�2���MoyZ̋���\$�#, w�n7���(�6��r_x���}������c?#�`��<�+N��Ӷ ��f}|D�w}ĦXȣ�e5w�ռE�9樆9ɽ�ʸs�{k�ޕbJ����1�N�WS�E�]�@볢��f��P2���!� {E��B��&Kŵ�9�����f��H��n]1<�����xL����.r�G���]w d)C8�k�3J��H}\�پT�Ι�k7� ^!�O������h��<������0m�&U�U�����J�������V��1U �'@%� ڗկ-������0Sf|�h�hP�n�$Ҡ� =�Gq�uJ��Vm���uq��ү���5�Z�j���4��uB�7��>�L���qwz�S�@��ʛr���5�� ����p�+?G[Nv�r���r�A=U�a��jH�p�K����Ӌ�>k}�.�{ &%��{�d��ךW����b��i�w|T�I=(���@�<���\�G`�幤�������9=H���������SM��0� iѢ����}w`� ���<��W??�Γ��o�G�g���j'6����%�� $��L���̊{�t��!�n)D�˾ϣ���I��]6#k�E�V����Ri�m1� ^(Xzp-%�ߖ��( p�V���+�Eֆ�^�{� �2���0ւ�!��uX������2����v�����{�$;p�F@+zv��V�Y�a �����U�5վ�n+ж�R%gC��7���^�V+l ,?wR�>l��<�@ڿ�Üp*�B\�jވ���!�$�a�>)_m�*[�˶{�T$��-�Cf�)<ԯ�8G������Y��+3��ɭi5��%�T���6m��0��췛ũ�lCл(��y.�Nh�b`��D��#�BE�:e�o�� z��ޣ�=S�_�Bhq����)#廉u���4}%�rӗ���Q)B�`�-�����M`�ٓ�\KN0ĝ�J�_b��w���1R&l�I�� �n������U�톥cu�PZ����8-�8&�����d#�N���fli<��{f�e�Y���pq�T����,d^ s�' ���Sz�B�;��*7�}��, %�3�6� O�Bɐh)`��{0t��^��Ha���l�<����,�W#��dpu�rI4AOd�~�1�xO��ԁ��Ԓ)_�f�F:�)��T,g�����h�8$`��\{X�@��W�DL9s)N����˵ݦ���E����p����'��p#�MW�[Jȴ�8]^N&�P���� 6�O(X��/�0`=��u~/Y�c���+�%�4;0l��.?����v��ۙ� r���̓��U���q �i/�x��~Ƒ~˒�}�\%�X�iжarԃCp��4o���,�C�2b��P��[ͱ�z��g�A�A�J ���8u_L��2mI���j����AnA�4��Rg�°��n����%��^�֤<;*�o6[%�p�����-�p�[�Nj�jԵl0vs?7�&_��v�UN��j�eY��r������Q�S��b45���8M(��wsO��F��b�ޗBlx�O&,ۘ�Y+�|��r������=#�Q�@{��4��o���SS9�a�ұ<�5��������\҉W�#�-�At^?�'�毐Wq >���6o�E)�1�*�,W��[���a��骥��dYGF��-���a�ʂ��ğ�������84-{[]����g��p�/pk335z��a �W��Q%�a)�����%��~���D�ӻKH*� �mZ˟@��StV��������ĶFr��>�s�K�4��K�g�<�d�m��t���2ƌ��&X<�`25��H v�V����� �W����4��,'\�iT�*�uS�����~�nw1�e@9025t���^�a"[���:o�� �I&��p$jZG?t�[�#�k��K8kP��^�7y��.Z��2�pv��4�jz��i ��m=9'Y�B�Y���$���Q��w�ãY��y<��0� �ۄK1$#;!�W���������.+ *R��w�]\g��&NN��+ӲR��f�t�l�]%���,����Y�29�f���@��B���K�� �K'Q�I"�,�l@�.��,���;Ί*�5JF4�qO�����㣽Z�_��nD�^���e:�ď-M?k����Up��dEމ\�֖I��;RR&W�O�s4�<��NE�!Ө�<��ʅ�*i�jx�P���$2el`��[��>�zE�,�a ���H��I�TY�jc���W���S���O6�m�s�7ە���L�cc�O�t�R��e�%ɭ�#�� C��b�E��������+R�88fX����g����u�ȰO6�d��G�brcw_����u��=`�ʸ���<D{���G z0e��@� �ᐕw���*R��H� W[� S�JA3�x��9h���V��k�=�.�M�%�1�[W%���BAIe.�nx��X�YS=!��N!�/����c7c����L�B/��]#��><�m�xG߷�]�S�H]���rdPѭB֯�R��(oZ �5S^����~���D�i��6����|����S������m��ɓ�YIL4�u�5�Z���N����v�����b+�:!K�\A��J���"�k�x!�A��m��e�f\�\���&��n��2������E��/RQS1-Y�X���J�����D�+�m��h[���ܖ�. nM~��N\������Z;V�GD��R�;�V�K��ީD� GZQ(�7�|ˎ-Z.��bf~^�`�ci������ťn�,Mg����iǕP�:C�qĞ3�*��E�U�`�<5���Ϋq�*�O�'+�XL��ˬZW��4����+*p?G��x��ds�t &�*�- �6^�^��4�X��}\;���2hK��M)P��V0$^j1�̒�C�Z7�ʌ��*oZZ�^V�I�� ���=�Z>Ye�~���Dw~��UY ���? �e ��T_�{@*�d~��������J+���9ʢa��LS�U����5���_ɏP���ot���\N����� HB�BCU`F�7�n�/9;"�)GX;
Static task
static1
Behavioral task
behavioral1
Sample
c9e55a2ab22f6533b68f8b5e94ac57a070669036c17fcec80d51983bc4c4c601.exe
Resource
win7-20240508-en
General
-
Target
c9e55a2ab22f6533b68f8b5e94ac57a070669036c17fcec80d51983bc4c4c601
-
Size
3.1MB
-
MD5
de4be97e4013fba60e0242c6119f1c4a
-
SHA1
b0d0524850ab0345c8b8a39b0c8873a3db3f8ca4
-
SHA256
c9e55a2ab22f6533b68f8b5e94ac57a070669036c17fcec80d51983bc4c4c601
-
SHA512
8609f5095146312e451a38accc3ffc4dd2424d284753249b9b9213951961cf33d4b992e6ce5bd1e89368617a42e6367c93b2c6536e787637f7f0cd26a85ddbfd
-
SSDEEP
49152:tbqYZCQWy2InGzjfm1RXXhtTgrocWqiSEPdORnl65mEPhWr9gR6KB3EalLYUmqRQ:IYLUYRXx47WlO65mEPhWr9gwKBnpYS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c9e55a2ab22f6533b68f8b5e94ac57a070669036c17fcec80d51983bc4c4c601
Files
-
c9e55a2ab22f6533b68f8b5e94ac57a070669036c17fcec80d51983bc4c4c601.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE