y#��&ͩ�U�K:P8��ljv��q���ݸ��p���e����M��$p0EQ6�s�+�� 01���%����(HH$_���KaHY6���<6<U��Tab�t鮘%2�;��.g=��n�:��'j�YT���Zڂ�=���=�,�&r�ɏ�hFi&�_D"�"�3������۴���O�0�@��:3����dj59��t\:�M�П�z}w�� xď$n��Ŋ�����p}��F&�L v/t��ي%�d~�A��L��+bdN�|��"���Nr�&/�@v�,R�� fbV��� �����m���]�JQ�����9��D`�Zk�$uL)��A\:���iJ��$jn�E��L��{1 ��j��٣�W��D����G�:�BRL��` ! S�ٜ�X�f WV�%&��F��C;�1z�� {�� ��~7��ț��G��ס����@]pa@��@����ʣ�'r�Ϛ+em�P9�c>p����4�Nѡ�! D���v��7S��N��AKA�?9�bQ3��g︌ Ϩg�R�h�qց���~�_Q�T��"�K�3�,�~9������0��^�"�����$Qpf,�NR1��8�~Ǝw/lT� {�-�r�~XQ�7��a��z"�[1��}�w�?�u���Q8vA�W��]��� �M��=A��'N*<�c�jT �HF�!f�.�x �2ʏQ�V[����)��2]VP*J����+�D �&�-�%��sJ�������� ���K��,�ڱE<����Ғ�Az�h��ʜ3lI �.Crk�V�S ���e6�*+� `F���G��5�L�d��Z��b�3�QT+��0P�=<��2K����"W��Z��VI<�HY���h��ȁ��<��=���?�%U�2T���c?98 ���6H�[� ��bͨ�w���[!�R��-���S���ݮn EB��կ/>���h*Zܷ�oy�wmt��҉{��/���ـ�l��OIy,�e���ԁ�塼�ZgA#��c�!�����ے5���2s4����y�g��}��;]�=i"�|�(ʕ1h�����E�z��~BVu:ؔ��$:�Lz�aB��3�R��� ����X�[$�0�S[�\A�K�h��b�Є� 3�t'�s�?� {�a��~8��: ���o?��B���8�]y�xy���O�l��j� �!C>���$t��8�A ��Sp����B�b�.�q+���V 21�P�U�2k���>�:ɞ�E�`��[�/���\(�����+�J��5�?����Y�XJ�0>I?�$e����>ܪD�����XE,�|F4���)@�(�p� k�t^��y��U�ѫ֮�"u %\�V0)���ӡ��oL�I�����މ��Zt\�Q���l�`KbP�f1��[���Ǡh6�{� j@���W��b l-��I>��c��C�Sl#z�����eV>����Vƥ뤗E�4�rC������j�jj��e)�qM]�8����t�i���_ � ��J���"���;d s��w�$9��Ѵ�@����O��M�X�'�lN⍻ �e��鶢����Ղ�j���K��'���%�P�pݲY���'M~�LӠ�w{V&�Mr����R>D�#|��C�-r���H �Ǫ�J��L����ǘS [��Q�j��q �A�ŌcF-m@�N,TY��"���s��������M��z�\��<��"3�٬�i�Q*�>>b �P�}�����,�s'�e_��K������jԊoӪ� rm�g%*L1�uwW���+��v�P��hV4ӪAM�ߟT�R�=V�Ǖ <C���r�D�"N�?۳mz��(c=�LI���/����@�S�HNumx��"�%�b6�*�~K���S1�<��S���һ�U �2a=���� /����79J>�z4��)�����aݿp Q�^S��/Q=�;�1y/�H��K�����J�|:贫Q�/��{�����66�#��b�i(�Wn���DW�\B�P?��-B__Z;�9�w;�<�Z,�TW����"(������� _��� [4}���6�8F$q[��3�¦�']�V@�^̿ $S�.9�eSk/�y�����:�[���}�k��9�[0�%�sK�Je����L������Y���Y:���4��}H-�3������(�H�+���m�Ns ��C�i�S�����@�Sڈ�'y'�N� >��Ȱ�('��7j��ݦ�iE(w�����s�\%����i+hݾ�hm�"l��`���oB���s ���T�Q�P�s-/:� �u�K�TQ�-�,O"�K�6� �ʅo��d,~d=�9���Evb����g�ڕ�]�L�䤪z�[��XO2�f�>i�%��4��4ꚽ [�O�:�|����r�:�� % ���#Ix�2��%�Bf�� �����1W�呲Q���d��Z�&�A��v��܍���-��Ǘ���&ۤ��r_VV�.wI�D�ӈT$��V��~ΡP+���[S�&��pc b��� ��+:����f��~�Ǟ���s����u_���/��^�J�Z�~�|x+�D[��X+�r�|1��3�y�ՠcu�n�i�����ߣ���@ր�!�N/j&���kQku��KZ���{�eR����I�C���a����\~�>v8x#h��� m���d")��6�Bԝ{qGo,� ߝ"8�ZxKR� �0�o,6 ��)�J���-��S�W�X�x����Q��ǰrND�A`j`X��ǣH(���c`B?���:�+Fy�� ̚Ĉ������zU˫��uq� S^�G��Pۼ�=��M$ P��5LC4�5�x�v�<m�ע��I�u�����2NϘ?��ޗ����QV�����O�k��b�|:CLy��-%xkjB�ُ�Z&���Fz����T�0KrM��- ��.D"�4�w>����HN��.1�◫yGZ���� Ovv?R�AZ��:��bӠa/Tx���9�dTh�s���N2� *�$���J���Z��"��Sw��T�46a�� �?���;1ڣ1���&�$ϼSUy��£��"R}���c�3�3 ����0�H��� S�D�'o ��k�zQ^J^�J�/lܯ� �p�{���y4���u���DU�bJ�!eɠ�&��4�W ��f�y�# ���q2F�<�0r�Ix5���a��#%�ML�1Hf�*U�����&�y�]^��)<T�����z��,�I��+t�<�(X�����k�4� 0��s��~�e�lH��=�����qx��7�pW����!>j��PU,�.�0 j�O�w��i �{��GZ�i�(����@Ռ�<b��<6�/��3Ø� ̌B P2P�����6�n������ƃ��D������㑫��)��c!��8��q�:��>/GC��s>Pe��|�n�!Qn��֬EoεT�q� )s�Ǧ �I�z���p���`z����@+����ռ���l�BN��j%h���A���T�)x>G ;RlXtO���I5Q CdzGm �n|)j�-MrEg�Yׂ�^e��|�G���Z�}%e������0��<W5��ם]�䨾F7�
Static task
static1
Behavioral task
behavioral1
Sample
54f23a532632a9cdedbb727e94e34eda312f1e84f7d1910210f7548d97902798.exe
Resource
win7-20240221-en
General
-
Target
54f23a532632a9cdedbb727e94e34eda312f1e84f7d1910210f7548d97902798
-
Size
2.4MB
-
MD5
97ddaf205149ee9833a9b79cbfa33e68
-
SHA1
1e7cf405e71f0585b6719b064ff48d00222a5e1a
-
SHA256
54f23a532632a9cdedbb727e94e34eda312f1e84f7d1910210f7548d97902798
-
SHA512
df02e7e0aa3b0ff4690b5a060e8a94fd7c0a2143627e4173ae975b49e9625bb1dd530b0de14efb64c6d53b2b2ba8c32eed0c82c3bed7227ab0f1443880101d2e
-
SSDEEP
49152:Xkoj+GCMyRFvj6NIOx4ahO6+azIJL9N8P8VIJT+481icMV317u:UxGNyEVw6+aE9gP64g2J
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 54f23a532632a9cdedbb727e94e34eda312f1e84f7d1910210f7548d97902798
Files
-
54f23a532632a9cdedbb727e94e34eda312f1e84f7d1910210f7548d97902798.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 41KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE