8� eUd�fm���_�*�y�3���쭉��3^%��#w�pK�J�`58�&���sKrEкQR��������RY���%��ԉP��;'�,oD|�������������~�7m(��q[N���ڼ��1��Ǔ��c �zr�Q��1�Ml������>v/͝���dGp)��l�}>��G��~A��_����g�u��������2����啻�UzFX��w7����v����N4Q�����A:�K%����W�<�;��j-8�`Qj_=��î !__�FBr������b�����@8<���������d����j�g�)���FJ���_s�2�A�2�`�-��/� ��aİ��`ùLL��A q��gr^���nMB���5��F�IQ�ڟ�H�N�@ 79���[`oZ)=�j�ECܭ�t��d�C���R#��g�e1�v��{��T�'��w���^!�����"n�յ�� �1p�/�{�V���~ Z�y} jpY��)�o�UU����p�'�w��3RY>�'�iBT�|=��P�m��I�Y1���,dG��3gC'F�ך��"�2� ��:���h+�M�>sV�S9�� �|�-f>J-���mce���J}t!� �k����'�u�̔���U�ᖯ�!�#}���g��я��-@8��<_�2y��qv��\�� �N�y���5%�A��_���Ii�\T�����Y1��!��S�ƌy L�(�w����&�E�6�Ee>E%s�d��3_��)�p=9>���+�'��ڍ�ێ; �ԚF�W�;�6�e�VsT��|MC�A�B:b\�3g�6�K�_u�4*8Z{��#f3���&��P#�["�� gF�0�1���M��[�FK�U�!��EFo���N����t�{��YT�2Q`F֊�|\i�Q7�d& ����l�ϐ�AӤ���'�ȹ���(γ4�S�oy3L<��,O4"�b���sL^��%��Ai�4��= ���o}��C�ghqz���F���$ �)�p�I�0���;П�<��"���Ӡ<e���C 5�^K���1 W�6��Wa�������'c��g'> DEAlg�U�^X��ú�&�{� ��cJX)�� �7'^ "�6���{)�Za �p�`�_U����b���������$��TY�#'}3��Hjc�=UII���2<��(K��oa�\S�$&_�s��C�O u���e21���xo�Mk���y�|���aI��H�[�{��>������Җ�����0�Z���^�=ݙ�B&�|<r6/<������"�ͭ=����PDR��X7�c���؎�\g'H�Og����v���7��w�c��_)����"�� x"�@D-ƜHٓ��U%�G.i1%[��˜v%gF�o� Ի��`��ID��|�.y���;�2���y��9�I�i�Տe�VBZ���^_����˛àKt�@Va�rŘ���O�" ڴLG%����n�8\��<�6'[ҡ�K4������� �uhn9z�6 3�f<�M�<8�d{;�c�jV�]hsU���銵�x,�7�m6%���kk���8������Gxr���L�V��j��B�-<6��@6o-�tTJ�%/&8�=�Q�Qr��w"�xe��_��C9�VV��Y��y+f��u�{N�^�5��#�_�șގ���1x��̸<|����EL=Q����%�q(d踼���7;������Q�K=���I�Mk)e��^9���lu����N�ƣP����X����b�����_���"�����]$�v�B��;��N�2�=Vd��Hu:�pnlH t��w�i�F ����[S�o�ZD%8)r����z�m��aJ�'T_D0G��y�MW��SG>S��d�T��3=�Ş���\ҳ�J��C�}�^��y�Zb?V��Ҕr��`�����l�o��|r<E���9��3�$)���DcD��p���B����e��:����LXUk�W������.���i-]\!�f��?�;�Mfv�e��,�H�.kwjDJ���ο5sj�U��X�|p�\��7<���|����c����:���SXN��}yL ��S蓔l���S����\t�!��V7�؉���I���QD�r���n�+i�f>A��:�b���m�E�����{lZ)���( �c;4YY���B��p��}��6�?��*Tw�n0`k����g���?ُ�g��kA���Z+0L#Zf�?N�&�VI4tes�Z�*1NI�T���e.^��^��7 ��������� ����M����y��,GS_�g�>Rz��n���l�����\X�`��x���n^L��ً��d�k�T���Xt�De�0��ܫ�,8�&�������N"�����>�{�+9`�NKh�"e�R^+wa��Hf�8� DU�4�>N z� '�pr�����CY�� \�K� �G�&���ӳY�ԧ%n�˓��N���>5D^|��X�>O^�e|�+���kU\�ރ�@S~�D�ĵj�x��8`�����c�m�e#Yc�[��Lj-�uսw�?.��Wq+5"��,��f7(�9�R� ��S}�+�J��B���A�J����s�-��`�_�r��N~M��Ǝ6\k5A�[1&�#����댟 LM6� �z�*GBkX�2]���c&�L�� ����������7�}OtO��XR&�7�4��9V��vt��3�9[�J�ӘF(��X�? �(�B+J%�*�o���y�ڈ�pB���t�(P x��m,<������e�ֽj��=�|q�JU�<JN�?o� �3+2����f[O�<t�J ���n�)�3d�e��Ŀ��$���= zu��7�@�Z��EdC�_OG�1�Bڬ=�1þq��9��.q5���+f����]$y&�?�^N��Z���`O�Y��^՜o�'��Wg0�DFx�!�w�R�P�AZ�Ɵw�� ��|^;�N�]"�dL|Ӟrj�s���M^Azy�CT�i �'�xO���)�D�/�d��y��t�{ �O�( �y����ůP��V+�����Q�V^&8�������xll5����Iu/����:��F.v�tM�P�}��Տz�x-�e�}��lFs�E��M/uGH���+2��"���8�g�<�1P��m���r�:�5�����E̬��bԢ�'��� w��Kq��'����D�uSxT����S*���<��#,Ο
Static task
static1
Behavioral task
behavioral1
Sample
99eff145491f05a17a5c26a22da6f906.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
99eff145491f05a17a5c26a22da6f906.exe
Resource
win10v2004-20231215-en
General
-
Target
99eff145491f05a17a5c26a22da6f906
-
Size
2.5MB
-
MD5
99eff145491f05a17a5c26a22da6f906
-
SHA1
caaaf3354e249616f8cc1a31750f9d647c84d7ea
-
SHA256
e7edbe5da62663460a654f213ca46634ad7781aeaa18416544d8a6e0035be268
-
SHA512
339dfe538cc7eb81caa8c456e42cd2bc2f1f446022b716f0d8822d8c91f707ed11f66ab725f2c3e146417fc97596a3045c4ade1306fb5d4e1d27fa9f43d92b4a
-
SSDEEP
49152:175d6qQ7zFLTenNTaQytwv0eyV+L4QmeoPi8A0/vpxp:17277zcnNTXLyymb/A6z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 99eff145491f05a17a5c26a22da6f906
Files
-
99eff145491f05a17a5c26a22da6f906.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 141KB - Virtual size: 312KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 26KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 15KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE