��ho}���%��c�佈������'P:y*+�3�{�M#��WҦ$���Tg�pnm�8���,o�yh��>LW�PDO���n����J�nOC�u�P��xO��bz��H���s[tu�mj_8�?��k�Q�����/jzSIh�Sl���Ҷ���2=�� �)۳�����w90���pH�����_k�j�>ʴ]~�\�\ o�Ћ �XDD1�PO��V���rר�� �v7@"893f8�_��"��@f0���֣��3��h����0�7������[~��Or��,C��iU�4�~f��Ks#?O>::# 5�_���kbϟ)���?��ŽQH�NJ`�7�rBgO$M��C��U+�Ei�����Ս����% ��� j�i�[�L��'����o/�˱��� �^�����/�T��X�19��A��1����j�~=j~�Ԯ�?0uQ{���t�e�5Ƌ�A:�煇9`�0<������9�(":��_z� �%0l�PH�p$���zMx�&>,fCr7��(f�#�Td���u�ޏ3�tǾ��̽�<�|��.�/�n Ra�������� �Tɾ���ӹd�=��se���⛌�"�GZ ��}�8D��_˷�32��)�W�'��Ҷ�D�I|&�p��3RM��7���m��!��^p Y��i�f�ن?���NW�����RSX�!ʮ����g,��q�H�o���Y��`���>f�&��&+�yU�ʛ�O9����ý��+g-��ݷi��>Cět'A��9��V_�,<|��c�y}=�� �����)���7�5y2EF�������R�������i���{�t��w�k��]��*'��x�8��ջ��[0�!��"���0,�P^-��EoOktF(1~�Y\T�.����&$p�ξ�-mto�<�|���������Ǘ8xu�����{^���x5{U }p1���ax�����'1���=��Mp��cM��ZZ��]�N��7vV�͠�z�0��gll�R�(y��}�4�D��,����|��O�,:������ANR3�(g�l��d�3��Aei�z�Ygs���J*�k��35Oz��1�"ޤhx����Ff�۬}�!J�T��g[�f��[���'U�l�tPc�' ̭:� �$p�f�T���FT-�j��}3�@^�E��sY�,�`�2�]�<v�kP���>T���T���$ə{'@t\t��kWҫ�-�ۂGvOn��]�I�P�1�]A�i�rQ��G\�[͈R�a?lҖ>k�A�/����"�1y�?�<�\s�<�_>�R�|}u=6!6 l�!�����7 �#M`�� E@0�-'Ϩ����x�IR|��G��K��ԲR^��9c2S�(��u4�`]���!�Yyq&@^Y/gw�Y\�b����qd�1��/�l��J��!{(*������売�Z���;�>3���ܹ�o��^��v\ٔ\m��F�OeV��i��V�yw˞qK���� ��E�UIԄ�$��s��~u�3I��,&( 4 Ӛ�m�Đ��rd� ��A8C��� �������1�Nd2�zu#ג��t��t*�C�~}Xt$�ZvC�ӓ��2/��E�˓e)��-rY��)�v�T�5Lv-=�e�m����/r����!��Y��p���N�y��Y���O�|%M�*1�]4g�}�Ä[v��:��;5X�W�|�V�Y�����DZ7�J����K��G&^Z����X��~Z �Y7W���7�t����[�#���F�z�Д2�h�dN���7�g㮎�_�u�'LCp-�����O�����'�kUg�"���D�-(�$��W(< ,�\�8������6/���|]��)�3X} <X��gA�ed�=���0�l^\͆R ofH�,ev:��?�cCpE"�E"����/�|��<��>���|:��Ƨ:x�F� u�T�V�����RR����\ �����Q���3`�R�����%�/�`�� ��ϝ�d�u��I>�R�Q4����t��s��A��QV�ۀg�֗�\(#��>���M���J61�ኮ�klL����Y���¤́����!�����/9�}��!���vOT~6�v\�.��%�{�f[��q&��Qj\���^�����p�o���BZ@Q��V�����Gyy1�;3������#~PM����W�}���h5Y,����7e-��i��g���g~�ئW&��C[#�5��E�mմ����$_w=�[�S"���#�τ�#�b2��������{o�� O\]a�D���bgFni���U^C��KQ�ة¥28����ք�@͔��#���@ >����_���DZ�UO����B��� �ZgE�l����a�@YD�m�~&���%G��q2���d !�!����������1�ʕ���.��$��F[�Ӈ��7TmH��>��X�*(* ���k�G� �5N��ȲI��Jm����3��oJϦ$@n����sjZ�MJ:���l��~TG��r8Q?��2� R��e���!��l$є9���E�C2�#D-6;�k�����woDZ^v�@׀��'�څ���*���M\����:|��5�Վ0���H+O�VXM�ӹ����p�래QK�-N�4J����a W �����=5Z:u)z$��.�yt�fϹ�e��~pYV��G [3~/�CM�O�̤̹RD,�nztӈ6�4� bw���`�y���8�z���kl����� �&]�F7��|����k��H=�S715�[� �:�i�pK���i�lLk�˙8 �H����ٔ9ⴏ)�q�����9da���O�]0����N�V�F�\�r�xB#�D��"��N߆u�y�#���އ[�ϲ�>G�����f�k=�c�%��j���H�7����О�X�W �b.0��QLC|��c=�T��I�2�y���]1�H(>*[�;1q�%N����ֽ�� Pm�ƶn`�c�s� RwR���Нx/�o�El%)��R�:+ Z�%�[�i�u_���G=,*2%Q*i`����Oe�v1�0k ]ܰ���x�b�-�����Y�1�mLyo�Y��>=�E�_T����T��?R?�O��12�q��^����%�<-�wԺM0k�q}�n��;� ���5�;�ʆg�(+�1�Zw#֮~^��Uj��/�&�^*~�������#�s��o�$Oru:�L�pX��#m�a��p�����R��C.C(NW�Bbr1��a57�;��]�D�7�e0����O�C�*�w��9�}x�D�9|���Ř���; \�ꘇ}6�� � ��~���y:0��5y�+1K�8к�r�I%�/x���J6n��Ng����o�������t��U�懨��:��CYM*�$��O��sɞUR�D��-ΊC�gf�J�@us�w�!ޡ�g�Q]Ot��]�vU�}N�(9_� �I�X.��
Static task
static1
Behavioral task
behavioral1
Sample
9e4490f0d459e056ee2ce1d6d9325f4427200c3ef4fac720bf23b2ebe55b891a.exe
Resource
win7-20231129-en
General
-
Target
9e4490f0d459e056ee2ce1d6d9325f4427200c3ef4fac720bf23b2ebe55b891a.exe
-
Size
3.1MB
-
MD5
a413d34633df74b132fdccebb8fdc8a0
-
SHA1
5dd0d4a9c203a55176969e991e145c797e73cac6
-
SHA256
9e4490f0d459e056ee2ce1d6d9325f4427200c3ef4fac720bf23b2ebe55b891a
-
SHA512
6a37961da233c4d75a623655fe4f0b845bf25c0425732561cb43b6889dfa4baa8ba29cd6b75599898cf0c41316d111c2854cd5e9a4e7a299cf5401f80f7fe46a
-
SSDEEP
98304:UHkFrF/Vmh4Kbzzn4DLzTTUK5i9kEQXHFAnS:U+h/+bzz4nQON/7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9e4490f0d459e056ee2ce1d6d9325f4427200c3ef4fac720bf23b2ebe55b891a.exe
Files
-
9e4490f0d459e056ee2ce1d6d9325f4427200c3ef4fac720bf23b2ebe55b891a.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE