p��s�p,�Pf���.����>��{qDD���4��a�Њ�l����4�$1˾�1��y��.��i��Y��Â��t?���#�fR��{�S��^ �Sz< {y^��Jϒ��d���� Ѻ���^=� ��hV�Ȅ�%�p�'"�o�����^2 ������8)a�"0^�;�� �p�z���"����'b�� ��{i�=�7��_Gx "���b�� <����Y���,v���bg��+L�c�a�����k�*�� 9����av��>�� o���i�4�(�#�����=�?�Y�!ѿff'��_.Ua3|[��&�z��ݑ8W��>h�G���:���Y��jլ㛞~�%���r|C:V@5cVaz��f��)�n��ښrT]=�J������38s��_@��2"`a{�������0��Mk2�q\8ܖ��^_����\��ٹX�<��ڹp�)w_�!�I�!�����2�0��=}KFEY��(��� c5�%���ӿ~�u_���+��1<H����*��Hr�Q�0]Jxp"������[�R�epSçPo�$�y���ָ����� ��o� ��/qXeM�5J�Z{��#b#����-�I��W\��#�����T��.��y�63�z]���o�O7�U�O�R�wp:����^���Q�הu���������w���:��%��_�j�嫝�����l�_�Qҵϸ��s�$��L_�F�o���, ��L�LR0߁���NY����9;���q�}}�;| �F o �_U�F��~A�mv�Y�O���@���3]Y{N�pM�-�̄����3������b4�$|��� b�ؖ���c����&�k�wύ�Ĝ�-�f��`�|M��t�s�J�X��o:ѲSq����CH�\����8Oļs���p�-�������{r�\�������$/0�kI+D���|��ԥ���Ϸ"�l������������}��kp�z-��5*?�g$�� d��|\�Y蚝3H�����E��3�Â��l=5w'��W:�f�H��HO[ց>��k�-��R#�P�U�'B�8����>��3�|���1.�nD#H��G��I+=��d �뺵h��&����E�=�t��@ȟ�[�Ԗ(l�����VZ5�J��&1/}+�u� �G�i#{��)�`��l,���`Xc '������ڇ4E92 6N3vo3-����a�ϡ�_$� �R&���(�S,�&���E��f��9�شH�����]Ջ�?O"���Xq��zA��fy��@(SB��_�C"�|�d���,�-���D���+VGG�M�?J2B2@�E���ڕ��A���&�����~A`�2�{c�> 3�Ԣ��6��$�w{��xng��{$����9k��B�hM���qws�����v��6��{����p2���')�����=�D3 ��*��&�z�����<���;��Z�Լ����}L6���x��oG��s����f+n�W�-�'s��+�[.�O�Ƙ��W�&��><K��e���ZD!X �]g�(�bt�j@Z����C�_m�G�Q@@�����iKT�=��֟�;iE>���7"֚ё�P�����c�x�C^B��֢ȋ��o��5�z�V�UCF`��{OE3�1l#w���G�Y ��r�σ�|r������.=�k0^��_�s���m?\q�-Er��L�/�S�G�O�} jz3]����<;7�P�T��T `Q@��(% ^��OĀ�����&\��[����G��)p�J~�lU��Y���S)�uʿGե5�k�ƾ��;�NoEз7%{r`�g�H�1��"�ěi� 2���a�� Z��0p�ՍedN��³6IHa����b������� ?�c=���,ь��,�A�{�cB���p �E�{<��,)�*���%����Auy\�������ػ�Cx���`�WG4�3�[<f�%�Rk\~_�<���0��W� �>#�T"Y��<T�� �?Djl��� nl���K���M��0'��K-�w���ey2�\Ү��̿�Eɟ�5���r����x��y�����u� �h����[��\����(O��D�e ���-5����V�D �d~[��cv�c�4��Y��C���o�9Ws�`��\�M�^�P��#[�eq��8��y+���s�Dg��g:�Uh�JO=�u� a8ȫ�����d�u�,�R���/��Ғ��o��1Aq�X������Յ�ؔ�&�b�=���A�Y�{I���"ܺR��!�E�ǡ��'*�b� ��E���*EKn{�'��8�Y�K�Js;�]��l�y�X��\�xL�K�s�# ��)3i(�g���\��&D)�-Ds��� ��6 B��M��u5B�^,t�Z�lE�9[���C�L�[��&�]��L����$WǕ�,ʊ(Q�t�z�����59�(�Ӄ�a�Yp��k�]��J��p��u|z��" �V������w#!���mvӉ���j?q�*�۔/riPՕ����X������k����������z���i�d1�H�&Żb�����}äm��* �5 �R�%8�>��bV ������^w�Q�c��9�\e�������Q��p!�/���` ����� I�0��=���-l��Ұ<�D6�s-N]ע(0>�8d�]������-S����2�Q��"��v+Y��`H<�����lYk�ߍ�tM����Ub������;T�oӽ[ <4�j��BѨ��ܩ��z��͒~_rk�D��՞r �����.>�A��a�R��#�RQ�}#��$I��������\/�S苺j^�@�%�y%3�z���R�İV�(�g������W��/�=��0=� 43���AN9%�l�|�c�j��� ؕmm�WX��+Z3�nA��)|*m��K�ch{���c�q���{c���S��\�`���J[��3�s'������|�Z݉?��#�ǜ w3WP�>Jk����'�-l��uڰ$�C��ۜ�8M^�*A�J:�Zt%d%��F��x������Q��Ȋ��,W���c�Z�wV&�hQ���V�����BvL��l�C�b���Z�a�����a�>q��x���a���ݝ��}_H�byH�Pw�!<?7���x��@���@EL�7��)b�eżl�T���y�����Ő�" ���:�b����r�i���B�h5�Ԉcà[ ����0XQW��_Nb��ֳ�%��C��Pg��H?c�Ts�������t�|��?`�J+ӗ��C��{�5��h�~�����|熌I�}���y���2���H�A�fyğ�i�\��J�[̍U:D���x�:���ߘ;-���uh֥ʻB"��[�nu��;G�p3�G�G�t��d���{�sH�X�))�"�!�/_�'�i�_ &�4��>U�JDy��+��#�~�d����s��� ��6LM֨�ܦ�M����*�*�+}���� ��./(�k����,>����f(P*�E�����P�h��e��If�;tƶ�T���.w�s�}�-�����n�%'�����ܖ+b��I��y��\hE:��3�n>�Z!v0L�a�*�Jnь]���%4�[�_ �>R�#[c%����I�����T��f��˽�ԯ�}�j�4� ���+V+1;�!k�X��.R�l}/K�1#���b:�0u@*�� �S���F
Static task
static1
Behavioral task
behavioral1
Sample
9957b602d1f3d5103302ba2e773fba19a418153eac45784f8515b88b9f2941f6.exe
Resource
win7-20240221-en
General
-
Target
9957b602d1f3d5103302ba2e773fba19a418153eac45784f8515b88b9f2941f6
-
Size
3.0MB
-
MD5
1ec7eaf27e38d3ad11487f36201325ed
-
SHA1
2c497c7a97c0720324b9e845c330ff1bbecaa004
-
SHA256
9957b602d1f3d5103302ba2e773fba19a418153eac45784f8515b88b9f2941f6
-
SHA512
15ee05b1dfa074bba9bbe061baae739148fafac72a52dd660753156bdeb0486a925f8768a07ee41af539db0f092481d5d9d6da7712c9d6c8b1a13a5b61ec2bf9
-
SSDEEP
98304:/v89tz7Hw1uwDn0rR7dqxk71+RhkjHHm95gVrr:/kvz7fwDn0rDqxO+RQnm95C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9957b602d1f3d5103302ba2e773fba19a418153eac45784f8515b88b9f2941f6
Files
-
9957b602d1f3d5103302ba2e773fba19a418153eac45784f8515b88b9f2941f6.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE