`��(.88�_���ND2��k��İ�i}U�b�o �F�E��>aUȪ|j ���X,��k`�#�B1��4�!��}���R�m (��1�$�&D<�*X��a�ɩ�������>:2�M_W�X�=�IC��J�C�9�j�3�e`l)u)P��a|.��,H=�mɼ:��d�Т����cϋ�BW�6����Kah`��V:p�����9Ds�����5A.�8�4�`!�aw�X0��'��=~~��Qd�m����N�/���anB��w̪ǩ�ߣ���bnǜ5�`=$ꞈ�Mä���q�8�$��|�^���F��|������x�80vB)�$ ��y����m�z lI�����}ޭ�?��+F�g�4[r���@���IC}��$>�N��ini��v X�e��CJLs,]�3�J�_��J���1%0��A�u�9 �?Xt#Y�r�JX���8 7-����S?xnv]�cr���A��&�c���8��"2#�A��s�f�}�c溑quR���T�_�/`������"��]n�(p3ZC���r���4jOuJ���쎈�����dg<g���/FW��j�zaI��FɈc�"�8��}�u�?-���.i#�1����HU�F{G��P��w�B�8�s��c�ϰ�n�l0x��-�Wi�P�[F�f�<��0�iε}���lꈴfLHW�����rM�+t37M%�հ�N-�5�Ɨ��EH�}��sm� ν�v� ��ܰ��G^+^�8!W�J�\.Ӥ�/&�h�2%�1��ʗ����kb����а��!���]��}d�a���Dѵ���ߎ�ʊ����G�w(ɭ��T��W�����Q��K ��L��YUĎ�9;�m\�g&�_Sϲ�Q cˬ/�c&���.�-K<��������v1����D?�П�E��.*�3���5��)��#+?#��;$/�-�6��b�rL�)���͐������Ԥ�C��$�� ��d1��Lg1J�|���'E/I!���#�mvk��9�%e�$��b�x�Z�V�����X�k��k�$�%m|N�����Wo��T�Ui�|d�𭰆0�6��լ���sʩ�q3m�$��G��8��><�[���@���lR6g�0Uw9l�˟����X�z�I�:���"k�,cD�����r����*��o2�!3�@��1�8�^0�g,�!x��Fy����>�K���ŋ��^�� �>�����<��e���v���u�⅜����O�/��KWe1O"���G|0�X�,˩����}��I�H�I�7E����ͬ���3%�����ə���ރ06����-���4�����fY��MJ�7�)��=̪�#l���l��@� ֿĪz|�U�'ν��#ڵ}:�0�y�ť������X�G����=�^�*��~ $3_mo�|�%10~�?�b�<�&X 5����0���%��=n��� �VAc2�)Gg��k&���F3p K/�T pF�б��)/���_y��̴���yW�djk?K�un�o鑏~�=��<d=�W������q�J�ȫH��=���R���t��+-�}D,Y0&2�y�d�>T=��n�M���O�2�������H�T�>� 6� �.��eo���)���L�8����"�#V?ϔ�����n6Vshy�GG���J"��&�ZxX�>ESu$hQ���W��M�g|�S���H��0@(g��y!����uʾ�.���Lc�w�$t9��H�{�6��E�Bu"w����dB�c��-\��Ta�q��n{`i��f�f����*@����6@2�E�r����?��;g��+�P,V]�?\�1���L�����)���)�٦[��~�� ���,�σ���lE�/Jo!ަ�����g���7L*ڌ?_3Z�5�����hX��a+�/�*�:��vm��z��iAd��Lݮ_���@�Jjcl+L�(���%�|"�f�x�`.нV���x(��D�d��G�!�����.:p��c�{#��48�i&��y��ռ�'7��|�6�I��69'��-�'_R�: ��Ab�H��op*��D�.���v�(��٪;uuT-�o�dapdz~9{���$�qf/�8�ſ��~㺄�#)3�������{�7H������=�� |���K�$�Ν�w�S��H�'�։T��P��g�;5g�لʹ/b����CP������+�N�ڡ�N�w�����f���1�m��?x�V�&E�)���De��u}:s7� "��GN(���i��5\�g[=��U�z$��9u䩚�hqӥ�A�����E b���������T�ߩ��?f�٦}rg�(���E�1H�h����>�1�+�`������)ʞ��}���F���*��}p�/LSU�SB�^�%w��'��l��� ߎ����П�t�x��겓��q kZI��Ld��RP�u��{T���CL�0�;SrP0���:\�b����&I�#l�6����7<�:WZ��2 ���Y��V�e�I�D���BJ��z��"���u�Ȱ���H�:�y��y2�����6��`�2<�1Y����(j��[z�<�|��ET�K,?�3�2{��2����t�9�ucI,����k����j(�Ā,��<}�O�3�`2�8�����@�v"U�B�Mm���%�v�'�n]F�p�v���=n�c��=�:q6�5+�\����:qOD��S��V������^�0χ8�ϳZ�a�wePbs��6��+1�r�e�2�{�Sg������S<S��������ۘ��I�H.��D[��,��kX�~���6�� �} uBT�-�F�f8>Nw*Ԭ�pF�kqT��+|���x-;�dz���|�q�q6�����%���B��]�ayǃ)*40�R�VZ�]�R�|TߟN���u���J�C������@�T^��f���*ۑ!+����mЎf:UT��0a����U�S�ƞOW�yh�\���oG�K}��^��8I�����M��R@�� `��������*�>�,���l���d�cW��Ma�8�����L�̚��C7������y�2�+$�&#wW�������*���o��-�H�"��f�������/��u��:CQ�^��d:�qI��"��7�T��K�& �J��sE��By���if ߹��:�4fe���xSբ��N!>s�"� �x>L���q��6��ֺI��%D��+�9 :)n&��)���)�b�s����}�H��} pKv�z��$iLBDb��~�"H��h��������vX��e��b$�,~[ʲZ� �k
Static task
static1
Behavioral task
behavioral1
Sample
9654be08c97d6dc3f94bd6e02901de9afa128740a547fb224bdb1a2a7183d927.exe
Resource
win10v2004-20240508-en
General
-
Target
9654be08c97d6dc3f94bd6e02901de9afa128740a547fb224bdb1a2a7183d927
-
Size
3.1MB
-
MD5
b32141dd5b9e14eb49450c6961f49aa9
-
SHA1
13a6179672d19fd0a26eaad79903e0c03e4685cb
-
SHA256
9654be08c97d6dc3f94bd6e02901de9afa128740a547fb224bdb1a2a7183d927
-
SHA512
d81e4c21ef6dd7e01e6588133b65f39c5129db5b650fb40b27895d4b301ba19ce19ba3a484970287582a30bb4546a7ec7f0caf0b84955033c92d3510c767dcec
-
SSDEEP
49152:H0VPuy5f/5MnReKiAWsG0eZBekgBsFELP5PU3jw7oULed17X:H+PF5OnYKif10KvgBLx7oUM17X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9654be08c97d6dc3f94bd6e02901de9afa128740a547fb224bdb1a2a7183d927
Files
-
9654be08c97d6dc3f94bd6e02901de9afa128740a547fb224bdb1a2a7183d927.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE