x���#(��ɢ9�?uJ_h���kԥ�BsR�e��Rx<\�rڂ����� �s�BI_yq豛��p�E�^C��ڞ`�1kZ[�܁}]{�XmW�:������_c�xD���ea�UZ�a�*��E��̐߭�EVp� b�p��kT����ׇCy����"A*8!����?���9:D���q�s�&kJ�r��3 �!�w��Gi��6�7g��Ц��������n��Z�r}/�V�j�a�Y�7�3(�F�J1���^�k��YJ�_�g�����宖���]i��$���c����@����Aԏ4��ه� �n�������R2�����N�ڠ�-�*�I>��^"��@i���D��z{]-672��{�����O�Y�-;y)�(Ġ���dٌ�����N��GO��YR/#�F2�Dos%��x'=\� D��GZJ���}Ӭ����@��/�� {;V��LWy��z�;w����$�.C��"������Wj�����2a���j��JM��ʯ�/�@a�Q��%�W4K~�����r�C��:Bm���ŭ�|[�ɀ4��2�^�t��VrXWϰ[�\�94�P!;�/@P�1; )�+({�_Wp.�������O;�Js�t��s=� 57�;�������c�5q=��0>���ߥ2m./բ�2�ܕ��=c?���e�EM��YJr)Z?���}�)��r� ��g:/���lIؚ�hK7F0|Ej\�9��A<)f��^ ������ X�oF��h���-��v7��#��>��A�b��b��5���E^ ß㢏T5/�������G�tȭ�5��"I��r\���?������� �g���o P�ĵ�X�X�ᰋh����m3#Ә3T�M�<И���ȳIJE9h?�w8�3;��9py���x�����?2�UHIޡ�b�N{'6(F��I*#|��J�+��E4%�vwn~�Xm1��ny7��Em�Dg7d�`Q�:h��L>~3;�3�� U��c�}��_���@e� �R�#��W�t�t��mI��w��1�Ʋ6_Ll^��8[�VS�#2g��o������������z����?�T2�(� ���b��3"|8��(��-����R�Ɣ�j4c0>z��j�w�e�ĵ����L��\�OK�N��(�O��(��M����x�)ƍ�h�?e�T��� p&��:&���E���9����D#>(�55��@:�t���(��Ֆg,�0�����G�u-H����@S�Q㲸X���!��V�[}�j=K\Ŧ���rI}�T#�lLL.���u��>C��9P�K��Rk>u)K���Ӥ-Z���.�����j� �1�&�4xp0y��.܉�1��ke��ʊ���T�ö;���*����q�Wf�(t:�|S���ۇ�Tl���� �&�N�]�m��ǦiAG���~>i������`w�b�қ��>͝����Xr�3��`s�-�*���W$)k�~��=��A#(ݴ U��W�̶��{���g����0��1%ﲕl�����0f_O�C�Mۇ�\A!�|8�[8|V�$��\S���ɠ?�*�]D�D!��?�(�}?��[)�̊�ܟ<���h*��kE�8����+a!��4��04��y��Q�@*G1�t�ێؿtه�ƨ%�1bP��HV��eM���Mf��h1��y^�X�����H�~dGń#n�0� �C|��qL@(#�w]��W��,E���Ȑ��x��%`Գ���k��1Iz����m-s�C�9{�p]���4���W�4݆�=�0����״�@.tG��Me��K�Y@���5f����W:�:r��BCkw'��D�'�Rz�[ZjKdF��Vu����JI���Aq/}W#���>������1-U؋�*�U�����F��mW8�}aF�Ұ�?k�b�9;~�R���l���ڋ"�������)1۽o���%����I��r��_�.Je5�fZ�Ǣ��{�!�%�c*�1DF4o;bn�W��\���݉�Dc[�In6��50�8�==��8P�<�f�q4�Q@SFV�̠��n�cZQ�I{�dՃ5ވ��,�� ����Z��<�U�?Ap���&j��vm��i�X�� T43\�m���KS'`a�`-��������+���$ ޑ� 5 X��Ӊ[�C�T����aS5}�i�ɣ�� &�s�B.>�aj��V cG(�4���*��')�Hp2 �Y�V`�G)�A�:%gom�%��w���Цݤ����S�����S~��FMzw�)��֠���w�s�^��-WR��sR\cgI��6���ե����B�A��a1N�1���L�;�P%��1��5����1�� i<����dT��py� 7�����!.b�9[��@˥��)�w�N�,O���pmל��gx����Njw� �˝��+S״���J��L��D7�m�(��H�D<w�>OX "L�4�92��|X;��i�6����ť/C���M���Ҽ���G�X�H�="����s����ظ�0"�fg�lcc(��7��"�3h���槷]ٓ=�z�7��������`��\�Q������(]��\��ό/�V�&�R����Ӏ�Ey��_6��K5J�vE+���|[�˙A���]A�0�Eqފ��vZ���cE�����g�/������S~�� KW��)?w}�_x_LU[���Q�b�ř���ۛIv%�&w�Z���b���m�j�e�z������<��wg�y_���]!�7���?+oXh���d�; �-k�� ��0���������5G���6~G���u�ð�{� ��[���t�6y���It�p����2���L�*X�V��G��Z�7/6Bgγ�ͦ*� h��A1��O�\���B&i�R��!Y[@���MN�A���w/�ϴ�%��)�-N�{��2�����_�Mb8�x�����qI�6�ʒ�1e���F�Y��`�N�+��a��2Z~���W��l{�V��~��ml?�]�/�iBb��X�1�^s7���ۗT�#�_tn6f$���4�&���ůޞA&HO�D�����5#�]}��`��ZtA��C�m�u�ɊeӲiYKLJ��gP��LR��IuH���~s���U�>]^���K�i.x�L���Y����Ownz�����C��ʋ��E×��=]-4�@�Pȷ�
Static task
static1
Behavioral task
behavioral1
Sample
789990f90c04a0ec2e11124e357f5ab8414b3706c357ce769d7cf1f603189081.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
789990f90c04a0ec2e11124e357f5ab8414b3706c357ce769d7cf1f603189081.exe
Resource
win11-20240508-en
General
-
Target
789990f90c04a0ec2e11124e357f5ab8414b3706c357ce769d7cf1f603189081
-
Size
3.1MB
-
MD5
9d3e51541c25d2d2e43340ba129764f7
-
SHA1
9ce4f504044fbbfb9374158edc1242d90513234f
-
SHA256
789990f90c04a0ec2e11124e357f5ab8414b3706c357ce769d7cf1f603189081
-
SHA512
a5eb04eaf283b2cf7ee9b99d9b606d6ac5faea9751188bdc9b05abe27210ac409d1754d792f8049fd76da810bae3859f1e993a41b42e0a065f729f1ba6f13b38
-
SSDEEP
49152:rWy7hp1NMa4ZLHGH1C7JtanYunFyFnha2/XA97PHPUdcD9ru2EEwQ661lYGOcE:rjFiaRVCFtaZAh5/XA9rvScQ2E/6z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 789990f90c04a0ec2e11124e357f5ab8414b3706c357ce769d7cf1f603189081
Files
-
789990f90c04a0ec2e11124e357f5ab8414b3706c357ce769d7cf1f603189081.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE