b�T9�Lt�>*v�)�����\�4�6eow�a���bT�4g.;*�c5�R��">�`�)���`���.B#�*���"�����i��P!�=;Y�xҪf�ˁ�@u`�d��a��NBx�O!AE��4NM�n�&8L� �oY"��)�̳��'Ң(eRT�����d�[8I��y��sEvѾ+�������pJc\ :"#��k:0U�7)���kp���Z'c��C"������#��v� �>�)ͳ"x����h�!������r�+"1D�����hh`���Z��dr$~M[O�&>��jXz�efˣ~�7:̒7nif;����61A'������TK��\�I<�to }׆PO ���ƭD&P��U� ��}<Ȗ��b��tx q�����ӗ���;�B��,��Fi�XYE� �0�,8�F��^��� �2�b��8���[(���J���ygj�<v�[WY�`���i E��\�xO����;@.ǡ�ɥ*�'�J�v7�"^`r��<�b��F/XN���l*�j5�}����~�Q")L��U_�K��� v��%�+!��z0�������VU[������=ӮD�Hx^��y��>�ώr����1b�o���,�:����pa��}����t�9��\07����Iq��3��VUm��1��Z�T\�:'~"mҽQU�R�Nu�Kw��������z��4+�0�ľ4����Θ�] ~�o%�w��]� ��m�[ ��h����`t��6դ����#^\�j��rP�Z-c���0�Q��)�}�8BS"�{U������"����d��{`�������i�N���,B����L����VNU-@w�rZ{�$�a��𝀦�a:���q��xD@v�sdz/�i��1�+��|sw4��GBeq�k���k�_�O�N|[��ت�'��ZK< O��2Ư�Y����C���XrWy}�"�v�Z���ӆ�-�����1��N�d����x��@I�N���{_����p�8�e0��R�o��`����k~��Ic��t6}�0�Ǹ\s��_�|��af��&��N�lH�2P|%Q��� ��)���bQP�{ ��{_w �\ �@��s�=!鴒t�VF����p�A3��[�6w�����寅.�[�$��꜕{�Lj��Dj�R�xZ��C�EAR��I�'��V0&�܄-�o�&t�����#NU��E���w�7!���yX��j��~�����@��eH�@NXm�,U��q�*8_������;�h��������I;=�G����W��0�38����8ĄѼ��Vnk�V���b|��E�J�;N�n3���f�0��l)�5��j�����H�q_5�����Q7_N��ϱyEپ������&�!PB�K�n��m���@x�r�J�v�q�r���������9���AF� y| �-i�X�w��*/�~�_{5���ƶ�i.�>_����;a8�/9J�C�o� '� �� ��ȷf�m|�RHf�+/�«�[�3�s c)&����J�����|C���hヹ�C�b���̶����\�lɪ��*Â4;k������Y��)t�&1W��4\�Y8����LgP[��OՊAWZ�"��$��L��&��y�f|mi������ ���ّOr?���FM~�,i4O��X�mjk]��J���sd� ��ؒ�p��c����ϥ#I�Z&?(�LWcux�s2C�e�X!�r�� Ɩ]Fis��&V)���C�%2�۱�20g1_�ͤAz&�"��x��a�!-5�Q p ���+�}��M}�F�paਞS�е������V'���f4���������&M�XQ !6|^�*l�-zE� F�ћc'=��qp��ǟo�0��n'R�]b3�ͷ!p�牆�L�ǦBφ>�|�7�=��DM.���v��[�m����z����xp�J�%�K�J�����|h+�u�n|��+%��]e��W�EO.���S�)G��ϓ�֑i���ݱ@�/Cb?�L�.#���]��T,��pO�.&�D�J���>�IK�i�I��[�. ��QE|(�����X�e k����7��O��zt�^k B)��$&)�4�����P�цvΫ� ���n����x�#W-�:,�~���@k��{�A�`��Ad]�bH�P�gt]+��p���+3X��������/����,f:E��r����I��7��d�iw ���J��������O��z�M,�{����V��� 96ܱ��@��Fa��T#8��5� �J��}�Ս�RJ@��i���r���>J�pc��T�����%y�Z��qۋ?��Us�t�s�~ɩm���t��m�"9+1�dD��2�//���Uh����{ɹp�c��ޭ�}�^+O��x�R0z�A�������4` ]�5S �{�A}l]���5��>����k���<�:���g�������=��X��kN��̆��Dzn�n��`�d��l$y��G��k�Aj��j������V��bi}It��w��s��N5V��&h���NN�/�6�WK �����M��XZ��V����:�(�����@4�T�)�6��)ˡH��+M2�c����'��Y=,��Z�F�4��r����Ʉ}���O�u&a��D�?�g��G���E@'vI����@n�O�|�s��h��z�A��v|GT6 �+WI�>�gyy�"��r��3\�ft0^�i�O4������b*��6�\���*V�g�W5�E%�ܡi��=����z �n�eX�'�~�����>�铟8�k�ȿ�|(2#�s��U�Mf��#�A�/�1���Q7�� ���n���ɳ��j��;��`ʝ9]�u��"�J�>e��u�M�`�Uɤ[� ᢠ����U��v=���}�8��Y��>:��k����680�]`:T�=Dg�?J��r�SZ�?��`����� "����O��J������v|Ga��1u.K����ِ�)�?���|��磧�Qz<O�Z�RJ1�+��h>o�}���9rP�Q�p��jH3L"mǔt�Tu� `����s�p`a!A!c�� |���mH�����"����1����qϼ�I�dЀ��T�Tl�_z��������P"v�[�GfkL���{�X�tܘ�Xǝ��Q��Eƺ �h��Gm�W�t ��e��k|���p��)���3�m~���7��4+���}�چ�+zD�4W͜=O�(�]�R�k���RY���9��P��*���`�n���XD�*�x���x�0v��4IJ��#����a���R�d�ށ���~�, K��;q�@ed��w�4Z�'p�5�P�{A���/e/��H��_����t�������l4%�v��Z\��lC]�����|)�.�6�A_߯(�I:�z��u#�<5l�_J|l�4�]���r]^��
Static task
static1
Behavioral task
behavioral1
Sample
c9c462d256003a22abcb86164d0fbf2b8237d80108f12eaf37947e40572aa71b.exe
Resource
win10v2004-20240226-en
General
-
Target
c9c462d256003a22abcb86164d0fbf2b8237d80108f12eaf37947e40572aa71b
-
Size
3.0MB
-
MD5
cab3866f018a423456c91bd0ae86f940
-
SHA1
981c3bcf3440a3b94ac91999c0d96d29cde9d474
-
SHA256
c9c462d256003a22abcb86164d0fbf2b8237d80108f12eaf37947e40572aa71b
-
SHA512
fcad85c8a1fa22f83620aa7901edbf2890ca9c841cc74de67afefeef2f1d3a61fc399b1b764bbbae5a053690e6433754efedf0b201d2908fe43b12a93eca2c90
-
SSDEEP
49152:RyMkkH1JFRyJI2j1l4i1Xv+PdgtX2cRjyms5Iwt47pfJ4GYk3:kMk6FmI2v4i1XWEjLsA1fI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c9c462d256003a22abcb86164d0fbf2b8237d80108f12eaf37947e40572aa71b
Files
-
c9c462d256003a22abcb86164d0fbf2b8237d80108f12eaf37947e40572aa71b.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE