�n��)/^cu���x�Z�2.�Ҁa�b+���^o2�'�~</ .|����UW(��K��M&A3���h�Hħ���0�#d��� w#�4���CA��ď$�@@w�m�I�����7��˝��+��KD�`��+&��Yܟ����n}�$T4��$�h*`�=^i�.H��(@ٚ?n~+>���(z�e��fL �v�����zFą��|ޫ$OA2���A����[˰C�.��ʶ��y��gN��`�m�ѩo�6�<��l����O��[˰3?�]����=���V���!Mw�ڶg����c�Na�--F1eϧd�3�m����+|���=S��:/�5�7�������I���"F����� -��aN�̧�/�!f'���q��~!اގgMstp�Ù���p�z��k�(��%sE�"�7} K6�����d�Yb9ui�AW�+�g�AK���T�R����Pz�y$�� p�g��� ^����� c�gW������� 1v�E��*�[=��a������:�+����nd�֠ᇯ�3g0k�^3l`yv#�����s���6��~�]yIv��(K>u.��J���䙓:U�<�H���O�W�j�ă�#q&D�M�ғ��*�M"Uo:�G㛄�����}�@�XF'��Z�6IAm�,��A�a[�[F�m����X�w� �А("�9�Ї!@����y{J{NhLI�\,�3,��D���,+�Լ�=:�/����NGs�K5sC�Ž� ����_寛<�,�he��N��G�t��ј�n��!]��"�,����؈u(H��ٲ>����6�*@)�+�L��Y�{q�Z8=��B-T7��2<�s(w ����E T#�H���Ό^�U\Bwkg�o���Τݹ�0��IEד�B�<������S�9L/��0������t2{0�I{���Mu��W��pi�]J�M)e[�=݀*��bqѮ"p����T&��L�]���Z�&V��-BcHE� +p����+��~��Vq��(�.y'��������H���,�Û9�xҘ�»�����?kVG?0͂� �����#q�ҳw-:�A����L#"O`SY�{��9�E��7����C�m�v@jW�22p�c�B�8�X+�� U;L�jۧ�b��)�xN�\�u;Ѧ�{�ћ[lu�-� r��#�t�Z�7�ҦQ��;8���@#�rf�}の�#8�����˹T�9�W>�?m�"���TDe(�|�rY\�z*'��2�[�QY�u����V�0�F盈�3۠-�Ջ=GFV��Q�=z���E�>�Pw߿Aʸn�8� ���8��kܸ�i]Ή�V�� �ĺ�i�d���р�w��Q�蹾&�[��v>B�աfL⅝/S�"e�h ]�Pmw��@zN ������� ��{�55��#a��)_l�_�c���ݏ�$~��p�Ў��p�v�e6�*�̯ � ��ƹ�Y�i�U�'.`'���o��;������A�ua}/ �6��8%[���Y�H8էy=x���^Z��_+��e#��.0���3������� G|��j��.LKP9�BH�P����baH�۷�OB�����5,G�-�� ��ۊN������1�]��}�=̽���Q/� �X�d�X!�:��� Gp�؈S�7���4��qp��+�;��&\�_��i �r���." �҆���!)g5v}�����K� vm�ۼ�"=�A��f���6$��<���<�wF^�MYc[&�1*3�okݏ��b�i�v�|0�����W����XW�_��d���\���Jc�4�\���3e���͋��\���]���� I�'w������̹�fǼ��"��S"�K�+���XR4���k�<E#����X�|��y������*6w�<�(F(��io_�]��'��|�v���гk;ҝ�nZ|���@=���SH��>y��Oǒ��L�S)B) ^^����Ll�O9j��˅��B�BC��K�3��;���x��jY�ɝ5�S�$�+������v3��~4{Z����@Q�3��S�sm�����b��o_oZ��ז��"�t�T]-$o�������e@q��9<ჾ��?�(*�� K')�� ��Q�Α�R����x%5B��wzHĦ=����Ih����%�vNQMp$9.oҾ̏�0�f1�G���mu�9�PbC�xo�8ᚌ���_f��h�ϼ'S�],KAÛ�ƕ��R���Ȟ0��Y��<o2K G�i�,�EC���;Ӛ�dj=w���t�u���_�R{�'����+4�a�U��� "a�����Ʌ.��I\�]�*�mH�0t'��7�S�.b]��� ��������9n I��r�l�EL��c�'�ƞ�����lh*@�S�4�Ews�Zsq���\YvQ�f��/J���U В������@^�!Lֲ��,�j}c�XH-�.&c8�����D^�h�KIk�u�����k?�f7��֥��;e�.M̖B�?@y�*�ƥP�j��x�o�O�l3�������3�u�s����Z�k/OjX���){��ĉ�oy������vJ,ri>��f���лD�l���i��cx��RU Ldlsr�Yk������n ���Nd��P��Sgb���`]ꋌ���>���2� ���o�,Ú�P�r��.P���?� ~2�ھc������D�O���B�嵖[r��J|~��)���s����(1����둈z�A�S�E���U����Nj�Pu�y�r^݈/-��m�'rdE&"������6 �|ʁ��M��T']tN��]�3x����O? ��tN*���30� �QńDf��cɯQ��C�e0�"��s� �$���ZbV�V��Xgێ��� ��epXb'�S��������/�)�M�ςޝ{�~ޭ�^�Kˍ����*�"� ��dy��&��0�JgJ�YJ�9(8��(�º\�4�L'����|��^�T��V&����k�)ɋ�}6�-�_FU�����r��fT��~�6Ao~<u_�O����mK�~�.���IO��G����Ym2Mz����9�w�F����=�5�%vz�V����� ����Y�^�� Z�2�'a����U{�m{ʺ��v:G ��u�LOt���:�ș��d]OJ�A���*��#=�+3=����`~�P]������������ߤ�.*ÿ���)+Y�Q*'�n]U}���y�a���a/P]��X֟��̍K��6 �AŖ��Ի�z� �ɚ$H�����6������=^�w��\"�H�1_�h�j�=<L�̩)��f�69��.�ߵ���P��5����?<��3�ri��և��m� �g^�0��������]��ܞ#�!�S8^�k�m��NQvo}(�mȂ<�����;E�܂�4�uě�T�N|�X�X<E(�zD�~p��%�fɓ�+>,01�T���~��uH��YBn͟���}Z��5��6�şd���_0���'t�w\��a4���s��j�r�����*��2�d�0m4h$K؉�Q>�vA�̼�!noBi[Jj#�=�yl=�]�X� �_��\�:-zy���/��u�B����1�ȯX��U�ޣ�� �4�<P ��"�������k�`} ��i���~(
Static task
static1
Behavioral task
behavioral1
Sample
9d0a1e4fb032884f7ce221af27d99172d72568a14bbf33af7f4f7f1c7cefabe5.exe
Resource
win7-20240221-en
General
-
Target
4621a40585763d9edb2f05fecfcac1bf.bin
-
Size
5.6MB
-
MD5
0950e11563600b30346cb0fefa39bbf4
-
SHA1
af032ba47ca9e37cfe5fe1e041050287dba242c3
-
SHA256
6958fefcc149dac508247ec22336083c46c5dd55ae805a5834ea02532bc62653
-
SHA512
725c34bc610f3516870ac713a19d1236c58eb61dd902134f1c2f89c5ca7330f6e986925ee29ccc14f5c6e404f94909e8b2161b6fdef935ff5df670bff17249ca
-
SSDEEP
98304:tBRzPjHW6Lix3N0tIjaKj7BL61hPha8P6XASGlzy7ULq7w4c7DBFPqK4okvJUcf6:tvjHB+D0tlKjyhPhb6SVy4LQzCLgdhpC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/9d0a1e4fb032884f7ce221af27d99172d72568a14bbf33af7f4f7f1c7cefabe5.exe
Files
-
4621a40585763d9edb2f05fecfcac1bf.bin.zip
Password: infected
-
9d0a1e4fb032884f7ce221af27d99172d72568a14bbf33af7f4f7f1c7cefabe5.exe.exe windows:4 windows x86 arch:x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 79KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 20.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE