���DG�Yi��&zV����!{��&.+�P�Q�N�뾰I�V����1�ׇ n$�07���z3�ٖ����'�K��]_i��2j� :� � ��>�Y{�ol�/�:�Q�����/�`6>7+�*���<:�/���E�b ۑ��B)�y�H8�����O���˛���0���(��q����t�䮔y�X�H��8=���s�6�9u������]���PLU�^��%Y뉒����J�v=�X��D�t&3OxM�F��1:X}�9��8����������f�c)b9�����4Ѱ�Hd�RSQ�+�4ܲ� ����u�� We�E|hG�y����10 ��s&�hI�'�r��������R�ȋlyau��ZJt�} [���}t�3WA����������|�)qw�7k����A\�BE��b��*�l5���R�9��m��V�L?���w�΄�?[U-��I�5���/�φ���K�F �j�£���C��WM<{�Z�l-���������Eu ?�~�T�fVN��W�@�S-e�k��� t捉�J�!��,��1-����\�Zf���;���f�z��EeQ~h8�1�(����t�7���dy�3h<%�����/0���Ƙt� �@������ԃ��](�B��ѯ�F�ƞ�R�hX�ښ�1����I~�n�� ^$F(*7�~��h���V��>�5��;��F1~��{��zk~]���<���#F]��]�?����"�c������ڑ`��x=� �,��>�-�j �:�9�^�ҥ����KG�rk7T�n�K@�/x��|�y��adZ���C}fCz4�"7��i�}�u�G��̽h]��t�O;���d}F�*��3T[x�A~���̺�?�O�Vp�7z,ڈ�����;WJ��6��N��Mt�E�ɩy^����-��>8O �y ��0b�0�3���X�ǚ4ns�о�H��_7�u=V/N�����9���*��|'���#�����Szh��_z�1K#3Y�(�´}H.��b��x����� �Fn�^ώE�����^�Z��vd j�*�"��$,�(je�L@�j���Y��Ү���\YTᷣ@�=xH���;�m9ئ������y�T��[��}��{^R]��4�W���4B�^v=��A;L����$i�b�$���E�x���#�j#�N�n�h���'�Ԉ��R��7��h��@�����`Ί�c� {+>nX.�7�=�pN�d{W8rc�Q�6}8E> ��LY�af9!Mwb��3q˰������3l�i�Wmka�鵓���Sc�6���LE�+����Bh8A3�y?^�$���A��v0 ��ۇevx4���_���yaRp7%|�m�?1�L�}a��pO�h+�"�+� b��|���E$M]����:�Zi��/Ei���?<"t��r�}l���xz�Y�iHd� �w��G2$�{��N][��*->v�&���!��st}4���>�$�� �2N����~���'��O%��얟��rv���M�_���t�.&�L��"�h��BP������}�u{�d�7F�ݺ�@�|�m����8��A�'o٦h�5^�����u���RA.��عi�yk���b�+�,5�c|�zi��5X-9�o�pk�n܊�:OV�ҍ~��q�B�������%�.�7������������-����r)]_f��Yc�j�����%���~:8[�Ef(�%���f����Do-6ۇf�睾*In?p:��ZL��I���������I��Uq����e;�+�i'��� �zA�pj�a͟��C�l�,���V���]?z.WK�ozR�Zq�Ǥ�k#6�! �$�j��|�^!.2�5Z���7�=����T�ac¯�SA��<�[n.q���������p��G �y�/j��)b�8t�{�ᘒ�����#$ ���Ɍ$��?���d*���^)������)��(��9k�|;x���Q���X���~{��H�����5m5��]��-�m Vն�^�L��f�jO�!q�� �~�d�����1�a���P4�}���J�lNE�穁1L���a�� g�FP�@��?�p��͛ wH��B#1k���0n)��l �vY.�C���>�?χ���Ȋb��9�<g�F�ڭM,���Q����E�9Ʋ��}�(�{AM��:*�����@�Ȋ�nw�LV�qɿ�־�����)=��Jvxz�m�y�G����)C����twL�����!+JZ�0�TA�{�liD ������wG.�2,ǜ+=�W.0��l���vmS�����a&�C��t����?Kأ���7%�������cC3'� ���0Ƃ|p��R#Ȝ߫�e|�5���Kv<�فF�x���p�U��}7��·ƢR2���^[��d��-�����<����⧈�1�(��V~�(m����!�/�y��p�1��W9�S2�8��T�tŔLo<~+���-��K��U�9 `A^�Ȳ�鈈�CR����4�@�ZC��XԃU'��2�o���G����c�>�����9<�fx�wτ[�'���kID���u*/@ꘫV��o�/h�Nݜ�ćې�,+�?Ъ���������>�q��[�XϦwF�x�As��H&��`)����÷��|י���Ѳi\���,>]�7��"�lm!�pԫ+1燠��z���V����PQ����l�#U�b�4L��|K�m��B���m�h!�<l3c�'��Aۙ�(E֫T� bDj�/˄����ɠ��l^��1@Ꭻ�����ڀ:=�Q ��&G]ͩ�Y��<��+� �4kC�Ca8�F��p�E�Ea���):��a$B!��ʙR�H���C�� .�jO���� 1j���ڐ�/�o��Xq[�7z))U�)�8}I6I��#� m�E����@}\��fP�@�{��ٚ���Á�t��S���g�T���_�ەB����*,�%�]j� ��ij�,�onT:�хh����*���L2���P�#�*4��!h�p������A�u_f+.��-ׅ���@�i��������Q�� ��U��px�蜇����j�m�� �A�ﰎ�S��vDԵF@Mp�Oۙ���,��q46�������< �ij��Q/db��-]p�g�af�'� ]�z�]'���9ϝ���X�ӆ<�k?��R�luu{ ކ����{zo�����.�5__������,�8�z>5�EѺ�
Static task
static1
Behavioral task
behavioral1
Sample
9b41a734dd59b55123683d4e4d2d572d25a355508c10c57118c7341542b17f37.exe
Resource
win7-20231129-en
General
-
Target
9b41a734dd59b55123683d4e4d2d572d25a355508c10c57118c7341542b17f37
-
Size
3.0MB
-
MD5
3bf96b69185f379bc7853304f53686ee
-
SHA1
12bc015d371804c042508f486f2c9d176c87b9f2
-
SHA256
9b41a734dd59b55123683d4e4d2d572d25a355508c10c57118c7341542b17f37
-
SHA512
062250e85fcb38bb7f3c93e251c1ba1913b3032442484b2d531ef3d75549354a3dbbba655fa460d5bebb0e403b48d08cd64f98a82192c2fd0da2ec0c4a78fc81
-
SSDEEP
49152:LjCGrloMaxixqYnqFvrwrWUXeUOLmyF5fcDbr+IfCAg4PavWMuQyL:LjHxopigYnqdJKXAHePKIfCP4Paof
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9b41a734dd59b55123683d4e4d2d572d25a355508c10c57118c7341542b17f37
Files
-
9b41a734dd59b55123683d4e4d2d572d25a355508c10c57118c7341542b17f37.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE