-�4o��}G�����g�Z2�W�nI����a;���ox=�g�hT3�u��q�l���!B`frk>6�N����C�S`��1 @ >j4l(�8)k�~Y?7Mc�nڠ"�룭�B�jpeh� ���捨�f������^�B�f�sǦ>ݑ��[]^���c\>W�= Q�^�cu8"��g|瀍��&h($kjEq��;���10�+1M��ߗ��I��}PH��J����(��{`�gQ�j�?�s�l���M�u��(�E�u1F{�x�2Z x�:�ثe��b��R�O����W5�S��͇�@���6��^����������&�u�'v}x��"0"-0��4`��?����c�\&��G �I���y�����V�9��z3-�����X��sz�����Σ��KW9~M�=>�<�?��%��V�F��h���,�=��S����RÔ���>���:�������x����� ֪��j6�j9��,e��FC��������uu��oR������h/��� HS#bf��u�;����{"�wZ����\{���[WZ�eR�v�,�c7���3A�V)�Z��z����F�P��G1�@e�p?J�jœ�Gws�S���`�2��J��\V;������˞��7�9f8�3Ic���S<�����s� ?�S@2F�cU�ьvZ�D�z\ "x�o/FE�ET���5�����ԼB��xhH?��%6��a�� LHN6��cU(�İ+��I����5aG�C���������9i�EzbZKB��R� ����A[����p#R�"�{�s�$z;��ا ��4n��S��X�UUeX[�2��E���枯"�t��ܝ��,}�Y�g���NbVN��cP�����SY�홍�� ��$�ɬ�� �Ld𣡉��8�.�Ƙf!���Zj��xKD��5�Z'���� � ^P*X>��ՀP�2'6&2a|�=%�R�ؓ�O�������}ZP���_���k�p;b�^�;��xS�=}'�� ���cı"#�lj�ꩬ�~팮�6H��z|���+��.yN$Y�����G״�/��:wTk��X�)��0z/�� �2�m����k�݅�D�6Z�8L89��9c��y��:�R}��.L7��U�6p� �Rf~��w�)�0���Np�)h��vl���m�a�H�:�������a���ɒ{P8g���ˢ.Ϸ5�uKCRK�lwyʂ�Z�*���x*U*�*�\#d���er�RNMƈG/�沗�7��N? o.���>��q����oy;��р����fw���D�I��h�q\�^�� w_)����:6�n���x.�\x� P�OZ��������v��$�#�s����w#@L{j�y x���y�k�5��L����:�i�ꕔL�����E�[�*�1�r-x� 4�K_C4{h�h��a�����/`� �j{��~A��tH��B˧��/�/�lLzGqXT@Ι��F�z ɋ��ŰW����|J9K� ���CªPu�y�|ǹ�,U<���:������<�Z�z,��u��u� ;}{5�Ë�qsaƤ9�F,�nc��SN�| a�|dX�m{x��2����]مW��,N�����uD�:� ���/!�2q��H� {�+}���~�naq���� ZY��=}�ꅨ�oY,k�3~�Tg�$��؉�ad�~5���9�����ֵη=%�� 50����R/{���=�3:ͻJ���P8C�W��ȥv���`��K�Ti��FiK�"X���r<��gV�X%�d��.țp~��*����]j����$v2v�sݭQR�(U<^���a��%lb,�0��g6Y�JV<9*>Ԫ�dp����'%��tHx9�iFL FK��0mV�P���ay��+��+]��e��Td�o�X�V+WN������ �[��Q���&c��J>��{�+�<U�F��mnϬN�2k@���>^�'��E����6q�@��[�|@�����]��_���E��(R^jDXXL��.� s�; ���ʁ5�P�ZyYnQ�%�[�72|{v�kw䔼�O ��Y�Ep-�H����] �T����������p�ߢ_\�S7��sb"�?>x���*�ua��zo����'w�����GAs%��(�H���)���������E��v�����_y�=j"0R���j���!n��;��ؿ�Β�6�Z�7�k���M�δ��=��W�m�����⩅�[�(���a�"<:OkֵS�k�C+� 1���%�2v�Ӿrt6gQ�ԁɖ��KLr�V�����.8Of*2�ϔ�uܡ@Ƨ咑�QUy���@��؝�8#l-���n�Iڼ�?����g`q��18�It~���[>�7V��.B��R1)�����dq\���B�V6�7��6u�5�O���������l%_�V���d�s#]j^R�6X��~Qr�HH9�l!�t������ܓ0l3 �o��s� �M�Ċ��&�D��{d���:�f�mU��.#d�������M��sZ �*����w$*��KH���4�n;�k�{`�V���D�WX��t%� �$���UH`�q_��c�c��V��vV��c���J�G虛�����T&��?�����*�p�vܹJ����5�9}�V��һ���=~���t�0�7�/%i�%�����| 2�[��jS�=ryd�qF�����qs0��12Bu��L��>�^��y���l�/�`_~t��V���,�-m���-j�n߅���͵f���l��e�밃�͞h��x�/?�=�nM>ps��κ����a�$�D��������ˀB�Mpyk� '�z��S6�_�U���;�2t�x|�OAxI�r�ӗH��y\ӆ�8���Z�,��<X��~*Zu��J�h� �1 ��g%�2�KJL � ��2�I��U$ƘAy��f��Bz�A+�AV:X}z���"�F���*�̋�m���,��ͮ���ND��4o�?�ˊ�d:ˍ U>���:okm i�
Static task
static1
Behavioral task
behavioral1
Sample
9373eeeb7d7a9c065afb641da6689c9d1982e949f6b6e5d7d228fbee397b83f0.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
9373eeeb7d7a9c065afb641da6689c9d1982e949f6b6e5d7d228fbee397b83f0.exe
Resource
win10v2004-20240426-en
General
-
Target
9373eeeb7d7a9c065afb641da6689c9d1982e949f6b6e5d7d228fbee397b83f0.zip
-
Size
3.0MB
-
MD5
e75db1bb62b649d248d7696133d7bed3
-
SHA1
fb6de8339ea911354215470a98387ea3c4e47261
-
SHA256
db1aaf575d982c2d2326ef8731d7960b7f0cbf3a70c19d71d4a18aa96b159be8
-
SHA512
611828631425e062e2802ee7dbb36b3f7a9eeb1798d8d169dc716b0072adf99f48c966454d2be95839e35194cd141f73e61c65e12416bc82967933e8c17033f3
-
SSDEEP
49152:TPS5451yufLFFFM+ZIBbMIQ5Tb4Zu7Go08gN1oB0sX+z4kPQGoJT0mc:W41yuDFFFM+wb3w4zo6vEuzFEJT3c
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/9373eeeb7d7a9c065afb641da6689c9d1982e949f6b6e5d7d228fbee397b83f0.exe
Files
-
9373eeeb7d7a9c065afb641da6689c9d1982e949f6b6e5d7d228fbee397b83f0.zip.zip
Password: infected
-
9373eeeb7d7a9c065afb641da6689c9d1982e949f6b6e5d7d228fbee397b83f0.exe.exe windows:6 windows x86 arch:x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 586KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE