���Ad/;��m�ij�Ta(�S�mEg�ե?ŝ�g��z��$�X}L��å�I��ހBO�4H����U��)h)���p �e�L`8�-�w�ǹ#�g�q���Hר�DS����يC =�C ��������e�IoM#EW���>�[V����%w�+�!P9� �8����8��Smh"�^u����|��!Yz{��XAj�5�[��q�2��u�J��su�3�����}QK�)Z�:dq6߈|�o5�fz��P�B� ߓ��|���ْ~8�F`�A�Y1T���b�h)���; �d�hPt�iǰS,�MN�k��Ў���+[�!7L��k���ưT���J��Э4��oJG��� ��_���������|��ŪwS�^����s�S�zH"5ƛ�ѵP�oZ2#"�_�� �H)���p������F�#��끫C�X�����q�?n4¯V��iB~� ,l��+W�o��e�"�S��Nx'P�S���3W�>�g�Oؼ�(+zW3��H��6��a��H_o�3�!#���� MzQ01�b��n��3W]ۄ����D��|m6rS�k8�>�"�^X�>Y����}����D�.5F�J���%�?a���r0X��I���ᄾx$]8O5��H>`s�{�,� ,n�*Ri�I��l����|�=R��Vض�4T3��6�s�����D�at��{泷�b����*xOJZ��u�������N(dIf�{h-�e��[lw��G��|=���"��6+}��D�CG�~�N���}���W}l�T��9� T��˾t^�[|���գ�n���W&JÞ�G��g�U�3�.ӏ&�8�T��tQeK� W�u?�o@M�Ӟ�֮�4Ç 1#[27*V�#���d1.<���6�:�$*�����~D -�x�RR0H�]6RS�K�������|�W碘����屧�?��X�3zo�/l��� u%�-=���� ��Dq�KSۏK�-o�ueŅ�����c�(c�j'p�(����Q^�Li����u�г*�n����'�G���#�<V�Ǻ�������^�A �s��e�tqDWO>3'�ٚ�5\���h3q~�#�H����LH;���/a�F��dQac�-#2V}�2�Q�����8~ՙ�X�1^���v_$�N���������E�o:�O ~+�8ꃧ���ݦxћ������A�N� ��)�8� ޱ>u|м��L#M���)�͓��Z�\��� &U��7����|<H��H|��t5z�#:���H��y9K\�k������4�K���ZL6 O!2��9�w+x�-e�0˩� ��c8'ҜC��7A���"��cym� �D�3HPU����1�8�r��|����?�����8G�KY|�4 _�{8��Q�[6p�t�>��RI�K���I��Q]�xJ������{����lA��zs���&(� 5X���$n �7�<�i���A�.����O+˓L�k�e������kP�}Zº.CQ%]zwO����hW�]Ժ�x7~�w��Р,���t�}G�<�W?�ڊs� ��Pϸ1�K2Ԯ��hD3�Eb�j͛-c���������~�� ���lQg�"�R�<��2TG�YͮD3�����+�C���y�� �$FB����{�2�(��ѧ��E}z����Y�\�фF �8gj[�А�h���������)�B+�������Ćg-����g�_�h�b���È�/���2s �֖B�1�">��� �������!��#^9=60��%�V<������ÏfdN�҇~���Fq��ώ��r�����k��$�� �����j�%Ǡ_�/VwL|�%.�0��~7^Z��i���4���=.�!]��¥#�o�j~^�[@�!c�3N�@�~������A�K�� �8`���e�w_!���W��N337��\�]���=~���3I�-�%(]9��o��o����"c{K��@U�x�_�΄���VKqܯ��ʊ�ںPm*�V�op�q&��y���o��d0�������f���6����nd�V�V&�r 5j[_�5/�-Gf��3��R���<X9��-��g�S&`뜇�;_L=���l�_dG�Dд3c���<��{" f?~�S��G~����Aur�j,�F�SV��:ܒ��7���6oL]F�A8�/�4�=�(��J~�Ο{�1fɿ8�l�E���E�m�,��{[(Jگ��Y�v{#����WNQHx��ʛ\f��[�� ���I!o�4H�#�ө�J��7��yG]������'��BJ(h3�������w�E|B�ز���qki�A&�9�\/���L����@�1Bɩ�c��z,|9���i"�m_5B�qffV�Ze.d�),Sĥ<���D�N���Ky�U�)��l��=����_�\d��$q'�u2��� :9g��T���/�A�]�ۨ��^�Z���B��2�"ڇ��")�� �Ck(�z6��.E����!2o�Q �_GwT��i�5q��by�,jm�" ���*�I�[�k���Ϣ�)t;�����ߏ��� �b��[��D+^p<�u<L�� ��c�'d;:���&U`%��a�DA֜{у�96ح���'���]�N�qpŢ�Q�yO͡g�&�p?�E�0Y�(�)B\.��>c\Gm�9���8G9cq]���ȏ�bǧ�m����D�h�i�%�/)�Sm���S���)^��K��� �=���v�;6�Ԟ�Y��[�^�}���^K�s��Hg��Bq�mZj��/.�w���Y%�[7$Gz'O"|��F$���-�vy~��a�� X�u��7�ڙS0~�ʜ�m���勻qEiO����O�`���KQ|�K5gu]T����&��Y�}75v_�E�a}�p���q( u&�6�B������ډ�g�v\⹙�7&�Y��Ei�@Ȏ%J�ݕ�s\�E�A��N��/W��j��Nvf��Y{�U��� �Q��s�mf�𑃤!!*3����5̫�������g�����D��v��J�-�X�r����jS�G=�C_.x5�]��.�(y�Ea��Z{0,��M��3cu�WޖNtS��T>C�K���S�*,4lG� ),U�q�m̟��@d�A��� ���߿�S���z?�!���ze{�P��̶p1l;���~������#/� "I�v��ҷ]�B��Q�Q���2ɥڕ�mX�y�@���ȈZ�`�m��8���&@CI|����9D�f��fO�žv��?�b��k@�C���s͖�eC�gWT�X?Ud}t�{�G۰���S��K����9�h:��%,FR�@D�x+qde��m<z����NG�(y�s:7����Am�{+��Z��.�BW��#mDk!�� �?7�����%�o���ҁ�l
Static task
static1
Behavioral task
behavioral1
Sample
wAmong_yv7la9yo1.exe
Resource
win7-20231215-en
General
-
Target
wAmong_yv7la9yo1.exe
-
Size
5.9MB
-
MD5
9cc73c6bf86e221e904ffe9f768491be
-
SHA1
f281ea0d06848f1f6172082f6da594b184174713
-
SHA256
d837531e0e8ccaacb57c24ee7ca2f4796cb3e47bd11582874460ff03fd792d35
-
SHA512
7f7ec7f38a62a780c2a8262a8fcda56796d3af968b1325d6068eead0cb9530138f49839c6c621cb5ddeea656a87c75ba9626fc91b19e0a8959ae85efeb0c8879
-
SSDEEP
98304:Z4tYneucqa6Q4O9A+pew4rsyA3t70zjvI5zzQ0vLyNxRuBBlnIgByhY:EYndcqa6Q4QnE03tejv4zzjyNxkBBlIC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource wAmong_yv7la9yo1.exe
Files
-
wAmong_yv7la9yo1.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 84KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 20.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE