�$L�;gO�u'�ԲϠ0�Z��\u� ��q�h=�[U�&��6o��q�������+t+!�Q��H�������~��hk�/���tx���0��`��vW��� X�Y(�=���ޥc�rT9��tn;�bI�<T�6��L앸/�Xʐ����\���]�S�c���������}"�a|�* Y��B$�~;Z��~r) ]sq���G�sZf����5^�?6�T!f�ۼ��I�č���صY��[<>�$ԅ9_{���oly�� �� ��7x�,���T!TH�� ��Z��BF�`,I[�6z�重ՎD��t�x3�9������~���Z�GIlK �Q���;y�u�v.=ޅ�������C 8��B._�r��O�]���~ �>Q�����BS-���5�m�7Dn���6w�҇�PZ��?��yJ� ��1��D"iO�CH�әmXU<��a�n��7�Ԓt�o�}����D���&�w����7���}�����]ղ�u��q��� � �4$~*�<�1��Ii@"B��u�i}ܬ9mN����Ts"ۡx8Y}�����(�g>��5B��!��,�Ow�'�9�x���6xi I4���w"J�b�G3MM#A�_i�/-�.Lq?]���6�.+�M��u�+6W������=�L.}��p*�_����'��w�ȁ�吋���^)�J�]'���ܓ�2R'��c*n�Ұ���KQ1���F�w�^��gאV댏MP�v���.���H��J'^����RC+ ��r��M3����ع�`�KM��K���\�bT3���pg���H%(sô⣪��T� �.�y�R�$m�����`|�?n�իs6���k�� Y���k?�����X;9�{=ږNK�;q9�庽��Wi��0�a0B���i��}��.p�� �a���g��ҏJH�D?�%� �2'm� �F�<�7]u5yD֑�o<Z��p)s���L}��iR��!`ija8H��$Ao���$�XL�f�:�^'��2�C8�S���P%鲲����b�����TԻz���b�|�a���!��UAy��|Fpp�E�� �I����h�D3��C��H�wA��ݽo�Si���f�w����J�G*�I�#�~[��;�� ��yF2��I�;$ ���x�w�o��\�}F4�|��q��>�R�:J��*�}XZ"���������50�<DG/��}sX;��9���P�P���\|siV��z�2lei⊚��M���`W�[��v��3g��cU�=�Dh;��x�UIs������;��V�p��\��!�������hzt�*}t�7�*�@ih�p�>�_n����ƭ۞�����.r䆇�Y��j�4ۣ�L1�6�ZfB�q� 1��wk�l$s�o��W������5��G�}�qL����$"�Z!����A<�jNsGȆ2�T��J�[��1&m�h�d��LL��SӋ��j�����[\,�ȸ�q������v�o����ɗ��"\�6�6 5A�/��K��=sx��<��p�p<5��x?�qx"=����(��n��K?��y�E��asn���SA�>|���ǧo��yJ�������ASBewPh�Q��D�c�A���EM����u]١uH��I���"q�bӰķݙ�<�8i�3�bR�ꏤ-=ݟI��G<o��&��8���v�>X��F�fj�҅��=�a��t�T��:)Fqi$�s�/��ʠ[x��u6F�P�!u�i:�z7�R*!�l[�,xQD���*j�іW� no�R�s^����>�+I7/��62����&� ���Ä�@7o��cO[yb�� �>�5AsSu+2��c��FX<�7�<��2����,*��[��B+��:3����u��Fȗyت�CK����O�{=/�6��U��<��ˮ�����}���Ma�IfA�z�E+mN���! �J�) 4!�LK���S��w3ȶ�:��ܣ��T3������v�7���_۪��}��) ���v���O�ieA�;UXG��2*� �/��V�4����6Z$�����0��m���.���?s����́��?d���9���n@��b�^ܬ���K�h �xZ�Pl���ψ@����w� �/��/h9z��)�к�p�!*�g�f��8��.�����dN�m�^_棵>�/8=�+���u����.��5� �]}�e���g�:�l˱�s�n�Oː�2���،,�<t���ϻ����z7t��� w�q�eDO��{�����Ј�����hY�MZ�ؤB.LԻ����~伔C��L�U����37d*;+�;�wr��_�o�3��nSzS�.g��D �����t�0ua�+�3(�>e�P�I8�8>��W��o4���B�)��j'�T@Ğ�8�v}������"�S�%x��(���w��Ѡ^� ��2|t�x{F��r~���υb���vf5_\Bd�g�u4�����}9����dO0���.i���s x�Df/��bzzZoxC����@N����J:���[P�ΊU��9��@���3�wR湢x����Hj�^�Mv��������W��x��2� �^nx����"^۟_W\+Y�@� �]��ͦXk���u�6�=��I�J@;p��v�m%�%��p�ٵ�dX�b>�/�t�������,%h @W[t&��E�w�`����33AaI�{b�^�F(���o�p��^�u�j9���`Cĉ����5�!�^k����,�I�M}״�oud������k�K�g���>J��q��9-٥Ss���E�����y���FU����a�%�;�x��%f�|�G�;�P�ZpO�^�����O^���7d���5���¡+����lx4ߪ��? ���I7�F��[F�ވo����E��'��Tsga<�A(��c!��Ϙj{��L����=��KXL���Ev;e�� �n���7U,Î��e��Sg.uf�_�@��^L����yneJlCޥ�0%�w=!�b�'��Y ������t>��jT��6��|9�����}z�CM6aSwg;.�T�ފY8,��qMYN�t�#���m�w���@ 9���� YQu�@����'�&��Cĝ��ˡ��+�7��6����v$�%���+%�)�B2�$�G�nok>� ����*�0�����T{џ����D� JD�h�4�y�j�J��������Ŵ����vl�*�&�r�|���D���4ϝ��#�\��F��;V��py�jA��:^�L9�r�Sx���# 2�7�*� �����zbq��"ݪ�d�-�e�/w☸ݭ�m��K� �Y�N�X�ȏ��me� �(��-�@��-�J�����Ce'気���%-��c���H��1Fϝ?����*�)U�diW�M�{���6u�ٍ�� A`���@٨g�㺍�&�|L��kv�����-�vO�4�&U^�}@�\#���"�>^)�A7��_ً Z
Static task
static1
Behavioral task
behavioral1
Sample
9b0f76ed40bbe031c20b23a2eac1b5eb5b2ceb5ba44deedc79619c1e3ad63c5c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9b0f76ed40bbe031c20b23a2eac1b5eb5b2ceb5ba44deedc79619c1e3ad63c5c.exe
Resource
win10v2004-20240226-en
General
-
Target
9b0f76ed40bbe031c20b23a2eac1b5eb5b2ceb5ba44deedc79619c1e3ad63c5c
-
Size
3.2MB
-
MD5
ed9c676e56b676c0edda2fc02f69979a
-
SHA1
951d1b6a4561521c67b2b4cdf2e9aa8ec5cbbe7e
-
SHA256
9b0f76ed40bbe031c20b23a2eac1b5eb5b2ceb5ba44deedc79619c1e3ad63c5c
-
SHA512
dfcd85d1b282cfce73d5317cd37d002fa2ebf24bdbfefb3b3a0aeb09b55848476437e5f15c3549fd839d6ccef03bc7e14a58abd492d6878ccf33644c32a71bb8
-
SSDEEP
49152:W68VSvOaHYiXW69eLlLPDkMBT3lIVZH49+GVTHe+63FaAn3+oCnVhQ5pEfK/a88:P8oWZiyNPDZT3yH49LZ63GoQhQnuv88
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9b0f76ed40bbe031c20b23a2eac1b5eb5b2ceb5ba44deedc79619c1e3ad63c5c
Files
-
9b0f76ed40bbe031c20b23a2eac1b5eb5b2ceb5ba44deedc79619c1e3ad63c5c.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 11KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 22KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE