����=p �� �?���LTB��|۱9� MJ�������L�玍�h���h������0v�p�c�:ԇ�R�ƾ��uXA�f��/V��P68��e�&b>�)�i*���~z( ���@�b@��T���)�.k'[#��Â[:��w�v���w�:�i�P�����6�#��pb�i���%6R��������G<�S��Vo���xF6;W3ǫ��x˭��^- U�~�����ӌ�������s��< ^�l��A����n�2�E��ګ�����٫'�1o�R��9��H���K�3��yb9���L�!- �q$�'�MD����#������������FPݥ� �5�la���Q���c�b[6���I�) �#��l�v!��ijL)��%y�[�� ؛�G*(Ʃ_��E���O���G���t�Q�]u$>�_�pA�q����X���o��OV��[J�e���ZG*@�T���*K�����r�,���Y^�d�u2�TkA��������E�5�yϭ��@���"��)��<��U�8:�@C�}1�bo77?�!�!��S�p�P��Ϫ�Q��I���:Z\^qz�$�qv��6��~����mn�>�(�l>ӯ��a#�K~1�z���4��R崂�>O��aJk�=��&~]�kK)MR��$F��)�������4�rf��h[�?�'c���D��@k���P���P�+����Ok��x�n$��'������Y�fN��Q�@ԷM�Q��&�~�-)�r�-&gW�R߷�R/��h���8��T�������� �m��"�=1��$�rQ�7b�:� ��.����S�C��8;�y �+���p����9ߴ۰T-���n'L/^0yy��[��6a��m�iLYp��^��y��Gv# �MD��aj�����4WG�B�R�����I�̳j��l4R�#dK�~K�LB�0��0m �6�����p�3�2j�=����=,�)�jQx��;��4Vv�Ψxi�-�C�=�&��nDs5�}��qVn����J�ķ ǒ �����a�~����f��A"O�(j�v�+p��wUY��?5��9���OJ&�z���Bb��hSuo��4��3��Q��}���w֧O�M>AJ�-��#<p0���qQ\X����Ɛ� !�n��L���yp�l�*��?*���Z$ow�x>Pה�\=v��M-zT�& v���k38�8f�~?0����o�f��ig��=�4N�!�Ȥ2#��5?^d��M������HL�����7�p{��BC�=C��m| ��@Q.^a��I�w^�o��=���L����x,����r�3O7Ύ!�"A������x�/"�(�D�z;$�3��H�����Ue���xN���F0�v�'W�ҝ� �V�����LhRL�!�*=���S� +뎩��)��Pg���]�Ӕ�B�G��!� M/�.���nN���rW�1dj~�S��ꄩFU*\�E��)s%�*���ߛ�c5)���# ��ͺ�i^ml��=�s�S�F��:��x��kl�H̐�J/�j����qxq,�Y�f�E]Ք����'�Z��1�t�jEi�s�k���"�3F#�CV�@�Ѧ���[q�����Տ�.l�#v��(������y7��N��+/N!��57��5����L����5�����<�c�����`�ka��u@�Ww��2m`��Je�#U�QU�Y�X��b�`Z���_,� ��5O�b��ZIݢ>˖�l@����K��[8u��C%8��w����j��aK����Qtf��/�m@'��s�����U}�� [��ޢ�GX@wNe��Ƣ�e���Eb�Mvic�Zy*./�-2zV5SR�Fղ�]�i����h�-��T�o�qe�������r}��/�����Rb)�O"s�w����R��t��0o-�O�!c6c]K��$��&�#��|4�\[b7�B�+-�+D�ͮ�A%xLG��悢Fm"�hz=; �/6H�`�A�aO�L� ����V������)�����`� ~����"P���2<9��7Tɡق�w��J��r�)�^-tf_� �����`~�#����C�+�M�/w����t�&�Lw�ј�O�i2��Щ�"��VF�^�PCf�K�Z/�����YA���o�m�� �育�㬣���ሿM9�|~� ��WV��������)7[�)W(w o�qF�*ЫK���2��sz^��KeU�%=�e��'lq�T����N*�/���@��;����tN ]�B�>x��0�w)(&�}��nvټ'FU�F�%|v�u�t��������9]���@W�=�[� ��^0������#j��J4���䨖�Z� Э3�?����I��)z'~�I� ��Z�k0���R�����F�'H��=�2���LJ;_46� ��E��Jk�l=���p���y�CU�^Η^��e�s� �!�6��/�;{=�ylI�y0�$�����q��4E��\��v�&YM��}���x���`q�����5ī���"�9�;�\� ���[ex�@� �B�*9����VḨ��hsf�[�����G����g� �˱9�\�+�bU��H�/�D���|F#x$~���;�j�4~X߂>Q�Ik�`�I���gq���똰G��TuI�a� � ��Y4���5�{���Nqj�b&s��dJ ��H�$o��4N|(������:D�y܋;�x�2�=$f�V���������tW.� �!p����>}X�K� ����aCW�i��F�����I�8d�8�� _���K�E-&)�+�O���p��<�Qe+���[������a�� �'�̍����J�m��7���-zE4 *����a)�E�YI!�v]��+�p��W�x���v��?E/��Q4�+�8-�H�:�q�P��nw�♒/�A����Pg6��]p��3˝��7�(�4?��u�G1������o���p�A~Em�z+�M�`��.������r�d-Ћՠ,8q�c��j�UEQ]��C��hV[9%J��X���w�p����Ŷ��W��
Static task
static1
Behavioral task
behavioral1
Sample
9cb418062bf0d276bf8d.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
9cb418062bf0d276bf8d.exe
Resource
win10v2004-20230915-en
General
-
Target
9cb418062bf0d276bf8d.exe
-
Size
8.3MB
-
MD5
e697c8398d6fd6423c20ecd0eedddd00
-
SHA1
89408622b1166d4253ac277fdedbbdca531d6464
-
SHA256
8fe7796f8d1e3dbcca7616932d7a18e09a6ac9172a9f15900376c5ca13a6dd41
-
SHA512
c0c1bb0a36566eadc7775d4ed507143e4a42fade1515a1831e5afc8bcf98f92d34eae42175ea4de2201428c9b070e96a96000d4ce6893f40ba45cdb5e5f31273
-
SSDEEP
196608:uZYTvLUtl+5aKvmDaZ4zCdaoWtQ5a7ZEABtA6iBwcIJ//9O:uZY5XmDacCdaYcZhtA1uB/1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9cb418062bf0d276bf8d.exe
Files
-
9cb418062bf0d276bf8d.exe.exe windows x64
b1bd9fcc8d487d7d6641ee119b3c01d0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
ws2_32
WSACleanup
secur32
AcquireCredentialsHandleW
ntdll
NtClose
bcrypt
BCryptCloseAlgorithmProvider
kernel32
CloseHandle
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
AdjustWindowRectEx
CharUpperBuffW
shell32
ShellExecuteA
advapi32
LookupAccountSidW
gdi32
CreateRectRgn
dwmapi
DwmEnableBlurBehindWindow
Exports
Exports
Sections
.text Size: - Virtual size: 993KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 528KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gxfg Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.stub Size: - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 17B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.JD4 Size: - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ZfZ Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.;pL Size: 8.0MB - Virtual size: 8.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ