T ;)J�.8�$��tԗ]�$�/��B�v��z�u�笮ev6��T���Z-AQ�d|��,1��$��ܸ*f��A�t8Wt�ڑ����sK�l�fF�o2���Lqٮ�,R�'�D���C[�Ϯ��t#nHV�i�a��o���5_���������wG��vi�v�`̮�v���H�ޛ�`$sl�6���'t�����K�lL`o��&�S�Ӈ��`Xj[C��3��,'�} 7|g.�ǻ�� g.I�㓵L����z��{_]WNG\)����ʘLQ�Uh��w�{l��q����z��U���\��1�@Ł�8ɇv)���˂N$�d��H��oo��^��-����/����+��T�E\�.F�����(�Ɯ~�&� F��*���|�#�Y^�t�`p�Y������$E�ҧ��u����C��d����MK� I��,��o��E �ץ�������A}� �^�:T �/��]��+ \Yi���@���*�erbI$ �C�#왆e�&��^o9�QrlM-}��i�_d�o،�E5]��9Ѥ~�%7����6VO�Ȱ�e��}�(���i���u.�3����&�)�F���Ru<��K��v�a���P:�6>x{��1ug���BR��� *B!�>puYw�CS����ȵ��B� k9�&H�1 ¡k�1O��_���p&��7Z'�����z� ����INr>~@E�w������_��9��-d���o2�Q�� y8��0�jFu��! /���n0��:rD�:���j� �c��J���?^�ڬIK2E�WS��v4gU^d><��.$ ���/�`yq��� ?��f&)>��g��'�p� >m����R3*¬�L�a��[ɳ���������۶ P��9��i �')��纂�a�.<����Bķ�)���_V�o��|�*k9����RA-P=�A#�z@����Ybk�NY�8�\�S� )ʧ��K�P2�../��������X���uQىd��Q�j����\�2!<��B�2�s��nx\��mM5��3k��GY�W>*�b:�B6�������TT3d�X&�&'�����U�B��0��`N���x�h�����F[&�.&���277��G�ҏ0��'���(`�P*��p;d"[7u~��_�g�yGse �D�9��}=B]Z�����H�a��)$.5��UZ����O�(l����P�����(ulǢ���E��6@͘�� �<GIE-��^*����V$��Hǡ�u�M��Dz��2 ������=8 ���� b�[R��ЖL�:�]_n�I�r���T��;N7=äA�����?���I�\/�|BY���L�|�"����-Y� AFw�xG��_���+��_�p>�gI=��4�o�������8N�®�3�k3{�`��(t,��uY�DM>ѐgdۋʄ�E]� *[M��h&���6��U�1mŰ�q7�.��Փ�A���9�E�����̀0�u���I�Ȗ�ꖾۗ� ��~p�{�X�g��L���$���B�{֒�e-ۅ��p�|��� �XG� @�(�� �-�j�I6���H/��>�B<�75�T�J�{�Kq������)(�dC��Q����]�{�G_MQ�������u��L�p۫<��6��(�DC�� KH�:;�*�� i������16u� W'� ک�A_����K1���M���o��S�ZmoX&֘��/.T�e�q��I�q�w�G��c� ��hc��EH*7�b�<Ƥ�Ϣ��Y�:+П��~3�R^�dMiΖ0��9�$�7�/s�<��T�x Ԁ��\��O����>y�k�l��C����_5�awYl�Y�^��Dy�w����W T�CRn뿔<p�V/MLe"h�L8E>;����<�F$�a�0���Yʠ���^g��l�O�q �yY5�/�٢���V��^�x��9&�f#)1�LEJO�S�@���\�e�F��9��W�Ó������M ��+|P�x�.��Ƨ"p{�¼qQ'.����?0hֺ\����VW�V9�6��j�?�@ �E��x X�+�GG�#�5,n�F��8��z(P��� ?,�*�=�4�t��a�J��"�'�oR�V'�S#�t���w��=+߱������O)R�'1{�5 D�JN�4p5殓��XMFE���N�'K V $ ��T@�q 1�Q��66 Ou�ǚO^��A��,�e��8!�G��z�X ��k���sc5,�F��.�3�Jr���!��-�Jp���0��W�V �6� `�!br�]Gq�t�8��=�o|���5��~�g�6���?�.��6^����C<��Pa��?ZU����ǣ�`���&@ ��6��W'?�u$�sQC_Tv�bi�;Qp�sY��c�������>2���8��!�u�~�N�v$�;�>K;�$����Ɩ�F}.>HGo嚀�H#��>~�0��q�Uk���Ӡ[����K������ԃ^�{�R�b�J<4��\/O%����֍k�y�r�A݊��z���|nq�$��������v�4��t� S���:��!/�|>^������<�P� !?",'4{k������2K�ɚ-����9ߕ�EW�|2�rT/�.��eQ�a9s�x��o�������"RnC���9iG�;����l��:tV�I4�]��alx5qR�p^�AQ�tB��P��v|փ��W\�}]�_�n����������ҥ�E� 4�`[\�7 �"+�㦶��f��m��nP"�6�=�̜D�E�0�cŦ�C�?�ˆgĢ;���<�<\�6~0����D�?���|��^��#6���H��:2��Y� �o�� +���b���G�8}�����#���Al'=��C������<�XRA6&�l�#�>�䉞�/n����HG�I���c�1���X��u�Y���@oX�d����o�����N)�vJq�Jlx��]M�^R���:@�c�0�gd�XB���(3%�����h6�a~+�59p����ljO������qɟ�Ʒj�,a���BN��mH����'n���{�=����^�;���*i`ʦ�>����=��8���e�=���f�>���sA�؈���8�z���]������/�`�on��T�;�U�ؠ�~�7 �ќ�-b|��Z�:�C�V�A9omr]��&���[�;`�;k��4%W���4\�>yL6�q�(p ��$�k�ν�I��<����9��4"�;e������/m�V��ty,�s���5&������ji#��'�%D�s]�0Dɽ����f2NJ'�O�$'`��6l��=1���t�[�G�趠N +��ټo>M��(HѮ�hۤH�E8�=��A�\�e�}?@�-��}�5� ��j:K;��Q��n�i�h�r��hu�0`�^���~F���ٞA���BS��B��*)�t��ad���nx a�*. �2);�.�w/��lSI����j#JZ�c�4:;��$�|���o�t�x���;�� { ��ޮU�D���i�5,��h��$��Rc�E5��2�����Һ�=��
Static task
static1
Behavioral task
behavioral1
Sample
b80697d7ff9270e262d1c1a1d4afdeca818a3918e75297523839e239e561e3f0.exe
Resource
win10v2004-20240611-en
General
-
Target
b80697d7ff9270e262d1c1a1d4afdeca818a3918e75297523839e239e561e3f0
-
Size
2.4MB
-
MD5
0576ac8a3b5883b31970d0de15764c3c
-
SHA1
6c4ebf4258d189f5d326f71156cf3c7329c3f04e
-
SHA256
b80697d7ff9270e262d1c1a1d4afdeca818a3918e75297523839e239e561e3f0
-
SHA512
ebf7d130e5c2229824e071f928853077ed203ecc591f372aa7efe7e9b5bac080e00b1ecdf2401d95f6b706957d075e9c300d609a16bd799fa49abb758d06b983
-
SSDEEP
49152:dfmVRjReaPkLET+kMltyEDkVvV5FxG1EJ2tfZ0CBmBa/LCnDWb:df+cAT+kMl8ED0ybx0UXLWD+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource b80697d7ff9270e262d1c1a1d4afdeca818a3918e75297523839e239e561e3f0
Files
-
b80697d7ff9270e262d1c1a1d4afdeca818a3918e75297523839e239e561e3f0.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 41KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE