�Ӹ���A��ɼ��j��#��D�j{��6� �҂� FO�]_ ߮��t~�����,Mg�+�1���h@d����,�)����Q��:L���b�����D�#�ߔ0BFüT˳�dlG��%Wq���ۘ\�͘bOb�b!pg�����U� �X��j�o����*�A����B���_q���g^�xJ�:1�_�]`��kA�TLC�4v_�Y������}�g�Q`�%E�Xf���/]}��z��k�@��� �ı���q�-���2��8'� �� *��@� �������B�W���a $��w�L�ꎅ����lW<����xF�4n9ds�^,�h�f�Ν��r�ѝe���HD9x�)��R��ޅ�Z;�m��BI;�b�_�rJ�`4��%�7�z���R��6�B�WPX�a����_��I������h��ؓ���F]�hz�`�yaaM��������i�n�*pPV��Ϫ=bw�y���njJ�۾���/@�e&˰�S5� [�-_q�Ģ��`[K� c"�U��3��ОA�������o�T��r���/�����w���� 9 �k��$���?�S���j���$o�кp���O(3��]ˊazC���bÅS\�����eҽ�$�S�#�l0c��}t��8c��龬�S7#�����8e�U��^�v���)_Z��5l!E��\XP�K��y�>AɊk�����np��Kr�`�Ë,r9&D��-�_.����M'H��lO��$�Y/�;���3�Y�D��p��Zja�X�Y#���n��-��ìG_{梓]@v� ӵ��-�$��n�H�䡧+E}�:a�n����UU��J4��v����:�܉�9n_��G�!D]d��E�������.>��,���E����B�Q2�%���� ��b��k���ԯ�,|D܇�� �~��1^+�j$j���CO��":�� ۠��ek�Z[��SXJYE��kMiarz�*F�y�=�A )�7m�> \T��\c�����t< !;�����V���!�h��yYA�(z)ӆ�6����ɰ_�/��Q9FKO�oh�)s��D�{ZC��%]��� ŵ � qF��j���������VLY���S�� �}T���f��9Euj�!�����#�C(��ڱ�曟��:}��-�6��Yh3�c��IJJjK3��dz�������[� ��ά�)!�5���|�I���& *�_4%7^�r\�L�+ܙ��i�5{OU����p�B%@m<l��L.���*���@���߸�<��4� �AmP��q���&TPu8�@?���=�Ԑk�XR���B���~�!�p��Dʩ�g�%��`?���7?����Xhu_�`i��T?p���O�W`���|>P��NP�TGTӤ��{�ޮ��FOB��מD"��(�x��4jQVtU��������?��d��Vh�� T��SE-� �K�XS�+��������^<����av��u�� F�h������r�8��%�ܟ��>�����x"\;�( �&k#F� 4L��W�S�aN�cȬ���BϺv��*�����t�̿K��.k�,<��4zGDl������\��?�,A�G3ʈ�U���j%��FJ�9 �s��L�=�ͤ={W�'h�s�����w��;��?��R�ūpC\G,�zvl�qM-��f���F��J�E�a��5c�R�+�D.^���$i�|��?Ͳ�B=�`�����N�~8�z1��Ҙ�߱�Б��d��?��L��I�?sD�N��q�L��=�R�q>��'���ljj�}���=a��y�s�O0�m���I+ǒ]O�Yvn�v�XȖxI-/�2D�HLgj�ہ��'���I�%���/ꡀ�SM����i�$�>��K"KӉK8F�p����yKtA�1�7��l"�wZ�C҂�*� �,�Ak�����=�@Ua��u�����;t��yz�� ��d��T��,6�/�@0������=%��_�f�#�q��J�H��� ���ǢfV�P�|�J���#ɺ@�n^��ܴ@�oʧ���@ާP��D����#HO���jM��r���`�9��d&l����N��Gd�>/�Z�u�Nx��] +R0%@�f7m����Ji��DT�&�Q{痥�c���[H/�!4���g·�j���{�Q��C�l�c`C��Y��ܯ*Y�.�B��^���E���� �d�h9`Ѷ�p���\��<jkyуv�ז�� �|qcM�Ҏbm����W���Ht����G\�����!��ډp5f�~�#R4v�t�⛶�u�n91�]�BR���ѳdm�m8kq���--ק�WQ�͍����r.�X� d�$��Q���\�2|gNө&r�k�^@y{���q͗���zT%����8N��/��J��p����ٚɿ[;�-��$�����H�a����QR�c�҄� ����Ŏ[����"�xH�Ƃ��T�]v(�FT�����/6�r�ͽ����Y#P�?��ՙkg~�ܽ�>�Ó� �,����z�<0 rI��o�ҩ��m��@M�_�R0�R5�R! ��9�wc�*��W��s�s�6�K7I��EJ��u�#������P��a��xz˰�mq��'���K�����ќAm�d�Hs��̄2 vO�8�G�4�8������-�٦R�p���ͺU8!��B���Ls��B���B��"��F7�MNN�)�(�"\2��A8Gq�c/��s�S�r��Ä�gx�%p�[�.��kA�GU!�"T��V�����s^]������_I��߳ˉ��Z��>x�ս�#c\�W2�R���VE�kј��u���&ٝ�G��8�60(���7e�)<���{;�����^�#Y�ǫ�� �p�D����&�|���A"V��Ř)���/�) �2����~|E����~,�Z}��A����k�Zd,���@�ta��E�\-���p~+S�9�A;�&�j�4 ���2�o��V�������)S3y���\^���Ѻ�������t�,~�d,�Kv�����Y-'�p�}M��Ե��#��e�\D�ֶ��~X���˸B�3a����ۇ$C��wIr���"h��n�a�������ɇlI�}E�0���b�gf�[��t�9,�М��y�-�+��Kͼ[� ��Aʀ��u կH�āN��k�3\�@xt6�2�����X��������wB���-�"���V�z��t�N{,�#��h��;j�T�H�1Yΐ�7�k��:���L?�J�}��J�sh�zX<�w�=c�{��%��ET�4�ƪ�tG+���Ydۢu"^��*v�o��m��U� �k+$ӕE���qr�ݜ��1e+�y��#+��㑀�=�ͣ��W�NK���Ҡ����t9��J�&o'f��<�`}B]���FKa��1���o�m8w��6n��i�9�]����r�W6�Kd�D+��v�HLY� ��3nm�?NF�� "�o��=-_�2Z2t �9%!�DY˙�!A'��@�'��E�T]�� �^\�L*G���+�Uߺ� )�]�����7�������丏���7���#%1�����k3o]Q{�+8�Q<&%���0�o#�32bx ���Q�]G�o�F�r��(���e�<��X�VIq3�s����4Y
Static task
static1
Behavioral task
behavioral1
Sample
99e5f6a290a75f650f9dc0cf792f635687a737c68bac697e702bbc40b93cbfc1.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
99e5f6a290a75f650f9dc0cf792f635687a737c68bac697e702bbc40b93cbfc1.exe
Resource
win10v2004-20230915-en
General
-
Target
99e5f6a290a75f650f9dc0cf792f635687a737c68bac697e702bbc40b93cbfc1
-
Size
8.0MB
-
MD5
88d2a9cbc062af95c56b65692734a82c
-
SHA1
44f863f44ca136ed207ebb7f07c4038ab9ce581b
-
SHA256
99e5f6a290a75f650f9dc0cf792f635687a737c68bac697e702bbc40b93cbfc1
-
SHA512
46fce927abf7904dd7f0d0e448c78359c999331bf67da07a4a4e8ef65eec97f17b976f8f86e4406cc75a38b3bff2530d477b6ba7fec5595ed8868c4be1e65996
-
SSDEEP
196608:SkUhruUQwtYe2OfyXpNmbDhoW6p3Y+wmpK1sf43Tz7PyctP:TUhrHQwrQXmSW6p3Y+o1PHPych
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 99e5f6a290a75f650f9dc0cf792f635687a737c68bac697e702bbc40b93cbfc1
Files
-
99e5f6a290a75f650f9dc0cf792f635687a737c68bac697e702bbc40b93cbfc1.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 460KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.7MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 36KB - Virtual size: 536KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 204KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE