���:B�r1t�͜WL��*��C |nөN}�g��A����-N��\BѤY�j����u��r�l<^V�y�x&+@�u4���U����GY����.KX�ѓ��;l �-���;y�J�<�3����FK�ϕ�:� v����4�!�����Ԅd�<pR���O��mf�Aؙ��Rd��`������Wr�98���3���Z�k �a܀��/v1 T=>-o �B�Nؓ�p�K��C>xhҀ�g������fdX�ҵ4�W��ت�ꣂ��;��w։�R��~�KM����BT#�A-u�y� Hl�Ub�IM97�_32z�.#�6B�Z�������S�ӗпD����N��g$B�����{S(Q�p�7��F�;��1���s-��N����s�'�Jf+x$B��}�O�9B��\_��~���]��H��⚭n�1*G�fςn�˷8�~��B_��q{c���Ycߜا���<ֆ��Vh�i�i*���[�X6��->ɒ<��_ȊvVQ�j�j��q!�x3������G����E/�3 ��T���(��M3�_<��di9����O�2���ޗ,��|h8.ĭ-h�A|n����֜�����mfT�Qa ީ����N��ŕ���z�����ߍXb�#��vS��[1���a뒋μ>+n�_n�@UTR��Vm���gڠ�^�l�Jf�g9R�-����W^1G� _~�Yn#,��D�M+S�=��ח��O�aȅ'AR>�~�����!�3`���d��Rj�W㒮����Fj 6)���F$ J {���e�:K|�6��oD�iw�|��>&����A�o 8̈0�|����'a2�B��@��6��ֳr�h�{�Rk�0qy+i��ޤkd����n�Y���]M������Y�2,4L�E4K�ۤ��E�5��5��ĩS%���70{oo�5^�B:;���&;5p5lxT��b��ᰢgb"�]��]4Q(���9¾a�c���� :H-M�2˜Q�h���r �`�W �PDJ~J/<2�_����<�~P�Jc�kXDkB»Xh�z�B>h`���� GUti��h�����A�����4�(�F���L>�����1M���~��J���N�� ;� a�mOZ�şJJ�d"�]O6��L��Ϫ����g���{�q2�SZ��b?(kA�_����x�2�K04= H�6�-���K�S�������ƛ]�yky��rBZ)�P�G����w��ō}�� ���6qxq(ȋ;)ژ��8��I�laơT�w2.;�m�q;�߅����8}����i��ux�x�e�v���_�����9mh��]+�q<&��t"�����*�^��h���<W���3�G7��ӵI�nu�,��\Q�B�czD��i���.��=s�\���K�$'I�2m�׀U Y cm�8dE�ѭ�'��/���� :lT��� �2�d�)Œ�:�9��ƌ�1�*�{�-u���~T��.v���U����+�Q ܤ�\ ;�]ɹ�w�6HT1D�������Z9b���CM��[�u�2�,'y�E���I>�MCn��c��R��z�Q1�_�v�o��(�wa� ����l4 Y�& �B�ޥkZ�x�@�v�?��31 �S�������I��8<���:��U�� ����fOhVf�p�� k���g8��2���`ݕ>�a*�;����v��kh9J6��q ��oV�p10� `Z�����?����� ޝ<�B5f�����Ƕ$���R+�ŅtE�� �:�� t5���r��? a;������G��·pr���:y�/�7ׁ*�H��-�7C������E���Uc�$��-��e(>#Xhs�OH7))Z �Նt�Ml0ٽ+L����94�����Lء�M;���u���JU���T74�-9P��Y�h?rE�%���䱢������g�^p�?��P�RӘ�����U���>� �E-S��/�?�+�� �Dhc��&i�^ ��z��Ԙz-_clV����UR˶*A��} ��2�^�����%`�2!�7�I�6C��p�uK�ƩnV�N��n���YX���<���H��@�*_�i��N� /��� ����z*q��Ir+V��S�t�t1��t#�y����6A��[�R�o-�l���9��@#� �(d�����#[+�Yi}�e(�o4{*#^8����pb���@���&h͇�7,��R��3ۻ������k����[�C?E�N!|rr�I�)Z7ƕ��~�8m���S�DV��4��l�n6e6X�ssEu��M5vvۘ�5D��j�1�c������j��f/4��CN�+� as��y�&��qt���� =:N�;�^���*3� �8Cщ���=�$#f�� Mޫ��8n��T~�-��o�N�i�̌�?�� 0��C����e㹇gZ����K��z=����t� ��;�h����a��~B6�����-Ou��i��JBFS�+�mJ����K�t��}T8/�l-@5������i� R��l륙�x�o��q�!�-O4@��8�Nf� C9��yq�eKH���x��=��g��+|�TPC��v��A�<�����(���m ՛���3I�7��c�� ��`���I�V���t"U �|�wY��wg*���iA��U~��B�^cl_�������iҬ$k9"��6-4���(��tƃ�\B蟭 ��LD��vȍ�pOZl��J�ui��G��:�����d��c,^gWƃP��꼸8E%� 4� 2�0:۹hŢ��b&��t��#�E�VrI-��5� ��Gc�(B���}LN}�3���Rw��y��0|�F�����9����5'v�/߭P�^*5m��~j�KJ�Ƚ(ӕ��Y5.rI��w�T����6��o�(�cz�E'wԐm|to}Z��.eD:�F8)oFpi�%PNP�n���� W�{��7j_Е���d���6N?�Vx�����$���xՉ~>]���z&Y�S].s?�3�c�(�%��Z�Q�� _��t-;�����������N�C14�EIM�0�A#��[Zd��q�#=���o7=�k�A�DI�ȇ�}����h��1�rD����㝭�,���3T���H�V����g�!xvo���(��֏4�����R5�A�q�j�}@MC�h�������:���{=|��������O�@kM�b���4���n�� b݃��yJBz� /[�f�=c�G �(���S(�'�Ε/k�� � H��*j7.�)���;je��i�P�Zq���zj*, ��97% Ȍ�SJ�6 �A�@�dl.`�Ms�����U���T�E��d�QRCL{~{I����<�شm���Kh�2���������p�u ��� xM��|o`��4r:���2k�B� �^���-��z��s��!�m��3����9�6�<��ӗ����H�"��f��G�Io��E��T�eڊ�� ���0�4���yc^Q&�D�Y"�V0=���?��@)dG���I܄y��
Static task
static1
Behavioral task
behavioral1
Sample
ff5c8360c9f87054525970c5aeb707cc177291904206b5c18b09e0e6e2ce7420.exe
Resource
win10v2004-20240611-en
General
-
Target
ff5c8360c9f87054525970c5aeb707cc177291904206b5c18b09e0e6e2ce7420
-
Size
2.4MB
-
MD5
43a78a6987bf599db55f41bd3cd1d011
-
SHA1
b55a8d60de946c9151de60df2225dce89c95be43
-
SHA256
ff5c8360c9f87054525970c5aeb707cc177291904206b5c18b09e0e6e2ce7420
-
SHA512
808312620b6c2517876aa4f744a53be817fa9b0b5cdcb681943da060652957519c20e9f533f602dc6cdc8a0068a01e526cff797156f67b0f350f38c7b55bbbf4
-
SSDEEP
49152:Temt0UCcKZDPedhvpY6aUOisJzakKlfpazVxg4F2OhRoZqiwIG:NucKVERevisqlfMv1QO/oZJq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource ff5c8360c9f87054525970c5aeb707cc177291904206b5c18b09e0e6e2ce7420
Files
-
ff5c8360c9f87054525970c5aeb707cc177291904206b5c18b09e0e6e2ce7420.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 41KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE