�����,��&�C��#Rc�O����34��O��0�)�P��P����.a�QCE=�~�O���GZ�r}�]�I���I��.����1�pzXO�����-8i����rs�CF��f��t�.~�$���^�5�as�^5ou�P�R+3�>�Kq*Pˊc�O���^=������VH� ��O;XF����}:���)W�nV����/[=���r�"4)��dt�M��y�<Z��Z�x���X��rǂ���a>����6+�*t2,���9�[/&���49���Tn^�yLcdq�J^se���D�{��^����4�yD�|�.��(�KY%<%w�SR�a Hzx�?w��{w2�P2�@G�����55l�ɱn���v������L�W;h�IٺLx�Lc<O���$KP��;�p�\�>���<�)Αz���F|b)"aO`�R��"��7������<DG���P3�������}�Y8E��x�����I�N�P��x/���֣I`+�g��m9I$�t/���w�4�ᢊX_N�W�]�pZ.F��YO��� �%It�"�5�H#&��Mj�Z� K���$!� �w�D�B���PPn5~o�;[��T����<«<[HHIK;]{�� �Ȅ��c%����w�3��&A,W0��=*�!%���'I��Z�Z��:!]ɉ��"�h)������BW.���Mk+�u2T�$��Q8�bʲbxY�rc^���`5�r&�9��ldU���\�l�A�G���f����i�����t����t��[ 2����kE��γ��I >p�9B���lL+Oe%�w��<;�������q���dg���}��j"�>E� ��O����ȁ�E���-;�E�4x%p6J ��F tUG�/� �����C���^S�)�� D����Զ�� �*���<"9\D��ץUu�� ��~�D�W2�h��{��7��Z��m��ڐ ��3�/Q۬���C����M��W���5sI�����)�a����|tn���S>��f!�.�ތ`���%�+�� 3��tgM�v��OR%E���w�^lVѺ�8Ds|��e$�2��D�=�4C.aH���Y����\��F"�K|/�Lcbr�[�ⷹ����\~(���z�5��\�z�=��� 9���`)\��w�#����%A�D��<~�B1��r4*䈗.���z@�J�- �;��h5�����q���m�|�� ��v!{�%��J�&� �N-������X^tC7,'a��_���v�zO��nac �{"=� ���u�kB�"Ȼ^ԖEc9���:�G���o#V>&�6H0�OKu�'og5�8~yo��D��'!�Hk���Q�'ӹ�i�\�h�� ��@;������M�³i�l���L�UM�xOG�� &Q0P_*#�lj�r]Lh��V�,yPZ ʕ�������o��ƭY`9�孜�b��Se��V#��[ ��?�V��ę6��+�5T�,�5�7�"��!�c}��hy��x�H��+ E��|Z�_Q�[���d�6��EQ��������&>Z�t��$<��u5�:YR���u��}�S��Ϻ���$���[�M[����_h�c���D���x�ǟ�� �IElZmB�gl��m�ve��: J/+2pyw�H˲!c�8A�� ���ú\~(� y��6��u\^_xOc��ψu��P���D��:3:ұf�i�j#� ��+�l�5)��?�:(���N���p���}��� ����q�M��3�!�>�ս�Lt�[8��m @���6F�jW��-�p㮐f.��k�k�hf�_�ïI�+�A9A��4X��L�z����J��"c.N�ݕ�w/Y��wP��h����p����p����(b���Tz�9�G��c�ʴ��D��м)��0��+��=�f���6�~��;�n%7�)�[')զ�5�� b�,z��=c_웉�)ʳ�D�l����s���YRKbz�9���`$6,2t��%$�@4:�z��e������麇�Ql7Y��>o��b� �R�����9)��9��'��D!��~p-*��`ϳ��a��3�A B�0}aw��"8j�͂�v,�0��Ʃ빔ܢk@wk«��T���(gip�o��i?W��J�p��O�F�@��CL�#�i���[m����E3�w�xKL+�[�H/��SۋYCApp��ly�<������C TqJ��7Ǩ�P���i�r�)Z2ו;T�K���u�D�Ds����0u:q����ؽes�:֯r9���?�.���b������� �7�=��S�c4���[A�h?���D~��6'�*Gٔ�k7�䝨��,g�3;5� *(ATe����.e��f>+�8��E��g�M|z�0HH[�U;���{�^���H�M��^2���,�4���g�&p@��#�|�G�i��2&4�<z��nb���:�����uz��"s��l^�\�Q���V^�ͫ�O�l���Hd2����v���k��㝪�'�3�7x����,Ίh��7�"��)F����{�ԕ������ŀ�=��Q{o���x�<��(�(-�k(S����9Q�$h��n����5C<��e8�U�����rCgӟ�0�1qM�_�C3B<��z/��T��|@Z.�%�8F�6��x�Դ�(2�m�/z��#�^��O�V�������O�$��w�R�t�ғZK�K�NB҃��E������[� ���PK�Vtmķ�����I�(����3�5�K휸�/�N��t������(b�>^��k��;f_��Q�9L������п���_���|����3ٰ�lO���&'_�:�j�sC��� �����;�(i�nqi�s�?��u�aW>����0��X�g��"������|ӱy����p����4ܶ*5S���I����]���]ʙ�mE\ ���D��<�C;�� u`=����G�<蚰������j�<���x#�(,��r:q�m(��F6}�:��D*]�-�����CJ��"Ԉ�v��v"�ص�%� jʹVzH)�� 7t����\���'��Ѯ�ZV;�% �.���gi�h����)���G����� ��+�NT���g��uI�U̳U�d��y�5�!G���6�پ'�eԱ�G���߸-\�}�m�+�j��wC�߫3(.s� ����ƕw�.(��������̀Xeik��"�m Q ¤i6PG�U��A!Kk��� J-��6�D�����,��X �J�"S���ṍKJx�,�5��va�������ɽ&-���Έ�/�Z��� 5W_ �,y�@���Ϲ��!����
Static task
static1
Behavioral task
behavioral1
Sample
9417cc9e4898b47e9ef6753f67fa34911efcfb74dd9cb583ad4fa9e12fb840f1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9417cc9e4898b47e9ef6753f67fa34911efcfb74dd9cb583ad4fa9e12fb840f1.exe
Resource
win10v2004-20240226-en
General
-
Target
9417cc9e4898b47e9ef6753f67fa34911efcfb74dd9cb583ad4fa9e12fb840f1
-
Size
2.5MB
-
MD5
f2e6ca71518dac8cf4d91eba7ce2258a
-
SHA1
46da308e55be5c0cf5424d1a5009e3f576bd7e32
-
SHA256
9417cc9e4898b47e9ef6753f67fa34911efcfb74dd9cb583ad4fa9e12fb840f1
-
SHA512
a2dd28fa8b1c2dd5fe574db73cc522d9f786650e70427bb4fdfe030f1ed9492653407f49b7553b3e9bf22fddd027b6d052743eb5006da88265b610855cb92fd9
-
SSDEEP
49152:PLCfdsHbHhYQ7gGbzuIk7bxVY9zrUQ0Y6vA0fE8p9/S9Zgc7WDJsHhn4/Rgph7GY:PufdwLhYQ7gKWtOoK6I0co4dWDJqh4iZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9417cc9e4898b47e9ef6753f67fa34911efcfb74dd9cb583ad4fa9e12fb840f1
Files
-
9417cc9e4898b47e9ef6753f67fa34911efcfb74dd9cb583ad4fa9e12fb840f1.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 14KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 17KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE