[��Mb�g�)��V�>#�6Fxj��� ����(�֩���lR|Nz`�C�Z�%sw29XO�榽�Қ�]e���4yb�/C8H�_1O��P���$~�Z�oƒB�����G4���4c5��ן��8�ˢ8|���zie����ɡg�=� ��24F���`��q ���/�7ݾRr �b@<oVỶ�N=�qc#G]!�u��6��"8`,�^_��������a ��Ģ�W����.j�zV'@��"�M�du�w-x`>��ѩc �X�L|���IM=v�`��t��c[Cr����B^� ��S]��M�AE�uJ�K�� ����?�/E�(��܆�K�*���l3��k�Y��;�[�R��,�1q��M�BMg�p�1 .b9[j�XYM\i� �s�A�� �n�j"�����ז�ڞ�tH��Кj�� )i��זC ��hL��)���;U���R�� �M���E1Aʴ�Tіo�;��(�9ܕ�$�6��r�.y}�ɚ]�9F�r��o��)`�[��iǠI[7��@gv�� |���s3���U|�P�M����J���F�]��媛>�Z/Bg1u6��.K?��p�>�>��|� ��lcT�0�9|Q|)A���}�Ӡ�w�>�}�`"n-�E{w+��3��n��s�K{�o�JzUt(��� �h��D��g���i�"��Z%:R�5���$���s�A6�:0˗+)~|����-����I����h7x]vh�f�^Պ�Ӫ�q|�.�,�D"����07lpCN�A̋����Ò R������F1`T��x)"��%��=�e�hJq�~[8����L[�C���'ku*��I� ?7����p���.=sw�6��8�"]������A6���?i4 d b7���JQ���/�Su�V9 P�7�A�3�ۮ�k�Y-�ј�+<=���[�q�g�ـ�4�7 AUϮ����U���f�6�*��6��-�T��Y��U���&�}�hn-W��@ue�Oo͐���G�vH�n]��lZ�8k*Qsx���S@�g�f9y�����t��!R���h�O� 8��o&Ҭ>mu5\��[G�0 M�l�X<���3�g�q� �q�2^D��5ԋ���I�����ўfa�]k�{��#�U��U�5:�jI���g������O��K4�IlOh4�EڝD�&2�VZu;���3Z�>&} 6������� /ܵ�@�7��3yF)*�x�g��3gC�� b��U�_�!��yL�R�z����<[9�n��BQ�q��d��������1Ӕ�������v�-�� �������M���Y���!o4��
Static task
static1
Behavioral task
behavioral1
Sample
7d09f14e3053d887b4d7a44b1e90a7efd52b66d4aa8ca3f6a8a3c4b87f331ca3.exe
Resource
win7-20240708-en
General
-
Target
7d09f14e3053d887b4d7a44b1e90a7efd52b66d4aa8ca3f6a8a3c4b87f331ca3
-
Size
3.6MB
-
MD5
2e63f2a5cebd089139f32b434c91115c
-
SHA1
605916a5841886b87ead21b79128d9a78828095b
-
SHA256
7d09f14e3053d887b4d7a44b1e90a7efd52b66d4aa8ca3f6a8a3c4b87f331ca3
-
SHA512
d3a448690bd2ba62d7416eac23b8ae01738290ba40e1a4183534655e1d0d78792da26846ba5d4076851c71d883bb944b452f76896ae4918caa0d6831bd775e8f
-
SSDEEP
98304:500i4fMjTHCmLccBWBlfRQibRNiFSWk5rR+F:3icISoWBV/2kWgrR+F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 7d09f14e3053d887b4d7a44b1e90a7efd52b66d4aa8ca3f6a8a3c4b87f331ca3
Files
-
7d09f14e3053d887b4d7a44b1e90a7efd52b66d4aa8ca3f6a8a3c4b87f331ca3.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 355KB - Virtual size: 812KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 297KB - Virtual size: 12.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE