����[��ρ��-��pA��x3� ���b6���d�#���5���'c{T��G�sFar�|!=���cnbҡ����ң�-a|�s�������2sU���� ���=G������C�8��ȆOʇi%<YRZЎV�hf���T L����&��Q�c:��(j0O�l�?b�r�H$��谘Dk~�9E�������[�QcJ�`N��~�MT�:<zH�K,�le� �E2.d��q4ůL��O�@y�H���e`%9��J�%\ �h�RC�!����Κ��8���by<��+�ׁ�(��u���͢����)��h�y��9�;J��_���"���iQIF����3rd�N� �=t(�C UCU���1�0��i߄���K�+��|h�E=~�uf)" �����\w�����('ϼ����|%�6´�a�{1N��I�`����"9���c�K�<ޘ�z���vZ8W����������r���t���m�diZ��cQq�Z!{]4&�"#����ZӖ�7���L�s�7&i?M(?.\i�A���Z�SH�� �kZj�aJnX����U8���Z��<� |�S�4i�K'ϯX���m����N���L֘�72��"D��5y��ve���N1�v��ڨh����3��vC]د���z>N4��X��������l�UO;[cI�"��DL{ q7�"�����i��o��\2���NQ-�p����'��BC�$��R���*���O$�i�e~�{��zW�gdNv�[S�0�?I�e��*���;s�^�y �"d@6���z�#��j7�`KL[�ߡ�P�:#���#��i�N��m<�K>�/�j]�ZS������`�`0�F��!�<ϒؚ����?���g�x��\3� �@��%=�S�?&��JM��>���THx�Bc�z+ɕȄ� �zޙmbV�:�O[s��~�B\��Wa`�L��u�O���q�e;N�[\I�+�sP#+t�ᄤ�y�DB\��L���������{X��]������0�5!,��;�3Fa�a�j�ƥ>��ޞ��/5f5��{=�w/� �Ԟª��E#��q����H�N�.���S��C���vv ���v�Φ7m�c�eK�E8[y=��? `+Y�U�4R��f����}t2�&�d$����M�����%�������~�<b��;#�Z�R� |R��S���fQQTu|�r�Y���*Ż?�����+4cK�.�~.������Ŗa:�x�5�EM~=3s��&�h>�К���8a���^�1����U\h��?�~�E<@n�o���6U��T�����_�Y"���D�B1'S�s$�6B+���Y���rCE�|� �U�B9�=�`ө��k>a�}~��LsH���6;�]���δw���Zm3�T���7HwXDH�{i��P,V�'�����=��넣�P�����y��t�ODIGuh����>���ڸĞ���q�8�k��\�L�.�/ԯz��`�L[����,�R]��P;�H�-0��6GEц6%s㣍��%�D���B�F~B�{�4�O��udO��� ��m!{�_�ͧ��i�����b�63������0��պ��}FMe��$N��dB �1��Rf3{�^(�$˳"���{�����Q�r�4�"&��L�4�Vh��En,&�t�=��a�>���gY]�$3��Ffz��_# �_|�4�]��0�e�����а������gW��$&���m�Rh<U�Hɲ%(� gf�vA��C��)�i)Qs<���7�L��F-�v��ƈ1��J-�=�3����^/�N>m�n��qI�-ɥ�4��ЌRFr��홢��U��p)��Ye�U0�T?�+�Ҽ��S�;��7�aW�cE@�f7'l�1ơ��+�u�Rk��p/�}��*��<�;L�6���YBx�GԮ�_�j�7�G�T�3ޫ�CcE��}����)�x#�I��k=PKh�;�OL� aF���h�����<���43�=5��HpD���#���~ F�h�\����]9R��ͧO?�����V/\���1�[�1Ө� hASr T�_O��^UZBn5_�?�o�RwG�gC����=��M)q��ʌcW�2�>RTP���>k��/4�+��~�JK��B�Dn��Ȯ����>� �$��D�����Ǵo�d��x�!|t$�7�̀�<E'�t ;,ٷV1j, �Aݚ�F]��[Ć9����"�DC�|��S� �+Hᤸ��}�#��A��x���j�?!k@�k�<v{�f��s���Z������]-`~S+d�hPZ��4�������j0��#��ҏU��g`����\�mx"$h:.4/7dw�ѽm'��t����N��8���=�X���u��?��7.�\c�wQ�z`���'��J���sI�3�5'�a컂N�c T����I���;��K�=Rk0�(�)�quh*��;2�\7���[��q��( �,_6^���ײ��'0��z���c�TV�v�n ��@�ރ���eS�&ҶX�+�<�Y�Pf��j�$�^� o��H\~�b���m�Ï�k�ea�x���1�5�hY��(zz��h����Z*8��9(I:���]���X������R�̙ �SB �u�>�&lsU���bKS)c6>f��<�;F�́��d j�_��G��2u�~*_Jt���N2V'3���q�T���3.ܜ�Nl�]z��b4@rY���ir"� [�.ȗ���������� �~"ч1Y߱Z�T٬[��r�md@���n��[�U�1��졩��Y�*�O���C��t1�b�ѻ�O>���?���\����;�=C����b��7Պ%%�49�{�Q1kd��9%���U$-��HQ�M����)����֖�M��Zre��wmN]h�O}j����j�<2�Ô�Ąq{S����J:=�> �h�m����TЌ�.����h����(��ё=��0*�����Y^>�e����d��g�����!.��;bnН�e���v�p���K23�'c��Q�huK�+kI�ЯT캮Ђ�6�ĵ�� ��M��.�:#Y���Sw⓰%2��Z�p��� {T�,ٞ������5�p���`.�^�����z���뉘�?& ��Y�G �;����w�� s��z�0�����]����������X�fl궝���\=� �4n��Nx�j�5-!n�I�P>1�/Bg���;��(�y:�J����8!�.��v���PO�'#�n���7 <��{M�i�M�ɿʤ,XlF"Cwa;P�˨��+x+x�i��������f����aXk|���GH�iD��&>{�t��8<� �������-��(�;���E ����z�Y@/W0B�pvMݦ8�ە�Z
Static task
static1
Behavioral task
behavioral1
Sample
9a695f0a3623f72aa33fd57b80b9a60e86d0648d4b58ce327a034d41f6b5dfaa.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9a695f0a3623f72aa33fd57b80b9a60e86d0648d4b58ce327a034d41f6b5dfaa.exe
Resource
win10v2004-20240226-en
General
-
Target
9a695f0a3623f72aa33fd57b80b9a60e86d0648d4b58ce327a034d41f6b5dfaa
-
Size
2.4MB
-
MD5
108c8302b2b583742790895447ffe5b0
-
SHA1
df5ab8e3e921512ee9292fa7b89b74f30d9b2633
-
SHA256
9a695f0a3623f72aa33fd57b80b9a60e86d0648d4b58ce327a034d41f6b5dfaa
-
SHA512
8a513e9a6bd059e397e4786ff85a01dd5f2f0f30b822ed8a551333100faf8002d2e6b26b40402d5f94d159aee6d66be504ea751644e5c9ce84517f4434575301
-
SSDEEP
49152:Vie/0fdQ/uH4h9m03DLZkSTLcpKg7TKHA8TH3kjetozBNLCHX0D0:se/C5Gm0ztfoRPKHz0jdzBkHX0D0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9a695f0a3623f72aa33fd57b80b9a60e86d0648d4b58ce327a034d41f6b5dfaa
Files
-
9a695f0a3623f72aa33fd57b80b9a60e86d0648d4b58ce327a034d41f6b5dfaa.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 104KB - Virtual size: 368KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE