E��)p)y�rQ�~���X�,����Ht�kVf���w!��� |�=i�l�_C��X�R��m�F#��u��T�i'?�f�^���ݰ,��� �l-����pZ�OgԆ��Р@�U����\���i����H4��PrN?���U������}_!�BK��]�ݣI���z8S��֣������֓�������է��Z`;���V�.�`R%+(�W:�H9��硳H(6YS��Q�����)U��.V�I�̅.�4�v)J��̱9�WD'������ K�}� {$�^���ͻ��x%��z3�{=˦��d�E>g�5TH�-p%ۈ�~��~Q���;}X�G[`�똢��!)����<�T-��ܑ� ����+�?�3�e����]��ެD�pλ�0����D �U�ȗ��` g]܈�J����!��N6��e����J$J��iY��,A]Hd�V~C�P.-S*�i���B6v�`K1��a�H��XՔ�3yI9��V):.�!&��|��(�#�/�-�R�A(���P/*+�ϸ_y>�2���N����� �J�7_E��.-�w}�����+�-��t5�k3P:Y��z�Z��bt��WD�r[�8m��X��~q8���`Q;�!G�,���'3�U� d�C'���Y����T/H��"(�*�<(�b������e�x۶Z�VE`A��%����t¥��(m�r$��A���-� g�T)�����ڔ/��ƄT���ɘSw�l6��M��%�����7po�g�Ud?� �T���.��b���YӋW���TI������X�\-Un�1)H�f��#`;!{�/��iB�'UH���Lj\�0������^>���U���w����3v����)�,�S�z���8�ϕ:ij���s�� �oS,�~�v1�Ԁbk�����p��Q1��q�G����f��40i~��w� ����|�xF�T�Z~�����hS�IM��루�V��Z�2�B� :��� +c�Ԭ��H�c'���7��].c�=� �����i�d<@,JG����'@�V7H�&�� �q�#Ŝ$��C*u�WO6L���� ��-������N����Sq�':�U� R�uu����h=�hr�0�����:B��શ�k�~n�pcF �������2���Ø��k�x��>[��DF9���d��������`��B�;�mTO��0_F 9�O���-��!U�� W��c���Sc��i7J�*h�1RWr˧�`�[�vE���a��A*T.��֒,#_�?���6��+Q� 1�1T;�|{a-�����`�c0�6�;=�o��KjBi�h����p~��h�S+K!�S0�"�ܵ�LUqHZ{��Vc�Վ�R�����T���Dx>@�q�M������&;��5��Ժ�T�����%��u_��_6���A"?�T^�|��`-�4��WPʅ��xZb/�<��!wb��GaEklM�v4��|Iw^�s�8U�{2r~����^���I�2x�@��"���D.P���������6�H��+�\L�&�m-�-u%�gՂH������)�@u���0EA{҅�q��!���xX�->�ϣ[����B/R��и���A�B҆�������s��pn;���ܙJ�A��%��Y1��#|�2��ֳYE��$��6\��$�k�:U��>�����w����e�9�)� s��� Fԕd��������5�+\ʥO,��Mr��������b�F�Z�n'�Hl��b5��r0U��&!f��1������B]+N�(�O{�\~jx��s����Z-S!33��@�s�<����ۯ�b�^��<���jVjѺ�G���)�X0��J X�A�@�?˩�ղ�p���i�:v��Kl�zhk��~ �[�zz߽��z~��+z��/��aİ� ��FB`ZO��� �R������G���ۤY+06�g�T?� 䵧��'CZ�ɢ��nZ�?6߶��#(9�!9;��|���M�e�m��K���%�������Z��V�Q������� |7��U��c��˫����������� }�٫������J�R���?��Gm�z ciB�>�Q}�u�䌂\2�!F�Bގ�گ��CF�E</�j�V�������1���9�0���P��M����T�!��7�(�S/$Q�5S����o&���/���B2���aSZX7\��'����Sz��Ԡ2�r�{�a��J ����v;9@�H5�AN����`dA`�"B�k�`�&.�����nL���{�,c�*S��&a@�$)`���[��@�����3���DA9�3kJ�r�f��Q�R)N4����1R�(�a��S��Ȧ���Ϳ`=("�5��#�R��� �P��"��8��g�*�~�W�Ylٹ�m�O�(�����l�-��\zt�����CO���ջ� ˻[~7��Mun�*���h����5�j�G�����m���W+�A��[F�,0�`������$6~�YQ�Ǘi����q���[E¢��8X|EZ��K�i�M �7~ZNC����yB�3�&��;' NF[�i�{���i��5G(3<fz�/@4_���|SQ���kE[���اf(Т;`΅���KY��/�19-���n��_��_hPf�o>�wu��ٍ4��e�Ɉl9���� VBz�OT��}�����9ה���T����JS��?X/R@rb�Z�U�qfP@� ͠3���"pp>�X8��Z�}�^��>ԾJw�����߆?����u+�1�VA�%�O1$��Q��4;tt�YQ?���`���������\�γ����)5pY|�3=(�*!Dwҭ��U؟@o�О���r��v�-Y),hw�^�` ��Z� [8 ]��4��9�Z����������!�J)�I��P~Z�d::R�{ap|�(�h,A��jo����;d(T|%��h�Ӂ��n��!-D����M��p�T��#�-B��1�2>ٮܘ |Fgݨ6gÉ=_b%#q��� G�@l{���}?�%?��c{n���0���[�ZD�:]4E�n��=Z����6��U��Quӎ[�\�M�=�G�ݫ�+f�'g:�����ضy����y�3a�f<\D#M��/\hw�$W�K��g��n��a=��3��W)y8|Tu�������䨺����j��0q�yG���xm���) K�9\�Ac���;E�n^@ �fV(f�I]��Ԍ����9D���o�ѿؾ����s>��I� ���46q���'�6���J��[�B9G�Z���]�N����U ��mD�4����d���l���wS~��A���w=��쵔��)%������.O,%<Dt])�No�|����=�s` ���T��o��}���xz���Ȇ�v�_f���n�>d�$����3�p��>*���%K�oP���B�M�����J��Y�Ҭ�X�ǘ[����s�i�ۋ��Z� ��L�8l1ğ)�`>C��Z����I�i!
Static task
static1
Behavioral task
behavioral1
Sample
9b1f369fd5ebcafebad8549a388ba9d8448a16e72b3687708b1f61feb07136ca.exe
Resource
win10v2004-20240426-en
General
-
Target
9b1f369fd5ebcafebad8549a388ba9d8448a16e72b3687708b1f61feb07136ca
-
Size
3.0MB
-
MD5
a9bf05fa450c80efeeeac7c22196639b
-
SHA1
bac7f278008f7c0696affaa68fdc1365d6bbb7af
-
SHA256
9b1f369fd5ebcafebad8549a388ba9d8448a16e72b3687708b1f61feb07136ca
-
SHA512
8b715c70582dcedfde2800fe89a83120a4ff213011e1fdb607f56e6b93fd77e928fe894177f122b377d2e4e682bda91e541b9e9aec764a1741daaf81fa8b1465
-
SSDEEP
49152:/6g1kMWPE5Q9j1Iy0gWEOoXHozri1uileq+WOOeWgS6xXvDWPuw:bhml1IYOYs8hg93WgS6xfaPu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9b1f369fd5ebcafebad8549a388ba9d8448a16e72b3687708b1f61feb07136ca
Files
-
9b1f369fd5ebcafebad8549a388ba9d8448a16e72b3687708b1f61feb07136ca.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE