(1(+��0���&��Ӟ/��1=�C")��l��|���#��9��X�W�skW�Ԡ|���A5��t��~�8���+F������ٱ�i�/>�"��f\�H*��"�B��z+�_҆"Po跗�!����������7)bw��P�C�`��3_68�ć��D9�|�Y��*�c�����?���jXd6�8~W��95�����)f�������9��H W�Re2��O�����RΛ�a7��>�&0�)�}�}&��N������H�vӤ�G�Bc�s �����x�t�d=�����A�yM8$N��4r��u����s]Cםn��^����5�x�|n��d�J\v���W_ ��.I8�[���=��ܶ�0�x�8�WUU��v� wr����LG���#���D��Y@�U�))�*�N�k��Ɋ��y[9/��E��h�؆���$�{�P(#\��J��KE�.���(X&QH�|�ק��������7Ζ\�3�����%d�����ޜ�Ka����V�����.����f�.�AW�Ʃ�� W���z�)ZQ��?�p7kƞ��T�,k�l֛�#�~>�?�tG��ZA�݊Y;�+�� ��4���Z�P���-�k�sX����:|�)24~��-_yw���ˉA�-6���x�Ʋ�Nx��,��7��!��Fa�=�L�'ޅ�)���r8U����6,��0�-�0S\[G�-�i�����U �5�¥�Hg�(����ǵ~�}Ǘش/��D�9aN~��j����M'����� W;t��;+�6�F�Ms��<���u��)�ݡ`�~�َe<���y�I5���Y�Z`T�i�A�P#�F$B���t�5f?}X&r���@O�p�<�B����4�����jnB|��y��!'A�!��i@��Q>�)��/PIkk��T�`l�@���<I!3B��}~:���t�s��o�yq{�Q�����j�r�d� L6Eݻ�ɑ���-&�5[`���������� ������FC��-�!�/r��\G���㏘wѯ�ݡ�Y>��^1�霔��\D�uR�s����Q*�����[��N�7řn��i8 )��^G��<� �%a�"c���}Ƒ�Y�� ���4��O5��^B�`��C��j!��9��=y�}�E?p�$��dۼ��,��6*#_�x�7�5�1x I�~M\�N0k렊�/4���1�YJS�z��*�Im�-��?y��)�u�L�!E��>r�,�/M��^���.qr�34f(��" �JN�3_��n-)�������s��<쉛cfQ���P�!�A�9(�����wR��wy\R�U�"PH;�H$r��47�T��F�;I��̚���+��g�6F��W�o[-%�o6Jj�p�5����G^1a���ѵ4�-�n_�?�?0��1EW�h� Z��+����A&�&��h<���;�$y�5��gP#1�ΓB�|�α���c?n�0�}���m0�S�@T�{x��8�s��T�� S�%8����iy����������;��<q�7j9\�Y�|^����h@���G38�W|�n�--������!ɒ��Ͽ�@T�l�|rw�EA��H;�MޣJ���$���P����C<��Pɷ�M4'o�����zP�ӽ���<f��Oj��RX�t�Mͥ��_h��A�6��F$�sWE0���z��'��@�w:s�>�ȘʔR���w�]���!�����`���C��z��@��,*�j�/���Ӄ�$m�gOӼ�1$K��o�����菉�R�YQ��k�GE���J� �'��Q�w�OE:���m��X!��(qC��\X���.&����qtW����ڋ������Ƣ\ �\�B�<`B����į�aAld�Ǖ�&����F��:�w�x�3�z̰;z�K��Ծ�rr���x!��3;i���eo����;G�s9"���q����K��ᕋT-X� ���"�[��.�����_�bt7��k��P�yCz얾�Hj����a���`A�G�7'��(i�<~УJ"� �7��](+Y�z�,�����͐@]�o>��ީ<�(^K�8��wIWtmI�a"u�]O �6 ���(����d�"j�� �i�O q�)�����S8W�~��R"��б�rkr�[�5=��`]ςC1P{�N��2��0b5ػ|�5�,I��V���� ��<Xﲿ�%\nw�r@��n��@#ٜ�1���sJ�;(����b�NI9���x;h(�M��_k�����70�; @�������Ic�|q<��u ����Z�?�i�������)r�7`. ~27b�b�s���]c'��m������n�Lv*<�E%H�d��ĝ۠7�� M���L���V@�MuP����MI j���=��1�\C�Q+��Ŕ��u��K��l� ���iNZ��JB�_� I�$���e5ZtLkЗ�N�豦K]���a Qg��PQd�os���`��8�fiK$-�m�4lR�ʤ�b����6�0���?M��>�d�@��r�K]]�MS]��P�o��ZC�F����V��֍S���gˣ��4&����kР*\~>>���m��m���rv%����0�=��WH^k�q���:��A�A����L��)�2S܈T��}�$^h����i=Uxs���SW�J$и���Q�ߢA����)�<�m[�!cK9cfȐ��� E�Oa,�5���gY>Z��jΖ���`|���۽S54P��1]���%�۴cƢ���2y˨V�����9�WP��uw���6�%���<Q�c���f�� A'yhh#=���b��,V�}~� e�XZ; �u&���h�g��tb֩==���۰��q+�rv���@��I4�������=m�:��H���&k��?�6�c������2F��)Z�ø#�\:�G���U�W��� bE��8���B�o؈�JD;�r[����b�3L�v#%�`�;�U/�r�DKpb�=�J �ý0�y�+�"j����%9�H�+.��:Y��4����^��Tխ������.A�s���m�4�,���D�&h��@�\ Ao�1{�G�I��fb��WU/�;��?H���^}�B���~Ide��.�$J��&s�y#13��%qd�c��+/�~��XN����zm�͉'��<���%C�;��AɠMr�o�Pl�Qi�M"�,���6�t7�̳Z��jgE/�~��}Y�ٌж���Ԑۅ]$�*{ě�C-��q�� �'=�^n���j+��+¾N/�d@SQ0C0p�\��0ҡo�a����r�7��#XF������d��uuvk�j�W�[����LL����[�j��s����`�7� :��۩������\�Ҟ�0tUq:A�̸²��`�o^��x;���u�9~$��׆.x_�78�
Static task
static1
Behavioral task
behavioral1
Sample
c9155f89c82b6043a474addbc6afd42ea2fd30c242fcb99266fbf0b6b94ec4ed.exe
Resource
win7-20240708-en
General
-
Target
c9155f89c82b6043a474addbc6afd42ea2fd30c242fcb99266fbf0b6b94ec4ed.exe
-
Size
2.3MB
-
MD5
c6af01962d0de9d10623edafbddce24c
-
SHA1
22c5c1c8ee8aaa7a9e7ea7bd9ef3192f662e8b72
-
SHA256
c9155f89c82b6043a474addbc6afd42ea2fd30c242fcb99266fbf0b6b94ec4ed
-
SHA512
13aef4f40d0eec90663ea3a3c30aaf3e9e12ac2c32652f9c303b130a2866dde8229adb40330fdf7fb603c552e5414f00ad32ce6fd244442474cf68bbcc741701
-
SSDEEP
49152:YkI1MLbjnXAsJ1aeuD4BBLQeXc4GVGh8uqEVUMwzImEFv0cu1hrPO:YdwbjX7JsXD4BlZsYlUBIlcP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c9155f89c82b6043a474addbc6afd42ea2fd30c242fcb99266fbf0b6b94ec4ed.exe
Files
-
c9155f89c82b6043a474addbc6afd42ea2fd30c242fcb99266fbf0b6b94ec4ed.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 41KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE