f��r0b�G����ZʜŎ9�-A�I��NM�[G��Fg+iPrG��_�E��m��)�̹�HL���z��{m�F{���w9��ڬ.���d�IE(����"x�Lc�y��y��L�<kϝ{��D���K��z��/[����b:Vy�ߌ^2)��E�W:y�e�+����C%��9X��LN��M�Ez�������cF\�M��Ԧ�l����!g7R�bQe��6�}?�eC� 3f5�_��^�b������w���c"�5SaWKV��ܲ��~|W�Z��C��D�o�.��>�����Ҟ1�mTڏu���P멩`�m����Ñ� ���y~2%�6�z����]Ϝ����a��&���ۿ/H��&����E�cJ&����Pj���ޟZUi�]��gIU1(�k>�U�����^�%��ԪD�y�)O���;��U����(��� ���҆�K(�_����c�{f�)&��@��@Ky�����iok"�K$���%�쪓�7y��ߗi܅!���yd�)d"���/ѣ2�=�1mcPw#L���J�"o;��сӪ�WW�Y��D�:@- H�{����=�)�D��{�qfF�m� ��=ν�w���Y=8�hyx[X5�z���������˕��䲱�{&��?#���+�}9�6~)��|ө��� ��{���q�G"���^�m�\)��f��H�*� BDi���$�����)idK����`��i�ů��_� C8}~'�U���T~W7�q��2��F?j���:�=U�9Z1����7q��r`4$+P�/�쭦mh�,��sY4t���b��D���<�&l�mٓ�; nq���_[�8Śst�{g�i��Y�b;��h�B��7)�75QwGX����N�S�9�}���M�x�7��rq5�.DX�;�_������:��cG�^L]��]v�Ms�F� Hd9��ч<Τvd!���H�w�: ��/�p`�Q,-а�L+��Ź;��qmb{s�%L�S�7z߭��ƆGQ����j��c�T���*u�P%#5}MmV����%��B͜c����O+��v�����(/�>Z� ��*�k�CF���D:��pʤn�G�r�a�=fD����v�_��Ǐ[ d�xE��S�lM�GR�t�f9#Q ��z�C<�yl����&��@����ò�*#�'����)p���r ���QJ����A&�V��A�|����f�O�M�4�_�W_�B���K1�z�лԬ}]v�̄�&�(t�Ȝ�N�IܐADã���$�TO��b<�~ai��"}[�kt2 �)]�3Lӣ�'�}K0����z����'�)|��W5��y��X$].�����2���C�oC���_g�* ?���|�f�~w|��=}�ף�#��x}I�0�r��I�b�`��Q��B�w���������r�\&+�g��+�T��]v��쥴��" ��.�_Y�u���J�h��E{ҩ��S��-O���+R&�{�g������֟�K����S���Aw�q9>r]��nBNbP��T:���h��.���c�+-V�5mԑE�G�8O�}��1q�ou��ܭO�ǀ�I-+6k��!�A��S��|}�M���o'��ֻ�l"_�+�p=C�{}�"Ӄi�_��;�ܢ ���߫E#�dB��#:�����Q��_���]���۲K6Xt�8n1�,d�ԙ��f9r�|�q�/��h~��;�j0�����t^~u�0��L��4�V���'|N;�$��5�Ml�$aӟP�帮�i<��$֗�����_&I�m�}���s#&u8Z���f�v�b�a��bd4.�o��e-,�b�7o��=k*��/ S�?��@q��T�!����nVJB����M� h"h���d��8�&���d2ב��cHU��,e� �6����·%���(ջ'Z��µ��~������fC�qe�[e).��X��?F����Ťs��gdP�v��p�;�����k{�a 2<+�OvU?p݀]F�Y�����V���i��'߃�M��v��� �mX�J��*���1>}��Æ�B� �4�u�.��;�զ�D�B���3T�h�_������(���[`V6�x�U�P�_\�4� �ʩ�29H�Ʃ/�7�����ߗ![��ZTw�j�M�Q�����v���Ҷ����Ё�X��v��r�v��/ 8��c�aY��!�8×��������/|P�⧺>Ȥ��*�;%�_S~��Vf��A�S�wXr �&a��%���Z �Ɇ��%#<-�Yz.��r�g�� ͪ<��l$��ЍZ����Ӻ)��\.�{�s��.3T{��pׂ��(h������[#A��iZ� �qZ�qEn}��H��t\�@Kt�|��j?j|?�;qg��x��a���_� n��n�i�����Ks}5�S2��ĿA}�� jP��_�v��4-����kZ����#��1�_�f�B(o� j�g?�d)#�G�u�g�Ѻ����,u�C��,� 2���pܬ���L�Ƶ�;�ȁ�����yNw ������zKi��Φ:�L°��P���P�ݕW�\A~G� �|6��(���D�;"w:�J(�&���[����uw]`o�K(�9�'�/�b_�h:p'���_�/B�"��n�,F�D���)D|FǕ���t������8�+��-��0��H'�c���� 7���^�aa�� ��].|����w"r.>�a�sTs�!VӳK�Q�B��ZY���R�`!7.w�`{ww�ԛ�g�J[�83������P|w7��v�p�ܒ3zw|���1m�q@qQqh�Ev���PtC2,l�c&:�������n��X-�10R� C��R�|O��y*W��Y�R�y���w���� Yf2��ßaS�9�t]n����K�U12WҨcc �k�>6m[gz]|����:���q�@���)�D�5�M�[iP�)ZY.E�#��ܲtVY7��/m�n�쵢�2��n9O��X����=N��k'Qi��9�yy��o� �n�Q����q�?b�az���]׳ؠ����[��4�� M�7�M�&x��Vt.��~��pU�H�j��bt�����-��m�CT�2�$��%1���O��g�"`���NN���MZ��G�B(B�� �������Yހ���;��P��T��b��!�{�T�A3[�2f5���H��-J���_뎌���[n�h�b���w�wT�@�k�R5��,���ϓ�S�?��T�M�\ĩhPZ]����Q�3`���Rx1w6���T���9�o�Tj�i^����!�6J$��kEL��"IFZr p��>�~���������#y��ndZk�p��`U���B��&N�elj#%��80O��̍�(��7w��Q\�Τ���1��N/a�[İ�UtEl}e]�4�3��6�}��:<F�N�h��N,����}d
Static task
static1
Behavioral task
behavioral1
Sample
9361a8d77c99d182bd3f4b10c30bc2df11e94c1043420a60d4c04d86da9c4b74.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9361a8d77c99d182bd3f4b10c30bc2df11e94c1043420a60d4c04d86da9c4b74.exe
Resource
win10v2004-20240226-en
General
-
Target
9361a8d77c99d182bd3f4b10c30bc2df11e94c1043420a60d4c04d86da9c4b74
-
Size
2.5MB
-
MD5
76b432be4078467b8abdf0522c020213
-
SHA1
8a84396b7e5100ea2683f8258940fd12fc565e97
-
SHA256
9361a8d77c99d182bd3f4b10c30bc2df11e94c1043420a60d4c04d86da9c4b74
-
SHA512
0ff44b3b31170f14668e8d032f7f7b49b67e36a44c246e223022b6c943cbe5e041e6fd8b779ac0f8a340ac639d90bda121aa36311095abad122591aa4df38ac7
-
SSDEEP
49152:eMm0cb8PC9lt9GMGfzzCrafeRF9rILliuyAoPZWwl:jMbnG7zzLScliBPZD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9361a8d77c99d182bd3f4b10c30bc2df11e94c1043420a60d4c04d86da9c4b74
Files
-
9361a8d77c99d182bd3f4b10c30bc2df11e94c1043420a60d4c04d86da9c4b74.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 126KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE