8N#��܍ߺ���9��w�僩d"�Z��tD݈���\B��� \����q�,���@�?G_`�9)W���!@a,��G�+��&����p-�ն�S�o��ڕ*��z��;\9�X9Ʈ��Ұ�wR���"�8�-����kWh�[��O�,(U��0y_ �:E �"�(߉\e������O��D�Nk�v�Ņ|z���@)�i�3{�K0��0�S��cw��8�d NU>�����9��M��'���&�Q����`-��t2z�24p���xZ����y�G���Év���� �P����sz�M��ߪ�c�jMb��u_|ڛej�S�e���1��I���+�.���e�Y+ۄ\!g�a�1���H���6ĕ�S!q]�j��VI�-���ىɲ��d�I;|覈Xc�s�Pw#���|Z����9>����3�{5o8�+9҇��[U����I���C��*�V>/$����UD�F,�gy^}"� �l� �c��H�������g pZ�ћ��oe�n�z���݁���s;�����k��VD�y���sCB��zi���^�05=��S ؟��?�� n�B��P�x?R<p�m�@U3����=#gw I���;��\���K� Uf�[;nK"��KU�mc�I�&,|��-{.�E�pp/n���ǐ�� $���Q�d�]lk�=� �2�l�%D3 .<���>��г����o����G��40�Jo9<���S��ڪ�X� �����D�_ΰ���&�^UE�����3ӳf�6����L��DWoe�Ւ;�*�:��������3�E1P�2l��+� �۪���u-T��*���$��LZs���g~cI�:��;�����͆s��s#vU-�k��r����ڌ�� _Y�Θ�zJ�Έ>Q����d�-�<'V���� S���~�;��$��ƞ��E�����Ӣ�T��� ҿ��H��Wh {�N.=JY�;�]�x4="R���"�ӾJ�?��g-����=��%-y9Wn̦Q^�Ń��%�.1 ��¤�ʯ�M�]�V:ڷA?�� �T��M`�� Z��-3;�m�2,y�a� L�ô.pՍ7z6���ĖMů��?��F6������ d������X���D,�p��;҆odƈ��<C�����D����J����䮾R�pܮ�^A K&v�sK3e)�aH��V��qw��EL$ɓ�sx��̠ �[�{Z�d�(3JU=�-�Y��~�q̽މ���4�RG��=5�S��M*�=J���?���,t�Jf�]3-ܣ�>�m6�0�-o5$�8�4L�pS��q @��x������jOb�x��پp^X������O���¾��A��6���{:�m��1ٙ��&K�����ׅ@�I�\0�m��a[��ܷ\(�Y��C��{R6��%;��"����~e��ڮ����w1�j�C�_n�Z݃�u�7�˖-��C{��mf*��9AV ��3Ï˲/"s�8��x&!��V���FAT�-S�%��ǯW@HWh~�x���3Rn��ڶ�N��E�>���7�C���Mi�#�����q☭�mB�ȪT=ձ�@��m��IQҪ����د"T G$6��n����̆s�a-�C`�v�9��2�~���J�6��g�`�rﳆ�3�X���é��vn%.n ��i�d���*��:v_]�i?=n���d"���DJ܂��WA��9�� h�9�g8ןoz �tҖGv�p���� 7i�I��r���� |X5�l��P���\��,��� �(��#�wl�(�������B}�p��$h��-�D��b{껩�ۯ�~SjoI`Y���~�e�7S�+�8�RD���!���K$ �Н�U$--�b�����}�����"C}�5�0TfgfXP�U$����_�ጵ�������,���t�~����FMa��2���ˆ���?*Wb�ɹ�2d��G4�l��.1ncCH%��M�gpNI�����S/�O��p�-���?L�rg ��'��[dlE��3k����q���$�$�C[㼻{��P_��Ӎ��k#9��M��~����d� ��Vi���bkdU�"7��݄dY�: g���@�� ��Ji � ���%�,��No�>�7y��ߟ����ѡKsO P�Z( o�#bc��2W�[��Vt��y�}�r*.�����^(��6kǑa�YݏT���s�2 WΙd�jG.3���}z�R�A|3��}��ܳ؏x$kCR�y9��($������_��[6�f��q�e��1���M�qdzp{�u�v)T����i6�e��ͣ��G�[J�� %iiHO Y:�֥��OƄ��'Ha�G�6�w)!5 �& xi�3��S#i�T���uA�|�Z˜;�:���k�h|���?���2�V����]��N9L�N�=����%˘�|��ϕ�Ê|�d�ѡv��A{��w�姻�2�\�yq����gӲ^g����"�1Ee�c��PnR]�h��Z&s2�]���o Qf��@bL%�=��D"�a�ru���|���=�4{����ص��8�q�+���Μ�^�s�&��;�J-���[����:��j���\��1�����0�L����r�`�?)\ CL�K�����v���'��>f�UT,�� ��w������]��ﯛ|�Ɲ \9&�GiMN�h�]g�S#��A�|��#� ��!�l�i����2�X��ypʜ�.i��� Xʐ��N"Q�(�@��@< ��O�h7�:�2pr'��fC�3ȅ.*��S���� FPh �SS�b@`�&ep�}�N!���5���� *��AH��Ty:" �+$�#���o�}N�Q�UR�����n okL�zl$�剕tXcO�S`��+�M<�N���{r�̈ľcrf�u�pmVU���o.�84����>��w���,�8f��1h��d$5��|�I"�s������� �_�R��1���N����x1��ӍՌ����',.��fm�T ��d�|��k#�*k5+�WL͚T��J�&R������#��K��j�K^��R:�d���'�y}������� /+�3���.93)v\�:��V(ը�����a�3/���[!�)(���8D$a� c���ӻA�k��}����5T���6��sNjҋ��"�H����X��!�V�W�;����y���L�MJOL�u����c��i c� ��^6#�`ّ$���>��<iG� ����.~P�yO}q�N��u����C��Y������u.�8l�$���:١�e�(�H}���BB�o�=�������FN��k�-�+�Ȏƻ!���K�dK8�����i.�q���$�Py'hS*&��g���v_*�����SZeI���RL9�{� Ӝgb�/�qTԖD���٠7������w�M���2��D��l�M�@���wKȧ����y�6��ްY�d��[`џ ���V�,�c�.5�/�,�Vԁ �p�@n�<��� z�Ҧ�,t�xm���K9I�+�'��ģ�/3K%�V��sr�+Q쳠��Y~� : |��[���Zm���&ۡ��G�n�t o�����.r��2S�
Static task
static1
Behavioral task
behavioral1
Sample
b913c38a5576306a5c2fe644b0ec7e56d3b20fd2b7beef0a6f16e9bd7d14a12b.exe
Resource
win10v2004-20240611-en
General
-
Target
b913c38a5576306a5c2fe644b0ec7e56d3b20fd2b7beef0a6f16e9bd7d14a12b
-
Size
2.4MB
-
MD5
745cf21edd5863358874e5378e2d4289
-
SHA1
48d7e75a8754d3fca69f594ca3d1169642402128
-
SHA256
b913c38a5576306a5c2fe644b0ec7e56d3b20fd2b7beef0a6f16e9bd7d14a12b
-
SHA512
c32df119e3068a31faad129610f6043bf37c42591430f3eb4a217d35d6e7d2a9bcb2acf41a21df690acd925e59de78e373f04dd2c5d1eb4c2c6702d522ad23df
-
SSDEEP
49152:uOYaSf0ogyG0a8TGjEgAT+r+WtHLoVkx+02aBeDYe9kuX:uOYaSsoRGBjiTGtHLMwepkuX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource b913c38a5576306a5c2fe644b0ec7e56d3b20fd2b7beef0a6f16e9bd7d14a12b
Files
-
b913c38a5576306a5c2fe644b0ec7e56d3b20fd2b7beef0a6f16e9bd7d14a12b.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 41KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE