�hs�o���SF�q�`n:��?C6!�n&�o�䁜7W7\Tn��� ͻ��}S��'eԟZ�u�?��a�gl:�}V�u���w����^?�弬��R�i#�N�����j>P���ޣ_�4|���I�,h�M@?9�Nu{li��í9��Fg=s�e�-%��Cx���>� ��%��B!�-�'�Ce#�ֱ4�ti*��:C�w�`q�=���t}d0M�C�,����|��[9 ��^��hի���X��Ƥ��� P�v1ޑ�f����836L��Q�QH �ȹf���{Ů��B� ʩ�1~�/ �*&� �sʤ�!�ꩾ�7J�����r2GY"��P̲�6�o;QM�$�FፔDXu�:���M�t�����h�i��W��u8M�������^�IX�E�ub�Ki�Ԗ�U� Ծ�l�Ι�:#Z����+�o����ɑT >���*j �', ��ߝy �Hb��E�~T��L�ʔ^���g�Q���;�±��_ _�Q�;K�r��*`֤�=]��R_��Qj���ˈ���|:�hn�|x��/d`W�5��H��lɘ �-{?q�rW{p^<����j���^�����Y��k�7moU�k��f`� ��F�0�8ﵫ���+ɺ3��8&��1��F�| �X��T�p��}v�cR����o�Rt0Ҹ���*��"w�3�d�^g��R[�LLԁ�0k�`@���]a���S�m�r������M�;D��]�"Vˀ<9y8�����||Ӂ�QD=�]�=۶[�A�=}�8W�?��]6|�0V;IXc/��͊�ϧ`l�����l�AH'Eg`M+2�5��Gh�l��q] ��⯶�<>���v%"��I�.��[�$>���� æ���q��+Z�`T��$�j��\T��.E�L�47 ���7F!��zۻts�jJ�=O��W�6�B���|ﴹW�ʑ�Q� �+��h�+�����ֹ�z����J��N��rC��I� �@U_}?��-1_:j2Z��Lj��z����9��¼g#d���3�ىo�=��2^ }V��:C�B��L����!� �����ُ��1��/���v'�| �o�uĒ�s?�o�[�q��z;]�q0��1���_���91*Vn ���b��h2�P��fKGB��w�&������|�`ݒ��\��FyȏW��?>��<@�� <��X��?�F�� "�33kE�a���v�����h� � ��;���@hk��q�Y[P��}l��+C����i?q(�Ae�U���|!�D˕p��\�V�#� m���?�Jn��#?=��jZ U��D�D��k��� "�X�ɱT�{���t>�1�Э^���Qw���s}+�f�|9�E%`���"�<���)e��d:8�������W;S����Z��O詎���g���`��g 1x7*L�&Oiqm�_hX�:��c�Ξ�C�v��8mKȐ�|u\J�;{�Y��,�E1W�f÷%d�,&ԺNx�#`���E�F�ЄB�� ���ud�G����DU���S5�6Y���Rx}IT��I��_Hbnj��H�� }O�Q�p�Z;7�=t z ����o�q&! �*��im�j�Zn[~��z�w�I�<�K�A?��O�¢B���sA�Ng�7�ONz�Mi3h��u`�H~��#+f�f�X��`��:T33��&�|X-��ȬN��[`{�+�q0;e������#k x�o��%�]� ���N4}2�[�����/��p~ޙX���oU#�pM���{ *�i�F8�<z�0`��� ��|>��R T�$MBh0z�͖�\� � �8yN ���])Ͽ$��"*9�u~��Aco�U�X��j��$R46�*`w1��{�?͔ �� <�6�R9�[2�Ƿb]��%�y�^��PUˈ���N;�måj�#����4X�z[ٮN-�ޣ��F�>t��S�7X���lQ7{Q�)l,;9$��J�*�R&_%��t�Z"��4ϔ��"S@/|=~�.���S �`�{����j�B=bvI����m卷m-�����t���d{O�o%�L/�ǒ��q߲��`�A�ep�=��{�&��_�T�i�->��2=�M |�N[���v�>v�GD�]�� 3�eǐ��A�r��sz�~��R'S�� 5ا���� �`��y��,�.��(��W#�s��,���Y˾�����7=㪈Ƙ;)����G�Kĝn��O�w%��h��m/���8`�q�Դվx��w��҇�ӫ��P{|+��� ���psA�O2R�YfMc]��0�_���@��p�����ЯK��� =��i I�c85��,eOm�I�L*6��]`�_W���X/��Z�\�,Gh,�^8��'a��Ź���Q�1�g'l����;0#�H���;)��%́�l |�Խ#�����N\��� ��0�بg�S��'zp�~T��i�V$t�O���`��4�f�XH���hps�n� C�P��QJ?�[5ߍ c��6a��QOƞ�cv���3j�^Z�VZ;�̰w���8a,"I�'e���a&���e(��D�.p!���P�%��l��]���|=]���LW�|[�)�u��o�k�W+6��W��ňݡ9�dR�s��PZW!�Z2��|�ހ)�@�8��#l]^�6%A��qE�7�7M�s0b?��hL3*���|���W�)����2�Z��.�42�+�,Y������i�M[(�4��(�*l��ŝ7��]�������d�|#�{?�^h�U9����9 j�>�A��Xˌh�'P�� V;�4�܅[mҞ^��Z��>[䤬�D�]�y1�,���(r| �7�C�Jv�ޤ ��'P��<h,�*��(1�ſ*k�-~��m�����|ؒ�9�f'��e �d�3x.,c������##;���h� h#"�u�#�������hɈ? � CR�<�܇�F�eF���3�t����g^t���r�eG��f�<���/��$ןi�!m���`��Ԉܛe�� �AX�yײ{d{�,��!Ӿ�^"p�|��n0/o-G�F�!��S���;�p� ���*�iGW�pb�m��4`�oU�\E|���ԋn��ݗS����-���nȸg�(y��kF9��Y��ΰHrC���s,{�Ӏ�� %oї_,D�k�nf)�U�V�(��/jK=�����䚸?a�}����j����:%�)<�"d�������c�M����wZ4��c# �/���qF����e�V�����1�%���1�g�r�j13QL�,�A'���y�=YJJ ҨoI+��A?4����ڱ��ɧyj�A&�����(}�����I������5�����g�T������~��h�5H �a�={|Ve�pȹ����<V����ܫ�yC�W2�/o�'TS��9��s�mJ�*�϶A?tM�EOu ѵ���c4���HL�CJ0� �E�0Q풶r����~��
Static task
static1
Behavioral task
behavioral1
Sample
004c36d5a75d96cd6d275a135222353869f30bf7e12e8f6f7f93e3f6ed572493.exe
Resource
win7-20240611-en
General
-
Target
004c36d5a75d96cd6d275a135222353869f30bf7e12e8f6f7f93e3f6ed572493
-
Size
2.4MB
-
MD5
e5fc8a0a4d3171c1dcb1c8cc4eab7b38
-
SHA1
7517cd99e041c892e15ace4f8a5e22819aa4366f
-
SHA256
004c36d5a75d96cd6d275a135222353869f30bf7e12e8f6f7f93e3f6ed572493
-
SHA512
8c21377737312afdafc5b82fcf06461f11cc9e0cc624f2a66ecc63969766569c266ba15236f9aa2056e2d3fc603718b474cd033f46e0d3a8e45825092404c71c
-
SSDEEP
49152:zNIDcHJENoqa5dYYVoWPXofHLQNXDtTvvXv3F0Y9bBDgvlIi9n7:WDcpENoqa5dRV9gLQNXDVXXvuYr0Sil
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 004c36d5a75d96cd6d275a135222353869f30bf7e12e8f6f7f93e3f6ed572493
Files
-
004c36d5a75d96cd6d275a135222353869f30bf7e12e8f6f7f93e3f6ed572493.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 41KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE