NT�Pr?w)�Q���<_��Ý]�R�AP��e���Y0�(Mn[����T�oK�>�n���� �B�eօ#�y%3V���[9��1V�wS�r�{j���~���@x�k�A��x��3W�Ma��c�v���w���\C����]��) &�<�8�'kL{��W�Y��T��J�qX���t��� ��h7�ʆ2[KU�T�;�>Ø��5����iY4"�� 3_��0�\:o�<�s;���ih�uA �9���y��eGw��!T#��1r�@��p*�وr���9;���/�(��BQ�P3��IM,,�e��V;uw��M�&�#����k��kr���c��<�s�C���'#=�������������wܙK۔�Ғ��nyt�h ��7G|.{w��#�E:� �B�J5�٤�]��� S��7�" �N��5��'���aCk� Z�Bom\oo ���|�0?�a�Z#������.��Ix�i�w��o�);ԙ2��3��7���kD�t�����|�%���t"��������K��I��������ϞA�Y`�qЏW�L��$�>wl���%�<gNuТ7В���pK��F��;�t1��z�*/^� J�{��"z ��h+��dj�E���-i��\�lq �_�����QT$��ڊ08JX�*�����M��'����c��X�rr��!1M!]d�Z�7�}ŧ�p}���A���d9%l�%K�`w�a.��j��aFXb�JjJ�*�7G~�X�fT�����lX|��0 ~C�5��|tm���~r�H�I4h���ᗮe�h.�"���������V����c?C B��;ݣ|����� 侹C���'?&�%X���3 hӖc`��������u�7$[XA�I r�&���рń�JF'�m�h�B��^�z��q�:���-Ҏ���AO���.�Yi���V�I�_���gIEnY(� !��:=0k{Ffc�G�]�]�Bhu�z�U�܂F���ry�o�!J��r1$?!B�<�ĵ6(���p��W���ھ�"�h���?�[�]��4mu!�����{ρ��^K�ː��XH�� �� e�������%f���YR'QzN��Y��~�E����,Ƭ��_q����#b�F���pC����t 0<H�^U����O������Ԟ;o�N���\I��z��t�,p�=I}K�X��+� ������M+��=��],(�W|�����o��ҧ��ȡ�ق�Ϸo�?��~C���F�T������bwƿ�|�qz���z1�K)�Vk�`��m���� ��}�~bD�#Ƿ���)5����4�[%� E^�@�\���#<v-7���a�(�f%Ć�3F��]�������:!��{�< �pθ��d�/M������k3�"-־��N�����5O��݊78ΠO)8<>H�|����V3ݜݨ���y,{��V�d��q�����~��݃�<�<, �����]��-��o�^��B=-�L�0�SlY.c � gB����q������5M���{Y��,$�aW����!}�D�)Mn��_� ��Z�� ���"��� n4iكԒT���$��0����(&` �a�����\H�c��ԙO�LN'ֱZ-<���-�|��4�q�2 ��ˠ4�+�^)�8����Tg� b���@8"��KM��2�Ŗ��|���qԪ���Zm[m2ݺi�]G7]��'�[zs�1Xu��bw'��4�����̧p~���蔓���WL�_�Ya!@��*� 9��q��;f�P��? Y��D,pȬ� �F�Gr�Y������a+`Jy��"5��O<{�!�(��OѪ��$~�Ws�~[�a� _K�-�MI9�!/��~,����N���\�O��z�BaT@Yh���\<ol��.K6�ؕ�)cz��X��:�)�L$�WO������@d�n���#�5ya ߶���:��u�5�J�����V����x:5�������4�yE"��wǘ\2�:4e�og����!�����lu*�5���- &{�T6+|����>��(�x���-_��T�(P�i�$�*������X�(�=������ ��?����<�!eq�BU{V�ݹlN�R|�]38:b%�~�: 6 ����H���N��6^Τ%P��1��GW 78ojR�#�.<���q�,�k��S��3A���X69E�f;]�o|h�#�Q�>�`{�����l�������8u�����a9��,�# ���*������&/J��'��Mα+�����q� ��q�ae�*�s�����s�z���P�a|fs�;Q�L�x�mx�w�s�EJǟhB�C�P[9O�����Qdۀ�;.'������VW-�Aj��`������Z� ��7�� �ڊT+�{r�Z��/��I���ₗ�?a���{�l��i BǵZ�o}�Ju�u�ǒj�ve)z8��4� ҉����Ĵ"�4��5KF ����u��-7��8Q��&��lrh(����O�љ�mhz��h�S��at�.��ww[�r�_�?N�R}�����=�����t� �O��y�l-x�6�� �ё��@a�(��3s=I{�Y.`��T�E�`x�|~\�w��y����z�a���QEU��W��,�� �]}���\�tc�[��o��d�@���5�7C�}��f���u-xx�M��oKK��pN�<^���N���j�6��6G�}�iQ��r,5��ͼ�0-�eRO}�Z��v����3c�8��fE�Ξy����z���>8�m!���S����zH�[=��e����� ��U�`�'mcá* �4���İ8Du.�~?%��[F��|3 �%�ܦ�I�f���f�A�TQ���^,lz��4�O{e8`������q���E�C�n)_і7�����2-��P�tK*\�B�@��<F�3>r�<?=�ڟO}A���pG��Zʹ�(�_M���}�w�U�&ő��n�D���Ǻ.��j��h�9T(|(��G[}Y.ߣ��&�!��u`�#�C�~�8;K76'şhe!����~i*�d�!�m���S�ޔ�`u�Q�q��Kd�����ѻ���k��=G;��Y�]i�Ih����HzE�^���X>-in�S�zǟ:N�s�o���<������<�]�u�l��M�ڋ�.P�g>ޠW%,�`k�r�c x{(��9컗�����1�g1Snksw˸t���̔\�_��铘����S�?P���P1�W�i����!i�yGԎࢸ�R��8����C��Ag��Oe�}�~f_���Z���N��?������{zpemR�$�r@���\6��^ dO4��3�0�a��/�����xU��n}�N���fx3���$�UTU�N��
Static task
static1
Behavioral task
behavioral1
Sample
9604a42344cc6f6f0fb60447507d613cce2c35732686d673d1e1b1ff73193400.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
9604a42344cc6f6f0fb60447507d613cce2c35732686d673d1e1b1ff73193400.exe
Resource
win10v2004-20240419-en
General
-
Target
9604a42344cc6f6f0fb60447507d613cce2c35732686d673d1e1b1ff73193400
-
Size
2.3MB
-
MD5
04f3e32e1278d2bbb693579718f81e90
-
SHA1
4f0a9679772f6da64373707973862a8c52f271ca
-
SHA256
9604a42344cc6f6f0fb60447507d613cce2c35732686d673d1e1b1ff73193400
-
SHA512
143e1b540ddf4a5076802bfc31a2c6a2226b8d99b3da42754bd40ccd40bae1817a890ae6d7bda9ba45f4fc527c65fa87ac2d2b3742d58b52aee522dd03fc0bf5
-
SSDEEP
49152:XPfVuaPs+4MHZy4UBal/IRCKVR2DnMpa+rNdOu75DHPEtB9xB77a:XPfV1s+4MHZy45qjVkM9Qk5DHPERxZG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9604a42344cc6f6f0fb60447507d613cce2c35732686d673d1e1b1ff73193400
Files
-
9604a42344cc6f6f0fb60447507d613cce2c35732686d673d1e1b1ff73193400.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 12KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 204KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE