���1���U�R�-N�e�{Q���Re9%1�E-�O�����C,ҡ+�]�O�!.G;�T��[�m͢N*�;�������(�¡:����y+�I�~M7����Й��.@�A �۷�sfS? �剪o�U7�^p���}s��M��sPxfH��G�j�q����P�)v�S�ۑ��ݶ��4#Q9x38�� �R d�1ڑ~���`ν/��H��%�T3S���!�,�LI���w.�E ��gA?��S�'�_��M������O)�%/|5���T�.j�ʟ?��[4�\���EH7>�(� ���j����!���I���?�(Y[�ŭ�[��_��[�$u�Wn�,US�� ���h�_Z3lIN�ߝ��ݖ#�'q���`r���·K����5[_�Y$\�=N�衠�����pTm��>]&��e��{�Lly����*j_L�<:a\s��g�D��R�ӝ������|4#)/`�n��υsK%��݊k0BRS���[�i��BT��A��v�&h콞�fF(����}g 1��Y7�Wu��� !���j�pq����A�����N"�����P�'�eZV3���Y����8��b/�ٞc���v�w�4�M��ȗ|��ۏ��Xv2���<�[Ӯ$f�Vbs~��rJ>kzk���E7;�ٹ�7�)�ZB�l�I&�Xrm�@j��k�=�c��k�����9w�/���� p����E���}pS�vT���9�"��� � l�1��� ��}=|6C�-�d*��s����Eo�����Hݠ &���B��q��l������x�&�Q���1s~6H��� =��[^���A�k����{��&� ����wDM���p�����8����嗁�'Q��Z�R����^eK�GJW�J��v v��&��S�t��6�<�@������/Y�.�v\S� ꎋ��p����U(�>"���J���ۇ.�v�-Rr:��p������'�Y��Q=�A�-r��I�/���nQ�ՅC�'�7�.�7^���SAt���L��?/�! {���Ml�8-�'����u@Y��'�7�C�v�?���Ζ�)1upm4T�!40�w�n4zĩ��B�t��!�$Д����a7�Pa`$.y̅���?䫐����`�����*����<>ߺS��ó�dGs���.ԇ�x��q#!?ݓnܡ#o��yv'pƛ����w ܲC��?q�V'�� �"��i��XBz��C� �J�Q����P���j��|�U����Pm+�i����Ar�R�J�&M���Z�Z�����E�f�D&wL8���8�(�����7���g˾^������������6ح�jUz�"�0�����0hv���i���M����Mq4����5rAKe���� G��+w�ڗξS�"V���U^�hZ��w��Œ��������l !���ß�}J�`�W�Z;6���Xu��S���s])K�m3�����O@���^�����o}߱/����ۅf4Kf@�����p(`L�i2NsȘ3K�1���Б�i���{T�#V%����8P����h��W7�y�#Z��V` ���.*�`�ܤ�!�&ʰ���>MdH�l��|��rWx�Y*e���JtmAj�U ��Vc[���9���=�� �^�a�O�����'��ɝM��<��ίk�2rmx��;�)���i�bR�a�[��,��s�:�n[ƹ2��e�G-NU:�5,�c�5���r���α��ڟ�KLXq�}K�MH�g��%|!}vn�����Q���)۔�Y�O������Ŷl��wTE��`������tj�&~�LŃ97��"w�\9������J��kRhIYj&V��HE�'��,��Ծ�B2� P7��� ��,�w����A�(�Ծ��bHR� VS��:��P��t�"︪��2A��3�����E�Ҥ Fa��A-��)���AGD���`Х��-H;��J��S���:㨿w�����_���e�%m�CO�����'���g��L�2Juæ�I�9q����}�6؆�~ ��C�Dw��P��1�5k�<�7� �Z��̩��+N�-D��#+��UÙ���i�tkO�W�BC�,3`�!/E�zPv�w�������M�6�ׄ��9�6TX�5 Jq�������� x���N���S��o�-y�hf,_xֲ&0�yy�?��NT_Iy0E�����T�^���ra�q�i��a���4���q�(D�ILx\6T%S�{��J� �d�$���'v����������_&�(���m,y�_������h�Аl����RsM����sԼ��$Q� ��4]���(�|������ ]�1�˭.�`)}P����Ag��uok!�Dn�-�Ճ\'�W��ڸq{m����S���+����6�ĥc{=0lm&��G�4N�_��M.�3al�#��4������{6^�XC�Y�vۚ��-$!���p�и()�k$_9�v:��y�(� 4�'���P��`�mV����\R�f8��I�:�j�]'۳�$�U�uD�ܺ��oWQ�|��JW1@�V� �Ζt ��u tˀ�i�ex�Ǒ��ī�3a�s:�IY���%i�K "|Qޫ֔�pѐ>�$�����y�Tdn�o9�� �>L{����7�9!���r[ar�#H�%N[n`(U�Y;��L��c���@&SJb�q����t�k�7�3���* ��~�p���F��p܄��������Y�B����<<��b��*=�&���c�cb\�i�E�UDq��2=�T���fQ��������ەR���A(�:Q�� �f|E��w"�ޛU���S��̀R�!�Oo��@3-�9R�'�jP����e�xl/YO�Ø�a6���k34lއU����D���7+ Lj�:q�yt��+�ϭ�z�,��h���|�� ۻ� ���. #�>g�ֽ�h����d��b�M>��x���H(��3��٭7�͒G��� w�k�Dt�㗸wLz��u�x��t���F��=���<���b
Static task
static1
Behavioral task
behavioral1
Sample
6cf1df06dc076ebe0342f476a1ce4d96cfb640cd784e8f1b70b6fc2586414263.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6cf1df06dc076ebe0342f476a1ce4d96cfb640cd784e8f1b70b6fc2586414263.exe
Resource
win10v2004-20240226-en
General
-
Target
6cf1df06dc076ebe0342f476a1ce4d96cfb640cd784e8f1b70b6fc2586414263
-
Size
14.6MB
-
MD5
f9a34f9c672f831c5898fe9a4a9e34ad
-
SHA1
57810cf2e21035038b54d898173731ef13823f5d
-
SHA256
6cf1df06dc076ebe0342f476a1ce4d96cfb640cd784e8f1b70b6fc2586414263
-
SHA512
1dd2838315841185ab89adf7b53a735d6113827a9b61cf1428c4b2a1aaf75bb838c3c47558e6c47e1433689c80fc328224400cd50826bc2335b3160b3b90db90
-
SSDEEP
196608:RGx8sHLDmin1/iVtC1acJlZ/dY8o+6AHun0ejyX/fT8X7gDd9PyeOSWk/CeGjfp:EbUtCBlZ19RuzyX/r8rgDvlOdk8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6cf1df06dc076ebe0342f476a1ce4d96cfb640cd784e8f1b70b6fc2586414263
Files
-
6cf1df06dc076ebe0342f476a1ce4d96cfb640cd784e8f1b70b6fc2586414263.exe windows:6 windows x86 arch:x86
619ea37bdfbff7e675af72540c0fc653
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
ole32
CoInitialize
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.?So Size: - Virtual size: 12.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
..;O Size: 1024B - Virtual size: 876B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Hw\ Size: 14.2MB - Virtual size: 14.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 394KB - Virtual size: 394KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ