ul�8��R�|��Q��BR�������E�幟U�� a|�r2��(<�G�]� �:��ʤ8;"%� ��W��K�!�8���7eM�t�m�f��+�JS�?̵o'�_Xl�w�W���9b����Hp���Riw�Z&C�6-���2u➩����������BdBVldg��ԟb�^ڜ���#Pa����ɘ �~7��>�Y�r�\�T�:Dw���E�:g4k\�le�[�*�M(r��u!}|��t㾢~[��h�-%j�䃽 �0��� Pf���OB*��V<���8 �� 0VYYD�1hD����mB ����DdW��O�Yl�фH�HE��I� ����E��蝮�C9$� !Nl6�I^pn�b��a;�lU�/h��ö��(i �6��!���%t����p�,l��p�<m��k�Z5�L$�����!_���T�@�`9v�H�#��G�k;o��K7��R���k �l~��'};�#�P%Q�KPr���_����8�U`��DZs�sc�Ȩ^;��(@��� �s���0 ћ8��� �UIZ�[D���H�o3���I�"\�����Gn"��ʓ�Jdl�mV�Ng� ?.A`q��f}B%���Fo�c��vV��)v�m�}�@@��U�;Bsr]F(��v� vF<DM�ɳ���E����oR%v�9�'�̹���9~�c� 0'�q�;��j��,��_�_����ͳ�q��ξ�0�p�*�_~� ���?D��g�����M8a�/U�9k�/POK�%M"z��o��o�<��� !nǡ���hoO�6�5��Z�@t�?]8B��PM�R� ԠHDy.����T){l�{x�;7� �mE=�y4u����"JeB���`���#E������C���(���:JBzp�Ce��΄���0�� L Yoz}�k��۬�-�7��eK K�0+b݁.���`�-KL��$��c@�3�c^8�!�^n���l�z��Mp*��@AT� Z��wu�-�?�m��-2�?��eյ!�,��� ��i;翊��Qt�#����� ��(�6���"�S�����o71�x�U�l���K���U[Q�����F����i�蛟u�ɭG�&��u��2i�Zb�՟2o������0���5��0�ҖR�UH����'ѷ��:l��J�F���F�xw�Y��k�ҼdQ�p���r~�ڑ���(�Ĥ�����:���a���bR�wm��L6���Lk��U{p������xM��$rfB�0j/?/��i�3 Jof vZ4���I�)7��s�F�O$z��T�!����{��#�7 sM���B�����e��&s�y���e4�l����Q�z��!�j�H�N�"��[�!��ّ�W}}�[��d���@8��=�F( ��?�9��y�����ÅL��6���Y+�}8�W/ ۵���x`Ǟ�&��6���� ZK��뻭���*n�R�D���Y���0ᷦBCݮ&UNń� 3�����-��|�wQ�C�ѝ�y���M(�|��bЫ��Va���Y*�K�Ʋ$�>�gOh������0�Pw���g��;`���H�=���f�q��%�9 �S܆���������� ǝXn5�;|�`�G�r2�Ę��Ƒ�[�sn�F�i&���f�ڥ_��-�[�6%l�-��:�N��F94]�{Y�l�҈��!+��6u��S�k�b�].�A�����J�Jr� $����0�T^���cF��us�7"J.V��ܓf�Cd�ǜ\0�X�8��Dν�?<jz"��a��T�ݝ7ax��r��i����7�n���������.��N�pyF���߸T&�6�Ci6�D�MH͆�J^@7L~�:���d�P=vt?z���.��WN�k�K���r�;�^�?ՙ8��N�`ė��6PĮ�0�!͗�8�K����n��q[Yq��[N�ؗ��h:��W(�D<�$d��[���M���͘�`�e�@�����J��M�b$M�[C�Q$5��%xo�� ��XY��ߚ*9�QO�XM*|zv�Wc}]6�5p&�� �M���}�&>��T������CͰ�6}��@.��E0W�����J����{����ɍ���A���e� *f@p6 o��[]���%�i#1*�J�:� ,[3�3�� {ѕ��AI�������M6�R�ǵ#H3;�ECvoM��E�օD�k��QR�[���Մ��*"5' �p���T� ��z�� L���) 6!P��3c�a�Yߵˋ1(hDѬ��[��^P0'�k�:�f'�r��T�j��G���� �%��V��퇳��G2tj�M�����q��M� j\<����|u*7�X�d*����ƥک��HM���%,s�Jg���g���VH� r��{Ҥ%��M��1p��fT�~�N^'���Y���2ms��P�#�Z�Hq.��/7������}R� ������%pVGXGb�E����Mᆇ�����&�^ �BcT�y8��3��y��������Q�|D^��f�cn�>��б�������@�i���s쏇��+x���C�n��ɉ��&�A^7s�� ���6�F�L�$�� ���$<W��R nH�J������/d͠���?�9������mr�Ϡ,�8��KU*�`��Bn�3䖝+{@0��]K{%G��$� ���'֧��H��i_��ġv�� �Jjŀ!�o=�@� %�{�w��!L��6�d��|b�쮈�*�M�1�P�bbH��X��!���Тk��(WA�*������F�sI=�ۙ��0MoY:`���ww�ӏ�FWH����֚�Q�p��WB�� ���lh�,��|i�武p��q�P��M�ϥ$Xb�`�L��@z����RW���rF��Y����s�T_x��^�3��q�0���Ƥbf;�� ��&�!(�sѼ�`�!�!�&�! �& �g�}���~h ���?Xc�A�������z�/�U?�i%jOd�-���G� �2M*�C ���=O�(����I���[M�9������S�m.[&9Κ��ʧ�C$ �4�}@x(�ʹ
Static task
static1
Behavioral task
behavioral1
Sample
9579e91f54417176e4ca9b47bc3c691452ac653bbca96a5262f810c223df04f8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9579e91f54417176e4ca9b47bc3c691452ac653bbca96a5262f810c223df04f8.exe
Resource
win10v2004-20240508-en
General
-
Target
9579e91f54417176e4ca9b47bc3c691452ac653bbca96a5262f810c223df04f8
-
Size
6.8MB
-
MD5
a3610011d95713d0aae9a06f5b315689
-
SHA1
2866cd9d1696b5758ff40cf470ec244cb8b9d7c2
-
SHA256
9579e91f54417176e4ca9b47bc3c691452ac653bbca96a5262f810c223df04f8
-
SHA512
3e522e59fb2e6a8145a0295de3acd5d21b06000c71c530a19f51e7a235b12cb6b5007d9ffd71234a59fc0652faaf6b3213cd4fa35364ada03849c84f662ae107
-
SSDEEP
98304:ZFyOwcIZ0OiNAfeCibaIPQRBNGZLQKRnYzvIIp9hfUmwJPR0dL27Z5kEuWdml3aJ:ZFMHZtfK7PWBUZkj1TJ0p0B23kEFadN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9579e91f54417176e4ca9b47bc3c691452ac653bbca96a5262f810c223df04f8
Files
-
9579e91f54417176e4ca9b47bc3c691452ac653bbca96a5262f810c223df04f8.exe windows:6 windows x64 arch:x64
43625c20078644f95a6eea8e51fc7df6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
bcrypt
BCryptGetProperty
kernel32
OpenProcess
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
CloseServiceHandle
wintrust
WinVerifyTrust
crypt32
CryptMsgGetParam
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 146KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 767KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.QXC0 Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.QXC1 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.QXC2 Size: 6.8MB - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ