��p��\���n�����)��)���f��\��לޥ)�ƣ�;���{yO�_�!�0���(W�IW��yҳ'�bvŰ�㸁{�}۠)Z½m /���n)zn��i �6�~XT�[?����� ��/*KBK�Ե=��-���ֱ�����P���U[.b�_�yO?U؍�P���[a��?!�"��J.�����n]͑Y���Z��t���ƅA7i�:��h_zb*Ą%I��0�[�h��P�5�^D���r������ RV����%/1d��gFSF�י�G�l�c���G]H\O��8�2n���U[4%��3�$��:-��w�B)f�q�R����^�SOR��\g!h��DE=���� @�y@5lVq ������2���Ce�9v:� ;GD��b�%N�����I_���&�=����~M�������CR�9��W��F�ň�"�ݛ�=P�?������RF���G[����^X���x�m ������F��Q�J��T���W��h��;��}�:�"WPc�F�Mh�Cz5�PM?�����a�&��EÉr�%Zn���}�$9R[ڇ���Oo��C��=�$�����|�_�Lj�m1A�_���Y��$��R[��ڶc!ϲ I�IF����Ci��_�)��J`!�v&ʩ( ���B�Fb�?>���}�����V2��m?��_;������l�Z$V�@[���o�� ��.A��H���A�8 ��m�/~za����F�� ��ԝ��W���*1A�� �Tlљ)����F��w���Q���!0�q��ڕC�i��0�⺗V�e���4�q�U����ѧ,��ؘ�����Oھ��O��;�,Um^�nI�j�_ ��4]��*�����v�����0�5b����X����7�f$I�+�p���2���ɷ���k?��� ɿ�4$�j�f�Q�p)�n��J���~�Y,hF$�M���/0G��R��ȅ�H�Sޏ=�d���(�u q��:4Ӌ78n�a���YN돔>��W'!Q��t�K��L�&T�0S��Z_d��|(a,/v���şv�W�>Gi��w�4$��b�a�7O,*�������?�[vA<��(.��e *�+��c��;�� ���k�w��=)ĠNH�7�;�g(q*ўx mA�y>�F��$� N ����Y!S4%r�K��[��,�g�~NO_ �����(�B��c����3�};�2s_�'��sp6����cTW��J���}C�q�#�e��a�u$y����5KI����ÐȎ[(;�K!\}��*8Dſ��G�3�bY� �%�ɜT�Y������2�$`e៊�����g��~g�?�Zm�\J�U���2 ���2{���`<LS\]�M��=�� ��2W�=���G�轰�U�Mg��l�����,DBYz��6 �U0���%Kə��� �v�%��7��j��Δ;�11.��7��o�H%K�[=�t�d?���k��ȕgV{#on�]�� ���k�_�Q�)�����R�Z~���E�w<Uy�}�1��\�P5&���i$�c|�x,���,^�^�JY�3���B���j�ģoE�'%&u�*u����y�o����yM�]�6���!a����[�9�\���h���˗�!f<���3R�VJ{#�[��:*��k�~�.��j�**L�{jO�SDŽ��p^5LI��$��.������F��Ep�7�%a4lw Y&�rl��X���M�~a��?�{���gö����f�6�7�:8����lȅ������}���@1R\^*�S�+�'�J�igf�ԾW2����[ u�W��Pǜ��\ƪ�ucpv��Dm�LsQ�5)�}�,�����$#E���0�'Β� ^���L�tbpT n�&��XMh�}����֫�d���9�s�f���u�8����l�/K�(���j���}<2�J�goAG��w����íF�1L�]6&C#�����f%� ��{9>�l�<���0$-^��"�,�=���ѽ�`��"����="���,U�QW<��/���ƛǦn? ���CM�s�E��#^ut�ё5%��sx� �t�3� �z�>*��۞A�@�����/�x@ՒKfK�?^��V�崉��0`˛%���KU�c+~@ڄ��ڟ���l��=������z(of��:O��f#P�" �O�P��%����"�"(>�U"Ñ\2\?�c�\�ʩp q��Qf9 u�+Y\!Ԗ!�����] j�0��'msv��9���s������������C� �'��{z������Z�=����7b�� �R�!�7�Zq�P�����c6����� %���$*�Ǟ,�� ���L�6���;�-��)S�������ǣ�Z�)暍�=G-��*����e:)vel�q:j&������"�d�3�(��d#&���&y���l�$m�Rٰ迾��bU�]�����.������K:D�ٿ5���O#O.��|ľl���x�?oL���I�TB~�SD�䃳mּ.�>�I#�j��� ��>g��Cx�^�+��]jP'�o���5W��͕��\�J��b��z5�J�*Y�D��5��?��6m�� a/�;#_�Z�`��_���CpY�N�L"��9D�á�nM�]J5��Wi�����G�<�. �+��7�J�c��D���`w�^C��0��ލ|����� ���5���KF$"�8 hr����H@��Qy�� xb�l�2q��'��눝��Ŷ��ۂ�'NFj����F7m$b�ŋK�H��G�'���fIF����[V�wK6��ٟ��X�W���+�`Ym��c�5^�PS�F>5�Z.���ȹ:d��e�֯�X�0��ӕ��|�.��j;֊��Hh��/��s(��ma�/+Nt!������^ek�>��ܯ2�Ljm���bぞ��\m�ƻl{B9I��[MLI�B)��Kx9ņ����;�)��k�ٛs�c�c���<m,��FzV5cI��]��V�B3���@�����u?�g����� \5/�ʬ��B��!������k����-�0�H�͙8
Static task
static1
Behavioral task
behavioral1
Sample
9efa08105fff72a27f84de377d66b3f0ce02fa5c6280a60190436969adbe532d.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9efa08105fff72a27f84de377d66b3f0ce02fa5c6280a60190436969adbe532d.exe
Resource
win10v2004-20240508-en
General
-
Target
9efa08105fff72a27f84de377d66b3f0ce02fa5c6280a60190436969adbe532d
-
Size
14.6MB
-
MD5
756c576db1b2495e8a320d01a0d48310
-
SHA1
d39ff54d4c8bedd420ac8b120a6899df2385c2b8
-
SHA256
9efa08105fff72a27f84de377d66b3f0ce02fa5c6280a60190436969adbe532d
-
SHA512
69458be3c3bd5b6c247c606f4e6d28fbe33a6eab9171ffd759abbb79f6c77c7301ef37e8f4a6a691a210742c5d9c3816f1755775dee23c3fc3eecbbb9b344469
-
SSDEEP
393216:YNyYJsD88B7eh4vuptYBOhYe1onjiJMyNOL14lLKDOA:0yYJW5VnvuptYBR+dJMkOwc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9efa08105fff72a27f84de377d66b3f0ce02fa5c6280a60190436969adbe532d
Files
-
9efa08105fff72a27f84de377d66b3f0ce02fa5c6280a60190436969adbe532d.exe windows:5 windows x86 arch:x86
ce45a45e66600dcca31db3d25c0b2bb4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
CreateSolidBrush
kernel32
GetTickCount
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseCapture
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
msvbvm60
EVENT_SINK_GetIDsOfNames
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 51.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 669KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.virbox Size: - Virtual size: 339KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vdata0 Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vdata1 Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dat0 Size: - Virtual size: 8.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.dat1 Size: 14.3MB - Virtual size: 14.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 312KB - Virtual size: 311KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ