�+G&��n_�\YGD4��'�;�ܳB,@�4����/��$��J�ߤ��Gg`_*CR����ޜ?��tJ���I�s�b�nB��z˚v,EV�4*�ut����z�?5�I���h��Eg�]CdnX����[B��WQ�'�B��1,+��-}D�od�=����1��E�x�+���S�8 ���J�+��Xx�T�Rp�ꙫ��)��%�Ӆb��KW�#3BE�6`A��d*�c(buN��_<�R5��sɌ���%�H�[M �~�B��2H.;��C��&���7�*�dK��7�h,�Ր%J�rF�CC��:G9�V�6���5��}`�f���� �����C������,����E�����_*� 0��c'Qa+C�y��'��S%����t0���\]��Q8Y%���[3-N�Q��o�OEB�d�ϲ�}����/��j����l�^`��[6���x�7��5,�W�m�o�YѾ�����e�e�q>�QӀ0T���p�&&כ�ӝ\�/����5���l���.�'gV!S�O]��#�i��UU��r'A��<��f�ǡ ��E~_�Ce�Dwg��m&���߁�I3���:o�zVQ/;ޫ�^o�#�e�az�e6H��]I�]A�6��߃01���ţ3��9��u�M�ŀ�|����@^�7�_��:$�b��F���<�%�!K��v�}s��脲p�i�(z�W�y/�K̝�,���r^U����n{�������?`��p���\��[��ME��py�Q:��jF/�Mt�S�xW �1�B���$ۖ������a����opU��CgM�u���N<ߣ�+��H���V0P�O������*AX0�i���r�4���W��sQ�ԏ��uWނ�ӔTs��'���K����uGqSAl�p-;$v��^����f��_���YZؔ�dT]I��� ����U�]��'��>ψ;�5��(H�F[%G�{�K⪢���ӽ�3���. ��w��*�R��U�~0o�-}�僩���YH\Hg�4��<0(���� M�����-�DRj+�?��#��R2����d{AP����`�V|�ek�h��������C`��N���CN~�9]��߱�˗� 4�rBFS���]��Z���A �Ή�^6z�o:�?��d�o����c=-g�=c�I�Ƹ�t�ňr��KO�0X���G泼@���c=K�1���.�*X��'q���sV��܃xY�2���Qd�����ͭ3��,R䨢(����~Ŭ(.i���;`�>/Fq��y�&�����.�0���|,�����:S�r4��xf25����F�*�!�5��C_<B]�Mȷ�G��/<�� �H�YM�;�|XB�������J�{����O�Ir���7������_�Y��>���}-����vu�'���ь��h���%��H}2���V�]�(��?,6�Z�g،aG~!+���Or\�y i�����D��{���IIs5�}!3�o��8��<ѴvkG^~8�qG �`�$8�i�?���^�TLdo]�!�/����c6P���1$r�W7���^��)"��<�=�9z1��s�� v�}���/(]w:���=<1 n��ɶ�� �y�Ru#Đ��g��t� ��UvB�i�����jr��b[�>��h�`F��������p��RB�ݜ;G��ɰ}��n��������4S'�4�o;C�ĉP6��o�ĝ���粪o�SА?��]��o{��� _xY#hX�7�*,��#(����T�q�e4y�nx����<w�Q� ��C������i���] ��� �hf[�3k�.�zh��x�VvZ\�d��N��U+����(ggl���ʹ�h��mˈ��9NW��s�W��6��fVz�:����ҏ|�M�0{q�ڶ��h��.Fsű%a� ߴ�qvܩ/�>dθͳ�������� ��Ģ/e[=������i(�/h0I� �\�C�D�)H�!<�&�/E�.=R�N��iH �����MgN��l$�vJ��)"HBKədH�ŧ�:����_b:��Ϡ���O����IC��2�ŔZe�)���!�ne�f8�M֪�^�x:5O�4�i|U�c��EZ"�.*�N�^��#�]�������q ����IUW��'l]Z:&�ۍpW�mb"�̡��O�C�����d��1T2��E�~Kw3@)��60�)�����n�f�0I�HR�`Ć���3ph �9�ny+�5jJ$W "֬{Gat �?�A�h{����Bq2e�zw+.���:k���~T1h*�q�@� 'պ��iD|��Ezu��Y�� ���lb���r�a�h���mp�]��_\������-f�Mj�ƈ/���F��'�w�x>�,�f�Q������h���b\�w�䝰,�����q]-��������v�����ت���~mEX-�����T*��f���Б@)'�q=u���S��fv(�VDX��L���J�ߵ��P���l_%�`�h�b��c��!I�s�<p�2�� D�����ӂ���9=����r�,y�d8��تY+<]7u�k���pa�זC���!L���o����5�%m� ʠrΤ�x�*���������=Ո�Đ� ~�}{b.�R�� Gz���K<� xG��\�ʜ����)�6�Q[��XͥS<��-��t�� v߮�#�������q湪}S\�C)\�Jc�e�^�Tfy��}$@l�A/v��Z;+�.cD'�{��zZ�Q�R��n nbv��������f���,�IU��#]"�Rں�3o��gF���@ӻ^)'�[���ie��+omA�=¼{?�\��K���Y Z< �X�e�RP$g}�YK���ϖ��a�{/T~����0����ݴ �o��¨�R�W��WzOe�R��-D���v�>*n���7��H-�%k�A+i:�nr7�E����wg�I��n���UC�ʺb����I���"w� ����F�2-X���Tt�*Tt�I6.�> �5 �u�\z3�1���ҶH��^>:��b6��\���]��b��G�lBt&U;D���6s�����S���Q�B$��Ս�$o�>@�)�z}w[5c c*%�̍8՛i���!�U�V8��� ���ڿl���VJ���z�H�y͇��-��B%��M�tC⨄�A� J��!���1ѡH�_���Z��ᇛS��%Ob25tW��يUT�.��WKèui�`�M�˷P�%G5��!�0��ſc�>�Ӊc e���� ���h(G���#��B��u��� �(��g�h�LA��,q��Ib�J@8^�rϔ�YT�'e���=��'�����F�`z���Ù���������o�� �5����Yl��?�䯡��;�� 8��$�+-Z�z���k��ow�Vr|"�g8��ٜ?�$9�b�Ykˍ�ƛ��g0 ��������A�dѷ����p����Ņ�k1B�~uP3��(���w���tt�&�fw�}?F|KI�i�&�c�K���S�e�S�$h6�D�a��t&�aFq����3+r����$���j�kaƌ���Zn�w�:x� ��muj���X(��NMb̐��ڴmrA��<Ϗ72���0���"�#y]%�<#D��ܠ<��7�Y^v���|X8
Static task
static1
Behavioral task
behavioral1
Sample
9bef0ae0e16c686ec63f11f637c2dce35bf43d396c42069eb872c5309b8b3dd0.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
9bef0ae0e16c686ec63f11f637c2dce35bf43d396c42069eb872c5309b8b3dd0.exe
Resource
win10v2004-20230703-en
General
-
Target
9bef0ae0e16c686ec63f11f637c2dce35bf43d396c42069eb872c5309b8b3dd0
-
Size
3.0MB
-
MD5
108570c9c79672910b929db1fbe47ce1
-
SHA1
3172fae5fea014a9736a9897edd5e10fc64115d0
-
SHA256
9bef0ae0e16c686ec63f11f637c2dce35bf43d396c42069eb872c5309b8b3dd0
-
SHA512
17b173e84f00fa20b4516e9ab7ae506f6fe665c04d46580a8ad480c5ee1611f11c6ca43b33d5abee4b6597e8d624742f2d038dad4417c5584dba16f1fac5888a
-
SSDEEP
49152:fyOSU1zqGCZxU+9HvMVcqOav4iEFaNJIrN8YK+pDQFf1g/OgLUb:Th1qGCz1Hvgw8EFaErN8GSZgLUb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9bef0ae0e16c686ec63f11f637c2dce35bf43d396c42069eb872c5309b8b3dd0
Files
-
9bef0ae0e16c686ec63f11f637c2dce35bf43d396c42069eb872c5309b8b3dd0.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 768KB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 88KB - Virtual size: 552KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 288KB - Virtual size: 288KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 6.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE