�Uz�)�2�q��_<Ka�Ʀ.v�0�,G]$!H�O��7�p&��\���*\��u�ݣp��������dD'o�]i���~Q�ƞ{��'��G����G������Q��+$<����?����[f'�!`�b����(�p�/u���Z1!9�Qך3�9�G��`\|�h�2��N4�����%d+-讀�&��\�%�Ȯ����-�76X{�|3���u�>��w2A��;H2\��\$ ��b�W�$����86"2\�Ի'�������l\)Ҡ ��2d��No�DoIl5��U`<{J}��� ��.q2�5�iG�p� N�hL�)S��� �h�_���L�o���` ����\�x�Jk�2-�.Op8A�mOE9��K"�����NR8 H�g��ў�8+U+�.G+�"�9~�}Kօ��c���xd|y�کO�&�I7ý���}-a�w-�k�]֪ɑ�6:�M7cW�%XZ6 �8�1�S�W����爯��C������S��O��CP��W�o�$�$�(戇�z�S$k��g��dd����ҋifa4�1��Pij���ol%������s���,X�$�Al��b���Z��z�����ʳ��1�}}u �����q�E���v����Vn�rI�#�r���B�&��"e�*�^���s薿l�����G��8���L��1��uN��X*�G���ӈ����e���s�3G�c�0LC�OK��/r�1\Z(Y�O���rz3��]���g�Z#Y��U�&��a�F~�(*�+p����)��/|9^�7.� E����E��@!��'���b���'�l1�;{�)ܹH��k-Z$��k�Cy��X���P4���+�����:�]"�����9�z ���Bς����pk��A�_�`����H��KV�į~Eg�b�b�:���,4q�� ���HC[z�Mр���&jq�zd<�j�H��z@ˬ7��T��� <��/����������P�P9������� c7�E�YU���\Sd�n$=�d[K����<F!����<���w �&xj�h �0\�ۣ�\~��t��(����q��W`�y�t��d�O��Mu�ij�7c�]v@�F"�!jxA ��n����C���*R�m�eS��Jy���3���L-:V�?o����3˦�p��C6��{P�� ��ˍ����b�/^��OǮ9#�E_#3A���r����(��@m���t�YꁵO�єh���GX�t���ӒF[-~,}�Y�YuYV��ܚT `�#��s5?~���Èo��}a4�H�+� e��ů�����U� 9O�gGy�QV{��I��W d�&�e�m,r��Q���ˊ��3� =ntk�W�K6�����v�(�����zBT��K�b��>�z�MLNO���@ 犭t��w��e����uϴ%kZ�9HSt���'������k�$O�о8�b�8쁝���F~DH���Lj9 ��^�T=��.u��l��*��i�5z��W��ow�A8�uT`;m�t�Y��浮��%Ԭ�G��iV[ճt��[��ݼ2F#蒐�x<�7�&{V��ݣ�t��0�>����D����k"eĶmT��~���Cpud�w�� �f� c�U�i�(�5��}T�����z���������$�z.�*�|��,��+>=T��Оʍ�Y��s��.�ђ�R���bH3�S�ɵ�(���6/��L��w�D�Q��7LP�ណ W�� .H��7e�ES�\Ң -מ�1�[���M!� ��?�!��2`Nĸ y�6\I�y��ïԈmj*�+cz��54~��iy���L�y�tɞ�ԅ7ӻ��i�ػj�*�1�ܿ|��A�p�S+D������r�(e��E�&$��*��zݥ��Kݒ�L?!]toE1���iÉN���9�)!�<!X`�Fʖ,���=��N���+���#9���g���cW����d$^�U+y��e:�VIM 2����df��*�B{�)�E�|���y�u/LR��,��3�q�I��ٽq��vn�K�����!S��N��r�_�VjߍY�O��X�n��������/!Ea��5K���`6�c:���@�O��*�s겪/��p E\��i�� J9 ��/�d�qШoe<(b��If₂S�MQ��Nz����ja �2���y2�쟕�j�� ��Sh�1(#*�3��Y2�[���(_<�4����Z��c�8M�� 9�SZ�g߀<m.��$�o-vh��o�QjW�H\8y"j�� L�S����.M�-��u���!0i�1�>��H���-�`��3 tL`�8�eɚ ��g�I�&#���A����2>��8"�0 x��zi^��a��S���g����)�F�U�r������G�\�e@�VOHN߄����B ^�2�5�vAnkވ��G�^��\����R� ��ZÒ��N�)j�J4\��@�� �VV��et�{�ƀ�^q����j٪P0{p�L�ܪ٘ţ����� ���Pde�e��e[�3�= w]�6j���p�ȧ�t��dܳa�#R�)+�4<��m��C3(��Y��O=�ȱ�"ң ���u���i�\�9��M���J �4�Ȗ#_�0`��8Pel ��@�����8�����.�ă�/��2P�eI��%�rI��uxz��ϸ�Є��Sd^t29�r��q�Tfg.G%��B��Y�*o��<��cZ�#Z{(2V5m�����N��9{���0�W�b���x�7��q�z�1p]�?��g�����{<^�|=;qp��9L����_A撩�����'��{�\���^�W�T>�~���x4eC���Ç�x�������q(����G��Y�ԅOښu�_Ax0OK�%�ل2�[�0J�;>)��}Fײ=�2K�RJ�I��G�(��&�͵�zk�KK5���b��y۾�� �.ѱ3t��d��ei˾ɹ2mʭ������kP�Q7�Io<��h��i�Ibෞ����(��i��ӏ¡�Ԭfp��j6x9�::jM3A@��5|��e1jǮO���W
Static task
static1
Behavioral task
behavioral1
Sample
09021d0cd38bf9e94994c218462c3ad2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
09021d0cd38bf9e94994c218462c3ad2.exe
Resource
win10v2004-20231215-en
General
-
Target
09021d0cd38bf9e94994c218462c3ad2
-
Size
3.8MB
-
MD5
09021d0cd38bf9e94994c218462c3ad2
-
SHA1
c09533d204eb05441f8a84bcb1efa293ade73e47
-
SHA256
2f8617399c4ba179fb580910d95ed49ffd8e1e63d8d7bdde402f65192b78044d
-
SHA512
b524a42fa855e55ea6aa8b2194ed6dfb09c4ea076cd27ebe380551e1d8edd18b516549f7252b3c4fbd2363c4006603f475851f92080ffb7314c33887f93f1f1a
-
SSDEEP
98304:ltFl3MFzyEwLHsz7lImyAmrrUiXmV+67BsPP6EUfZSUK:lt/eulLHszm9rUGmV/Bs3bUfZS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09021d0cd38bf9e94994c218462c3ad2
Files
-
09021d0cd38bf9e94994c218462c3ad2.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 82KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 26KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 14.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE