]OL�d��8���\%Nۛ�k��8���k�&�7`nE�g)?A���N�T���:�ˏLX�Q/F�Q���S�m>��əүX��r��>S�I�)T���g�3}xC4V�s�������3�����F����u�y�a[��y R��H��aU����:5�Xi{%��y����qR���a���a�N����*��݉�b��sN���R�%����ZVٮ�- �t(�\�ޫ:x�����I��T��.���t�u��`������V�gp�8_�O�$�+��F;����dkO�|����$�_�T� �z�(#mp������N�:Q)�F�g��{?i���]������oS�,w�?Ùc �2���-�����C,����ؠ�M�)~�}'�Dh 2M�csT�翩/~���H"S4jYR���&��1]�������T�, �n5��XO5����Lx���ء[��q�c����K����4tv������4����2h>�zߛ�e�b�Ҧ��h9'%�̗��M�b���*C���*7G��\���0%{^H��Yr펲崇���M�pO�s �3�%��w��~�mA���qz��oL��;Ų]�x�*�f6�rev�^g�~��أ��wף�6�1����5�W�R���%���{�I���O�R?���s�]�%K�� ��Ʉ���o(�H� z����B)[-2��$����'��+=����~r��ű[�K�-V|7��oͥ��$��2��2���C��2�ҏ�Pt�g���W)jsa�d�R��q���X"崁�$����#z��8T�A�M?��eUs�x�ĕ\�=ٻ%�4����Ê���K��0�Ά������I�q��7�� �4��_����Q5)��FL���a'hvv+��q#f��u}�٭=���:����R#Q�6�������N�ϟ|I%��g��?�7*{��'�,�6?��5a'�S�B��v�R�P�c�� ·cű����y!w\�w�6iw����Z]�؞u���Ug����Dq[��<�D=3�w�S5�S/rKf Į ���� q˩ *��@��ĉ����A�T�F�9'��C�̄!>�c���L�=+�`�dВ}!N\��,�#�.^�4��Ө*>8�N5ԩ`�\٨d��1%+/b� �/�8�h�=6`� U�J>�M[��vJ�㯯MO���� .{���yY�Zh��,m\�B�r&B��<�����와��@��m�ױ���R�͋'*"n��B��-���esP~+�o��FmL�x�P�����7k�r��y�@/tYQP 9��'��@º��$�Ч�B�����%���R�Yv���,��a]�1%�"GΈ������t�e��B�"��i[������-!T�絏�x.�OH ��F#�+'�a�B�dV1���� wOn��� ���#MDjd�Y8p[�2����2,� ��?ډpe/�L���ֹ+SgxG�*N4��B����M:ʬ���$�/B{�s7��1�p\���<��'�=��2�HU{��=�*���,ذ[�ID|L�?��:r>/$�650� �p��6�@�)��⩡�����7(�� 5��. ��h��k9J�_5.Anc���W��U�2vUo���YyCl��[>W����Nh`�����]i����UL+HY�cf��wy��]��~$�KYѿ�|��BPB&/[{W�$\e��I��y�Zj ����Wfq?��o�;�?L0��F��O��O�������%�l��������/惦�t�Q�q��`�/b�W}��d`�CqZ�*�<9It���~�?�!Q��nI۫;��X8<G��S/Z�D�Z]c�;i ���|�����i��^k��Z��sAT��Nf����&���$/�@h���2�jQ0�������d=��:�l��S]e*�쳈/u�T�E�NY����ϱJ'7 ��o���xAT�=-�=)��UQ���R�I�ޠ�M���j���}揾@��{��R�谛Vm�� /|���e�]$����G�\j��@�QCVH�FvJ6������c$�����c08/I+�A����x�І���PgX��-o�8W&�<��H-+��v�h�ͷ���g���|��t��&��P&����+�%.m���eZܶ���T8R�ry���.��H��:�珩��'9������B��p���|�*�Tl���pR�{�/�\�4��v笅�n)��q�S-L�2�y(�a,e`Z�qg#�m��%���=@�>4tVZ�s�^�%�0��d�ʊFa�G9�A��NZ��cp)����HjF���T�F��̏[F|�^Bֺ�� ��4�M%���,�7�Ƚ�8�(Ƶ�7�&�����r���f��e���Q���Õa�(y�Mħ�g�'��]��`����m�|,��P��K>�� �2pt�a��dr��%�fZ��1�U��$0�� ݶ�OV�b��x�^�����ǫ`�.q�,?�Đ�OoG�Fs`lX���s:��T�dJ"0�n4����`ܟ�y�G��[�����4���l��qn������^�&��i0�%ܼ�cW'�����'��s��6lEJv&I?���c|���u�x����s��y��c+%��'�g���G��N��Q�+�>���t�05Q~=8D�J@q��b%�V�h(D%��(;Q\��$�Uq����0������7�BNEȄ����/8��`���1��9����D;z9�۬y9�H������V�Whc����1�X�.�FFp�� 8o�q�9�3V���7�Ж�.h���rN�i8�B[��O̱��I���5�ܼ������,יy�w3v�C�� �����x��^�3�~�+g?�q�Mu��d��ym3k��E!�=����7�] �1�m��1/u�{8�_ fq�C����d��v��{+���@������h� uTYP��U�� �6�p��Ɣ�S��B7XL�tP�H�jݽ�Z8z;.HP��&1��q1gp����a���>�#�H�Q���1�e�:W�?�X"�� z0���P���'K������x�ڜ�U�a�sg�ע!5����Ŝ b�-#o�Ia�䢻!�B6�r�����-"������;��߂��^V�x�NB�۠�9�ޔ����W�ģN)���U�O��r��O�T`V��2��̬����҃Xm+%מj�DA��z���ג!<i�1�|
Static task
static1
Behavioral task
behavioral1
Sample
9a2a01bf94fa9a4b500707830d761f89ded12db04211f7b9a80163e1e71cfcb4.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9a2a01bf94fa9a4b500707830d761f89ded12db04211f7b9a80163e1e71cfcb4.exe
Resource
win10-20240404-en
General
-
Target
9a2a01bf94fa9a4b500707830d761f89ded12db04211f7b9a80163e1e71cfcb4
-
Size
2.6MB
-
MD5
761c0fe140e1349ae68f8566653daa6c
-
SHA1
e8ac9c0058337d339bd3dc327f72fffd27d29bf5
-
SHA256
9a2a01bf94fa9a4b500707830d761f89ded12db04211f7b9a80163e1e71cfcb4
-
SHA512
4241eddc97fd90f0adb4ba3a9b4358265fafa89a2c3fcdae082995dc5f82f8576175db67c6524bd15c85918ba7629446acc130c6df038e1cf7fc63e544fd96e9
-
SSDEEP
49152:pGI8QedbotdrOa2vnIOSQGdzgzAbD45hMlfRmpQcmMAqlkZ8ySdtewW1:QjMrORIFQGdnnoMFUQcmMAqlkZjSHTW1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9a2a01bf94fa9a4b500707830d761f89ded12db04211f7b9a80163e1e71cfcb4
Files
-
9a2a01bf94fa9a4b500707830d761f89ded12db04211f7b9a80163e1e71cfcb4.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE