��$�,���܉J_����qL��Ð�ȾT�z��*5[ �M@�É|I�*ɻr��P�fSՒZ�f��D��y�~c�G7��Խ��fC(����+���PQ+�m�}1�t�?�-��+V���Hg>�~�f�`�� R���:��X�� ��ڰ�D�ƍT캺�ByY��:���t�����Aw},[iO�'���c7'�� �=�s�`hѴ9�9�d��Cr:�<nC�c@�D˔z����z30��3Gd��D���-G���k��hd���:pHL*P�L���C�ڜ^�n�߶V\! ��c��p=Jt��~t%}|P/xx�����0Q�(e�53�p�n��?l���2e� ��|p*G��d����W!@��0Q�z|��ŒplJ���YT��l��6+�^��(�W�$S�ʿ��R�� ҆��QqU�S�t��������2�7���w����`a���)� +.�.j�W�g��N�lf=�@�2�¤��JJu�E�b*��-T O%�bY��R�g�،�xfo�%,��7�R���=�*�0y�&�}�X�KB�z�7Djz����"i^R\�I�φ��eUL�����ĸ�� �D\�2L߁�{r�g�m��E:6Yz���I���\h���!����$��N\�+�H�r�+.�+T2�̟��ȪR!�DV�괜-a�����9�����!�����u���,'>o �j��!��b g�@<2ؿP/,��8��@����b#K����*K������,��Ɨ��,���V�.0!�+�r��Nu�·&�n8���\��iW�V���ҁ.ly�j�d���_�A�y���� ��y|=��ӟǧDVM ���A���W�>�� V��#�ng��C3���מ<9���x�/M�cT2�$Z�X�fh��kY��M� A�_�&V�Ggw�!Ho�7�\`��+H��/*�j�@<�ͻ�+��@�ovuz�� N�����#d6/��qH�VX����)�I�Y�@��Z�u��H��h��TD|o�Pt�Ity� ��r�.8=�w�ND+��a2��5���k��|�ϲc�kĺH�:��8�'�k���%D�T�+������<N�����=��G&O�o��S���q؏ ����(2݀�v���]�J�����/�(C0v���AIA��� pi��KDlƆl��f!R��5>9�������J�����\��>����;6x��n�.� ��Ǻ��(���P�j��^f�5�C���}3o�K"�zJP�t������^6붎v�������`�-P1~�� ����!)�� G��_`�>.[TX���'��Z4�NP���v:�[��T�N2϶룲��:���~ Q���L���h��4�0�ߪ�8%[������J��ݣ�=[���� ��01cb�oa��ʿ��!�T�$+2�j;�n�Ic {L��nC�� n��ȫ�/�����+S$d�}Z���l(����5?yu���Ԯ�1��UX~�H/{Lj��N+�ifS"��j]�[ӯ!�AI���1}��Az)�?��RdǮv%�g�Ub�7���f9������2R6h��A�W�� P��5rh��Z i����!����Giq��L� &��(S�e�#�������A�;XÎ@�NɾU|���ш�V���������}s���&��l#�0e5�/���kܜV0d�?�s��,KY�z�n��NF7 D�qg���R�pˎ3sS~ԧK���[��/��tf���%{*�^��A�K�9���_�P�K����_D���n k��TD���� �m�'�S0�� G��D1�R�����A~qeT&'�n�s��h������鴉,$5s�n���zp�����]���U������!Y��X��c�[�b.� � �z��o��h�87���"@��g�c7����F��罔X���y�����D�d��5�E� ���@���[O���~umf8��Z%�]�pgѸ2a���]�t����F�y�^7o���ص*ӳ����qW��I�K��@. C2��qLވ�˜(�2u�O��D�k]Bul��=1Q���\��k�� +�`��Ȓo�����~;�mDЂ�*���pVl��=9�4�Q�a)��dÿ��Ay�����?�*;.7����ɐj��vA��e�j������� ^��"�J ���`�"��*0��b�N�:�2lCpG�HG��^r��z��_�e�S��f�*�Z�G��q��|V�R'�5I�0��O� �GG��;v`?eG�,�[0" KE��mP<���$D��wg�@!��W9^ժh�,���������[���t��,֨&3ϥC~rE�Jp7�����d݉ʭ�'V g����*`G�6),�}TyTn���F���vw����?�,���Vl� �����N�^w�3ㅮ��F��)%���F�����*qׅ��}҆I*�;T�Z�KC_ԍ��J �|w�� '1%2�� �d��b�����KZ|�4�d,��V��v�'-�כ{�V�Wn@`4rh�2�a�}�+��]cFꄒ��h'9���H�ٖ- r��g�;?9�����o�r_��g�^N��<5<�Em;.Ŵ�D(:�����PuQ@;n �?�O�w���w�C@��3�-vQ�2O��i^�1U,�n*���zA�jn4�:�M�����LG�e�cQ��� �N[����,��~���J�b$D�$<����9���>�{\'%T�9���Y<�e����\�c`���tU [�0%�5�f:��ڏ=��{�xƄE3}�Aa`ᕂ�#WK�P+�������i�)$����+�YE(�w8Q�;F���`���J4��'�=�� �P�*!h�5U/a��tFc����ւi��N��^_V����\��=��r ϰ��1o݉��W�I�8�0��O���#�7l0!4��ײ�1�����٤ׁ���:0� �'���T��I_�Ul��YE�%D&�K�X���7�B�>4l�i#��۰ʼP�˫j�����J�Ϡ���%}e��s���������7��jQ� �P�*��G8�<��)�8@�I�����U�9��'��b {h%_%dP ��9��=�T<�����i����y�V��\Ұ(�Z�'�dJT�2��������I� �;�BsGE���������y�w��C-��Q��/�Wq�!ɝE3/���rIo-� ����3�:���3ϝ������)M�'�-j��j���u�<������y'�'ɷ� h������VuG�^��zН�˱��y���^b���V+�9}��(�"%G�Ρ���'�5P�%��T�����8�˚:��Q12��� �r���bѯ�6�E T�� �?��&���s�����Q�R �9
Static task
static1
Behavioral task
behavioral1
Sample
9638254d0022fee60986b585e741933624385736266baf69c122d69f56dfa385.exe
Resource
win7-20230220-en
General
-
Target
9638254d0022fee60986b585e741933624385736266baf69c122d69f56dfa385
-
Size
4.9MB
-
MD5
28f1d736313ebde3bca865a141bbdf75
-
SHA1
9df741003cda5365f069f9bb94b52eee984bc51d
-
SHA256
9638254d0022fee60986b585e741933624385736266baf69c122d69f56dfa385
-
SHA512
d26abe997bccd016868b8857fa7eeadcbf01a5a8c7cf2947fc01ccf7880631686a6c9345bda3a7e4c91129cb766034041500e54f26e5e2811f2cefe6cb882adf
-
SSDEEP
98304:QPwDd5Dg/fGSY2c7enZ9kY01yUlSFUG5Kmkya9rxyd+EGKm5:QPwR5U/fp7c8kb1ZSyGwmta9rxWcKm5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9638254d0022fee60986b585e741933624385736266baf69c122d69f56dfa385
Files
-
9638254d0022fee60986b585e741933624385736266baf69c122d69f56dfa385.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 549KB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 77KB - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 67KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 173KB - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 182KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 13.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE