g mD>��TprzB�>��W�B��s �.��<b:����"�P���5����|Q�*2ٮ��7m���K�{%}�6%U��m�[�W�U,�5[ �0����/y%�[D��]Ygz�K�I����_0�ZN����]V�;1=�?��ў����7-��v�uʯ��e��E$+6|O�r���W�B��/p#y�Ǔ��ޗ AI�ÈT߷��#�<���/��Bt;����� ��qn��j P\�)�z}� 7�}�= �ܺ��?{���N;ՒSG2��b#��}��q1К!��}��`�,��� �%�����"u��#�����w�ӆbҖe�:cm��n5u�����Zv�{���1e��`�[���NN���j�=�-4��C$'���6yBz�n�[����ų@r_��#q��$y��bx?��Md$w�����q���ݨ*�K:bӻ(����6�������D�p��3턚�������˓!~���}�&���$��W�Xk��Ǣr�$�#�S{7��4�x�@������Ɋ��<���@�� Z�g��SU�EN�K4�z;�e�DN���0���y��n�=����� �������j�I�y� ���vKf~��:߬Eˁ�w��� �>pɠ���-V��ء���sK� IJp��tj����j������i��D�mr�����Ofe�t$2�h�X�Gn�]2)&��I�.y������VN�4!��%�O�z���8,pڿ�F��t��a!�ލ���!J� �SJ�c���G'�����ʷ�x9ص��2���� =����0ᆋ�s�����Yl����a��:�&����ip����!���+Ȕ.*z��"�;�P ����]V�~��<��d,P�AS���Pܼm2�/×�ژ��@|�����w���ؙ:�d��p���L�Z)�9��+83��)K�ݍ��n�d��uB�'�Y�Mڂ0y���D�B����`�>]�_����Ѧ� *c�����Xf55`�aD030�,���k�����V���A>�\��?���,⥃k^�=�Iu�%j��=t}��%��W�_�0�]O���)��*�XE-=�����B �*�%�&����m�.B�-v��K2�ܭo<��{\�m����.��ώ6*YSZ��[�]s�+�6)q �U��ٽ7�t>`(�>zlZ?�qR�b�v�c_L$w��i����!�7H�G|Ms%j�h`CB��i����Jpi����Ī����&�C��}�|�ӀvHCxRU��2n����y��Լ9�5C\)��mS�����p��H�A�`��G���R��ޚ?�����;*��#�'�0?�l��PxD�5�m��Un�7Nݤ�I�Ԗ �H�`d|Ktt�ڹ���������`%/����J��_��Eo��,-� |���2!2^C����,ZM5��i��Tgl �p���f����V��J�E?�E�v����l�J6�}�46}�+��y�u����a8�qU_EI7��&����k��0��z�ԫR+�� <�r.P�N�!7E.ʽ�x�ؘ�.�䙨X���������3L7�±W B�<���Wn6�����(�Y:�Bt��=�����:�>�xt��.�c|�.o�'Z� _)�[0�;�$�r�~~�����B"�1�7Kr������A|?>.�ܲ!��Z���͚���3n�("Z�'����1%�&Y��k�.aM"�"`#y�����&�~��A��4%?e�>6��u�I�y�̳�p��.5���Y�* �)\ G�8 T��2.Z�b�ͫB�of��-g���P�%`�ZIp�ŪD�[�>_/�$���I �����?`L�u��I���F�b5�2|VG�"���7� !��6�i��'��q����n�.��q|� �����i� h�x:#����E��VP�p� r���-��?=�^M��ϱ�FcJ��yL����fZ=��ޗ]�@��6y�I��oʆ�V��$ިw�UG�y�� ᘶ�4���jI'coe�'��B=x_6-҆�_g1���i�1F#O���яv�b[H��D�6�������ǰ6��0�v��Z��r ��x�1�����z*�ڟ�i�w���bb1=��� �&Z?c����ܨ�B�욾}" ��%c"�Q!IJ^/]���ױ�g��4f�Z�L|�4�8;ত�s����W+\�i����� �y�<����o~�ȇ$9j@��?�Z���h����9�����Y�ܖ B��$A&�rpKcu�!�NT���C�/�>�Ԙ��kSc5d����<K�1l��+%�zk�/�\�&��"�jz�Yi^����ePJ�ي��������y�m� #�ڭx���,�z[�C+t_�W�z�'?��#2�}]E���B��ߋp�:Ǎ��٢��a�Y�4�50�5bԀ���Be�A���镼��K���í���T�7��"u���|&���T�X��Kcs`�xk(�+3�pI_��،-�>s��A�Ʌb'�d�f �!3�j �h�E0���lKP���Y�a,�p���;�K���-u�@D0�勄�k�Ɋ�8�.�CA��l���pM4�b�6I��{�1����o�D*��ơ��Jy�1��ʲ�G;:8l7���N����ܣ]�Y�&����bkZ���&����L�ǧ6�Eo3 ]�綿?�â�|��b�6�k���IaS��%Wn�+ӂ��#b��E���� � }l�«�.��CSZPK"� 0�C&7���7:��E��A�"$Z�0s@c� aS�F�������[��0�wNUox�!�@��|��� $���,���Kt�8�k�5}�bTMܷ�2?|�`���p���3&��d~uw=-�K� ]A�I����xj����EM�~K�|@��_����s�F���u�n����eE��%�rS�pZv*F���R.�4����j{j?t"�*�S��QF�+��ڡ��GU�uF���z ���N�TK"nL���<��1��0C�9�.E'�B�X`��$v�� <�)�, ���q�[^LR��Zg~7��1�\V���p��〝��h1�BHi�~�B��H����`e�H?��B�al����<���< ��h�R�s����ܚ��S���S��rd�a��[�,�z�] ���
Static task
static1
Behavioral task
behavioral1
Sample
41f5338ab7665fd97eee000f1e121c7638913b5f0686e43121cc2c28e6b0ade3.exe
Resource
win7-20241010-en
General
-
Target
41f5338ab7665fd97eee000f1e121c7638913b5f0686e43121cc2c28e6b0ade3.exe
-
Size
9.4MB
-
MD5
e0b8b9c15f6c0b1388373e3e91942d8d
-
SHA1
7bcacdbee55c3eea556d2aa79f04377344a54e47
-
SHA256
41f5338ab7665fd97eee000f1e121c7638913b5f0686e43121cc2c28e6b0ade3
-
SHA512
f1bd73c5f225243ac914054e6ac5ea01c3e9fbe1589ce1d93084c40e0e11c0e35f93c46dec8d270ac44520bac19fd008bd752446427433549bb604c163614e08
-
SSDEEP
98304:udv7AIFM+IJkXHJKZno3XzJ9ktJUs71Saxfz7w3YV:gEIFM+IGXHo+TJ9EBz7w3YV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 41f5338ab7665fd97eee000f1e121c7638913b5f0686e43121cc2c28e6b0ade3.exe
Files
-
41f5338ab7665fd97eee000f1e121c7638913b5f0686e43121cc2c28e6b0ade3.exe.exe windows:4 windows x64 arch:x64
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 59KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 297KB - Virtual size: 12.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE