Qe"O����Z��V���@�xov�rA�Te�;�����HV�̬%�kWM���� �aY-�)�8tu�����y#斤���>�Ȼx�$�O�0љ�1=&!������@4Ui��>��;xt@BW� 0�7�b`wV�-��+Q�?(T�̜�2����s8P�5w�x�m5*.�ٲ)q&�zB\�K�0�:69�*$�R����Ӏ�����w��s!��z��]w�i�}U�5�m�SH�Kp[��a���ͳ��X��{R���;l�G�xg�������&lU�dS����2�C�lpmY\�Vy���]f�v�[@$�٢6�Hb�P���A�3C�#���?2Ia���^O��j������7(m���Z�i1��L1 ��π���A����Wl���82��l=� ƙ�}<�0f����Ђ�������v~��= ��i��Pph��������hbw�uӬ�n��uH"�nSWJ@��е�^H�ӷ��(��k;R !@Q����&��BB��S&���m���p�����`�=֗˗�ە��;�Y��8������q �x2>ѱM��1�J�{���D���2����moMR 砳O�2�<����U��V/Y�^�(C�������K7"�Xzw�������"�y��b����n����� $�FhWs�}̋n�@/68�g���ǹ�6v�^��e$˞sIi[K�u�!�-���k��Ut{*�Dd������ʒa#�@�)��}�` �Q8�9�����A4XODؕ:ݹ�f���6�� s��B5+�!���e|K&��� 6��ij��Y8�#��u��ZR����)�9q�I��K�ʮz<<2a��AV���,m�;��4�D��>}$-�Z�(.�D���KY umز/�[|eڷ`@ �)�iݔwhOoX��s����bF����.֊L*Rj�� A����7h�,��9�[�uS�Hy�Y�1m������XeF�i�pOI$�:}J,ƴ��+<�a�\P4�Ȉq�Ya��-�ףX�ئ=BN�OpP������a=,����>�7[��m������m�z�C��R�t,������l\±�`��˖l�P^����E���e�Yڏ[�0iX����U��ޭ�1�c��-l����"�u�}Қ�z�k�F�(�]�م>�FP ;h���;짒' p�H������������j:���*�����{�+�l����6ס/X���l�6u�5���S=ԝ���cI�����Z��K��V�};����ö�:uatX����3 X�a`7=�0X��нh$xt���c�Tr���z��DQ��-����we^wC!b�F��yja�H�~����N��ǂ/�V��M��p-� �1Ǵd{�^�w(�;q���BZ]�a��ɚ�hr����������d�6��Qƶ����UձY9�w]��G5�!Q ۊ,�#M�<gr�3Iq=��U��yt��2�Ԑ���� F\��R�MS/ﻄq]�Y�v����>e}'p�����Tt�~��SX�i8�ޅ64>����嫔^�p��;\��-�1'%����J�nj�l��67b�R��<��UI3Z^�/F@� ����0V�˛�ݛ��?��>O��^�+����,-`P��@�@�c���)���7�~9[~ia�F{�"����������&�f��}{ 5:���X�M�a����ai���E��V�HJ��g;�@� �G�7�4Z-`��b?\w� /T[�3 �~]v��s�<(8���p��O��A�F������_�̞4�ĵE�m&�i]��ԁs${�\*�Po���#��%��S5���X|��9��|�K��+�Y�B�" ����.*�����Z�bn?���m�eB{�����pX?h��0���J�NN%s_�3��O_�OB��#6#Pz�8r̲h�y���s�2�?n/�l�٢�T�md��HlD���U`8�")�����;�����&���1�[=�2��B���k9F�T��fA����Ni ��s�� %�r��〛u۵�!�öD3f���~/�B< ���< 꼿�떷�̴�Zxiڤ�1�.@J��.�֣֝��OjW���'�L�����Y�]��c&O]�>0��@�^��`�?i"��u����-I����e~����ܱ�;��s�qN3`����*���0�g�-��h�3�����Q��kuk�,vPY߷�����y�"��3��|(5T�%C���g�6�E��>���e�O��aM@`U�ֹ�u@�+�?�$"��?~����-��r� m˸j�}qh��V=|vlrHB��<uW�ޥ�,E碀@:�1=11��g�[F6��Y��$�T�vx���2���zE{��˪�4�VTC�`���w���=EE�� ��ed̤�._���F�h��b3����T����(��ek��Bd���`�]n�$�5fF��&��I�к<9ͼ���<J>W��͖c}BY9��]�Z�U�4�����O�a �Y��B���0���<O��:�����4O�co�`�գm������#�id:Ir���}j;���V���i�:�;e�.H��S�z(�vf����%�z,Gl� [�}��[�T����\��pJ�K�cT��sf=:ݒ���S�bSa`17��Ιi��=T�;�����_ݓ]�Xg7iۯ�7���쥐�>�� ���'zVJ���#ŠXhHP�l��W,�K��d:3a0@^�� ��2��S��'r`T��Q#?{�05��..9�(�K6p��p�X�Q�9��гN4��̊9�!�'���b5#^A}���t�K��Ɓ_���9�T� �.�Y�OTjџw��t�)���dQhA��?�gBS�G�D`���ì<�H�3��?������ݑm0�6)�DR��2S�Ǥ<�z�k����u�'�%-^�J%�(:��QGϗ�����[6�ǵH�²7Q���IV�����$�ѽ��@7�7�';$m�lqM���`���u�鮞���4��F|>�@/v�)w���3Ъ^K[tIr$��V����<�8�ʩ.w�{��k¿�N�a� �_��w �pa�Ҍ'����8�r+*���,��|2ih�26)�`�Z6� ���o����>��9ID�"q't;����< n�.��ӝ���)1X��`C�ȃj��gL���MLۓl�[�֝�-;���X����%�tp�Ι���f�s���w�~v�F����E䭔���)�P� ^��.����I�e*�7nx ���8�9��92|"4��J�!c���K�Γc΄{���aT��\r���n#&㯠�>�Q���}�D�c�'ϧ�k�s\`<� 3���V �� �'�!Emx�Ot��7Ǭ�
Static task
static1
Behavioral task
behavioral1
Sample
09f7d6f2d7f42fcf55aa01a06b366816.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
09f7d6f2d7f42fcf55aa01a06b366816.exe
Resource
win10v2004-20231222-en
General
-
Target
09f7d6f2d7f42fcf55aa01a06b366816
-
Size
3.0MB
-
MD5
09f7d6f2d7f42fcf55aa01a06b366816
-
SHA1
2557c07c820d3f856f59c55a76706e29c0dcf9c4
-
SHA256
c738f197bc0a44a2b82d58f7ebe25196809f4a656e214e4edabc45def3b58ea2
-
SHA512
ee3fba0837034b1a433f7ee24b28acfd41f417c574cc8c8c8d58fde9fa3e34f47fb561830dbd7f93478d31780041b2b841760faf81f999f3e67810d2d0d69fbb
-
SSDEEP
49152:5vSyPHT6Qpi2QPK+9XHgmig3556HHRXSu7qNrbVmjR+3YZ1TpnTiOfzpKZahL+:5vZPz+pRtia5wHRNqpVbsTiOxq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09f7d6f2d7f42fcf55aa01a06b366816
Files
-
09f7d6f2d7f42fcf55aa01a06b366816.exe windows:6 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 321KB - Virtual size: 848KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 410KB - Virtual size: 944KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 33KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE