S�y�zr���A�S8c�������"����)O�H=�@D��p�v뒈����_*4�m���i�$!����� ��JE�捈�E��1�5���}�V~C���s�=��s犓q��е��$NE9��+ߤe-�r�6(�)K�dc�s,q�̗�"�h�/PJa ��2+��Cs��K��Z����L��S.]�~�$�d|�ge�B"x$N����KZ\$h�����OV�v&M�?����b�>���R(�kS?%L��#�z�W�F�a������E�P�5���}�",���'�e�p.���aP'�<�܋�dž v��յ��&k��位/��>Q}�f|��W�C���v��ɸ����z��:��͑^6������;�c�i:ǪЕ��[��"�TP \��.S�Lǒ�[�I�UzY�O�W ^g��Q��wq.��_68t_��3�&oDd�!0ӫ3*�4�)�)���`C:�݀�@qJƓW�T�쀶֚���۵Q=�s�3�Q��są�E�'~Z�KD�?%�[_� �"[�dZ��י`@9'���57 Wl2��� 3��U�o��u5��(J������G '�֏B v���zE�����ˍ��g8���ܸ�_&oIZ :$�2�D82�h�8*���d�Z�\,��@Gb� �6����W'�2�D��;i ו� �ӫ�Jd�p� 6W��<��ӹ[�>�q���F��p������`���5n�ă�JG�����k�u��S�Mb߽��4m�Gf�oҬ,�:��?���`h�DM��=�c-5�¹��剘-���}�a�Y�jDk���A�)(�ű�(�j����$��}:W����$�:0�0��x�w�t��bΩh��ټ��{�r>��H(9��B&.������G)�'A�Dbʢ��LN7���_G�ƃ|i���P�=� & o�gL��Ƞ�Y@tVYKg�����6k��ty�����Y�!��z���I�t���C�{[x��F|:O�6A�+��}t�uxm�=D���f����g�� gK[��D,���Y>ֺ�f+W��P/�������7�0QWR� �3�F&B�귋��#��z�H����'�,�R�[-i[����7������;��O�Z:2������{�Q������R__�X�����B��U�|c�k�Mp�����t�{�6����?��:'�d��(�\���>WYuk\��1͔���ֱ��Qvi�� �գ_�+��������|����uɒ'���œ^�<!��Z ��cOc��+�[� xlO�����)g�%���3�P��*� -X]MgP���k�s�U��ij|�k��@�(��S�n�b���^E�5=,I��tu��&�g��n/7F�*�:��2�}��n�X&�(����E8*'���i��>Cty���6ؿm����E��P�/�A���)����^�%�yK�i�\d�����sJ���d�~H�kW�ޥey�yݟY6��Z��e&@���C揞���vw�i�~�ND/Ƈ4F)�V�T$��lH�uw�-z0>>%�j�ƀA ���J�q_g�t��m��jۉ���x��U�ַ�_�������ѐZ�oףG+����l�o�ac�}I�vl�a����`{�82��IV��l{�Ջ�K��K �Z���zv�9���I|���/����:�B��� �W�����9��~s�8���Q�Ni�jA��[yy��|u~I�q柚]2�^`��\���_��q{�/�=��X�g����а�$�������h���P�壙��Ŕ�h�Lnf�p�a�=!����2����u��FF�'������=(��R��q�I!�=o�57�(��x��f�K�1}ng����(��w�Iq(�\m~����� 3v�l�F���?����V�g�����&��6v�N�!M����ݲ~]�����=��=r`j��m昴���K!�oZ����x%��Z�b�e9w��yZ��2Q�uu�6 ��>���n ��R���N�L�����=&��c� ��Y�i�LY-F�ʻ�_'hC��V��ln!�q.*v�b���L�� �T@�F����0������U����p���Z������W�{ҽU��X={%{�x��B��n�����g�9 lˑd hn�J�"�\�}�GT[��!K�3}<�no����E��SSE!�����F���B�E�]���S��ͯ8"��~�UD���Қ�>����)[A��,7�t�M5�,�e��w�k��#�����_8f���k��oB,���������Mx�Y�]���̔u��,^�1�W��V����=.z����u�+����X��r�Lx/eP��]����Y� �y~ӈ����Ԡ�<+8�3<R�\nb�VĿ ڹ����ut8f�ɮbJM����^h(��CI=��؝�(�̙vs�d�@��pG\��"�z��-�=m���f5yu���<�kLё��*i�mn�kѠL�>g��if �,�C��Y�-+�\���W>5*؍���ج�� w�����Z�g�ȼ�#TT���<E�A���D�l�E����*�mz�845æI#-�V0��.OF;&i#)��vӺ荨/ckȑ �$Ҕ�f���&*�S�5�d�NQ(�Y����Q��c�c�n�|���8jc=�3��CIq��!�?�Z��QJ�@�kXض��) ���Ė�ݠ���G~0Ŀp�P����9?0��ɤ4k�v�d��o��1��_��D��C�ox��^hہ��Й0���i�#L�`H���Ġ�I#a(�mn��W\2�]�6B��A����=������\�R&�8�� ����@Җ�6Tn�cQ�w, �/a���a�d�xL�0%;����B�W�-}����Q�`M8�e�����[)G6_�1z)_�ށw[�3ڎ���R�[�dil1_�}�@��B?����~M��d%M����t���دa^���{�v���=�/�K����Ƕ���E����O��FJ6+�X�� D�t�Ң���t�&B�\�Ėǿ�9�!��,Ėbǎc8��hJ0�\'
Static task
static1
Behavioral task
behavioral1
Sample
09f6adc526f67c9e5d0f13da963dfbce00b4a4d1b62e2eba3b8cb22952fb3d76.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
09f6adc526f67c9e5d0f13da963dfbce00b4a4d1b62e2eba3b8cb22952fb3d76.exe
Resource
win10v2004-20240226-en
General
-
Target
09f6adc526f67c9e5d0f13da963dfbce00b4a4d1b62e2eba3b8cb22952fb3d76
-
Size
696KB
-
MD5
41db438bf03b9d8a0bf337d49be9c447
-
SHA1
2ea9876bda7473d6df2c3f012249560fb5613560
-
SHA256
09f6adc526f67c9e5d0f13da963dfbce00b4a4d1b62e2eba3b8cb22952fb3d76
-
SHA512
16857b39fc85989b79da62f62b2e32e7a774b3125c2059b9a1381f8712dec13bb145d2ee6f3652d9b62dc33317a8ba6ca2988a320c77ec67681503b09e9279a3
-
SSDEEP
12288:lJFUWbHuDYFdqwq3bHE5VcnCS5bVk4LUmglR+Q+oiNg6VAYsv3O36LBuhCDcV1PT:lJOWTIDY5II4L2n+Q+5g6VSfe4uhzHPT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09f6adc526f67c9e5d0f13da963dfbce00b4a4d1b62e2eba3b8cb22952fb3d76
Files
-
09f6adc526f67c9e5d0f13da963dfbce00b4a4d1b62e2eba3b8cb22952fb3d76.exe windows:5 windows x86 arch:x86
0fb0fcd7c71a81ed2f9a4f184aa4a517
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord645
kernel32
FreeEnvironmentStringsA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 325KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text0 Size: - Virtual size: 616KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text1 Size: 684KB - Virtual size: 682KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ