��Z��}���g��@��M�m�1�<K�(�;�|�)"�T{������;_�;����E�O���^y������_��Y��2�O��Ҋ.�pfep��yC3K���%��e�3�Y�/�\��:+��T����P�#�x�oBcR�Rfuk�+�M �.���f-��^'}�@�}'�Q����ǥ��K��N��'�5��tURN���Z��!۾�TEƗ�-M~��/Q�㗍�~(p�G8M��,���9y}O[��������T��<]�'�n���\����F��\}%2m ����aێ��L�n���@�G���z��{�J��, �~+%�28t��EJ�ie&�nׄ��5��&j!G|8�cL�������j6s:�~���čC��"�ب����5���C!����ʍ9���7��܌���`9�� �s��f�ΨRVs"g1�1���m��8�43��n���~��,��B"�'��@S��p�ZY��}�cn/�D0 �'ۄ�]� Լ��I��G����ԀL�Us�j�����Ew����K��1�"~YOk��H����@7�l��bB�!����g����0+��I 0#�-e�!u8��Q��>�<ygk7!�m����x-��Vd`����H����Sq3���������Ul��%��L�]��o����r"�Z���^�[�$n��x�U�|�S�\(s@�-�E���(C��zZg�O�^Ɓ�� >k䲝}�@���Jik�i�eI8���퇐_��O=�v������ֶ��[�6/����4e}���F@��+~5���I�)�,}�������H� ?)=u0 �L�fH���eB����� r4X/��je�v���S�ڤ�_���X�N�Ͼ%X���\�3A�y�E�.�~��4�8:�@c���*�":!�-7���z���,~�� �]Gv�&���]�Xk�mq��B�Fj%QNa �s="r�},�d�����rv���E *)��h������*���C�Sq<���شE�Gt��mˬm:s�% ;ۘ_��k��A�[����* kk�%@������o'փ�ύ��U�S������!�m��}AZ�E\���an���p�c�S`�!��'ʒ��^�c}��c��9���|L'm�>%� �&b|�)���T����з��3�2�1�p `7G@D\N᠉�È�Cu�ks<] �,C�`5��3SMR6{15s��c�4�Q���џBI��> ����� K��?���u�%k��J�V���_�a���v+�bK6J�%��EK�f8��,�v�Հ1?wV �V|��o�+�(��p�y"��5"����D^K@����ӷʁ���%�u?7�D H��2��w�A�v�]m"�� �|���v���6u��%�p7�aR���|i?��g�<M:�Qb�u+�S��+�µi#��=l[k��,� _����}�R�G��k��������* ��z�%��_�7���IV�(~����B���� �a�F��A��������g5سD�cu\���$.k>�\\89C�+��4��j�7�$]#����<mOj�q�Þ`�;���(�ȱ�MޔD�L ������pP�Ȱ� ����]��wC��~�`<�����f����sUl]t)1Fo��mGC��R�${)�S� >�'g�H����(�7Li��~p��Ȧ�R�_�Z���w�K�#nqW4��,��r�p[W$mFs�qJ�d�|��4�H�j�8rt �&K�Ʀ���ї��Aw ���X�{2f�.ʅ˝7�w����GI�O�y}����>�uJ���N����*�ݘ�y5����T���deQ�d�X��Y��+�)B(#�(�=�͋G%�˓%����P0�Th5��6��Dw�l��� �0���=�ST������BT�@.�Ie>�C�W�1��Vȳ}�ٖ�s�D�B���mء'���A� �ӕ���'���vY���-4t�!aA�I��^��@9�(��O���sv6i�UswB�FzǶ����eG��8�:z�\ x���ӈ]"�#���&,���C�C��|�lvf�$lr�w�3r��wb�T�ZH���O�:� <�����y�~^LG��]~�����)�_��cV��Z��|�P���\HE��K\PU�jxg|�wҵ���W�T#e�L!?�A~��}.W��Z8�9��34ǜ���J��:�QUJ.�ĖiZe��QwT��ߋm~\�h���:�k���2��^Q�<�+�w���\����"W@�w)<sV왐8H������L�хc�@!���g%nփ�+���H�i�H���+~����v�����P���X��P[��@��U�[���*�.�#p�T&�a�K��"/��u����,2������:Gg���(4QO_oaq��H���DDL� �<o6mS&GHZ �'u�~��S1���~x�c S�sg,�i��A*�) R�7��]�^}/G3_��xdog�#,��Ƹi�!.�g �w�s,����:�r!?���p�f#�j�ÂM�X������\��%J�������Z=v�ݙ(��Λ~'�}�U�5M����.��Hn� �߄���P`�k1��₇�Dh�bA�_�4��C_������ ;�� g"�������S ���K$mѪ��@�Ջ����k�(��@�g�2�6��}�5<� ї���U�h��W ~'&��8��z���h! �u�d��6��EB�";�Yy��e����'_�S���s�QQҿ?ӳ٥S�ء�а�p�U>�(ٜ�D��?E��.Y�-2��"�*��h�������Ŋ%M�^%W�oe�, *�|�S� ��� ��U�]�&���bE�P}�����������(v�~�e�H;?x.��ky�U�(�6�d��&�E �uާ-���D��5N��J���@�;�{�<o�Ou�k_Hz<Z�� ��e�mzC�ǺBȿ��%�Pt��M�����` ��4���9�o�e�T�k���T�w��#9P7��M� �T��$L䷆��^�+� ƙ�� �9���.3!��&q-b1U�k���E��A��Ѱ鬈*�+D�3T�8�$�EZ" �qOïIG'K��
Static task
static1
Behavioral task
behavioral1
Sample
9adaf2f680a1492314902ecd473778c24fe8697967c43bd9acf738a11ca3483e.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
9adaf2f680a1492314902ecd473778c24fe8697967c43bd9acf738a11ca3483e.exe
Resource
win10v2004-20230915-en
General
-
Target
9adaf2f680a1492314902ecd473778c24fe8697967c43bd9acf738a11ca3483e
-
Size
3.2MB
-
MD5
1fa72ff2c15e5601309d32d6faa4525b
-
SHA1
9ea25573ee1a26fba9cc695db975dd335898abb1
-
SHA256
9adaf2f680a1492314902ecd473778c24fe8697967c43bd9acf738a11ca3483e
-
SHA512
57870f3658445aebe68d8e92cc5f9fb8285dac0879b47c6f848f566d2307c0927894ac4bed15657bb7e7b9f48b4a5f567af578baea187027951785828a94864d
-
SSDEEP
98304:8CqFDaqg62EEydIHqcVFjNzujY1qxavCeLjS:8CqFDi8R0luc1qACe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9adaf2f680a1492314902ecd473778c24fe8697967c43bd9acf738a11ca3483e
Files
-
9adaf2f680a1492314902ecd473778c24fe8697967c43bd9acf738a11ca3483e.exe windows:5 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 63KB - Virtual size: 276KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 44KB - Virtual size: 468KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 333KB - Virtual size: 336KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE