f]:�M�i�Byz�\�8�Pgx�p��&��1K���������O4~�ğ�*�sh�8��K�ؚ�?;�Η��iH`mA9�x�{hL$���=n�����I �SY@̅����Mrv��}K�����S����;�[WQv���\+Z�Sb��e�,��.�;��B�i��(�����.-?��`Y�i95���"W�|�T�m��X�}>Cc[A�p��7�8VB�i��k���A�"I�<�M��}=TK#[Z3L �Y0?"��ѣ�����8��W�lӌ��ԍ?KO�����B�vӦ%Ij�r~w@�?7>*���������t"4��?�͢5�n���߃�.��!TG$���������X�O��i8uWd���KG[�_N�]|��"_4��O}���"��a��9�m�J%�TA����:�{��nW����% ;���B��~Ә�8).�\�ԡ���ɺ����k�5�ѷ�{ҕ�xI�4]�txy5rЦ��8�M�S���j8?@f�o~���~�G�����ͺÍٲ��\�FH�@Kb s^�)���'P�/}cI��� �o�'M�lr�g���ƅ��Vu9�^�R��z.�=K"6���(����Xv�a���'& �ՠE^9c^�`^��q���u������Z=�Ԣ,�P��JJ0��U:WrE%�U��%�* ��hAgs֢�/~�>cĠ�G�b������ I_���a�(i��� �SQ�Pp ����k\"��T�tVA����p V���~��@�ϥt���u�F�@�V%�Sǡ�U��U8��H2�:do ��H�}���i�SFV ��f1�I;D��+֖=k�� ��^���K`�V�KH��U�H&�~H���ȑw�����-u/��0홃{���k�����1H��d�_�Yf3��p/������{�e�h�l��IU>;�ϼ��K�w·'̷��� �.��q x���6�=��/�Φ�s�(��[��v���'��d�߀6�-�ci��� �P��]}��R��G$ ����=e� �-�ގu�L4�bJÒ�{��:��v���E�se�g��XZ\V��+p�>�(����;C���9I��\"5$Y���/\2{� Ez�V�T_W�9ʰs��'�C��S��\']� �ϗ���{W���wVT�N @��x!l1��HW�<q-�Z�o��'"fs��,v%Ԛ.���n�m��aj.l@a�T�- �2v�ss�/�[�H/�ԓ��.ar��S�7�TpRO�� 1O�3����e΅l��_�x>��~:�:B��b� i�"�t>��W�?�������4C|*5>YV]G���`���_-i�h�&������/��� �\�l�e�?�����$a���SV���S�W,�xR������yL6>ʗE*b���̒������W���E����:Wm�Q�$�����T���R����ۦ�e���S�#2�A2Յ��Gz86ЈWň}9��Ki��X��[�,"o�P�$h'5��T}pO@'�g������lg�2�7�`��x�N��TT�@J�{�Ē T� V=X�JT��@q���*��$�F�<�� i�ua#dV D�R��n��~�=>�bUu^�e�7Q-�����u�(���<|�Z�_+����j��V}l�B���Ǣ}�"T�j�j���/����V�2��]Z��p�z�С���V��݀�����,�X�(;e+��w[G<��#��������R� ��Y�I���2���g���<Ǭ�� �}1(J����w�K��&��,WZ���.��c���&��LJ����x��y�ֻ%HW��1xV�����x��� �t�F��Q����6���R�Y���i����Z:/wO�:3���sPO�_2f��r���=���+�w�EV����Ov�`3���iw�&�k����&>)����������S��T�x�����*�l�Q6X�6���)�'u�����.�U*T6�%��da�#P��a:'�#N�!Eu���Nk���3�.�:�[���)����Ԣс�V�_ G��7����O��.W��M��o��MڪK�I���ޛ�V@֮�Y���ɇ|~AT�Z=g����-�]^�u��N�:����d/��m�,�q&?<g�<�>�y�iG�Db�/L�����!��Kr����7hݍl��q��s/������-a>dR��F�Dl<\Y<Q��r�54u�mR�Y��]w�>�+��z�0��d~����r�Q���̾V1r�"�ũ�ҳ>���n�,�L����U曲�n�:�g|�zX�� 2��f� $\#}��e]<��^�eԶ�������p�O[���H�%Y�?�O�y��e]��B!�,3_�b���x��\ �����$1��Y[OxX�=��?���M�Y������r���<=aL�a�v5��!� �ܾp��5W��������零{{��͌���iWC�Z�tF������j��+��p�E�-��E.P�~~$�1��V�j��'7���m�q�L���l�Qx���İM���b�f7����>�k>) ��ei8��w�l��:8TCy���*cd(*�����p�����q��� |�g%Wu^m�~��"v�o8��e z(��fy@��m��f�0�P��a��+�'6�î~<��+͌�ud�>[d쯂���<����kԇ����-�D�)�j\--p��5����9Nt���U�,�M1��۹,b4��5�_|�_3�P `_r�!���741R���f���5�96S�>ݔ6��vy����o<�{n�����,�X~�)=�ہKI\�Q���z��77o,�i�҉�<��]�ʶU�,[��E%���~c���_��e���y��nxQ�N���xA�Հk*v���iw�t�{��X ���5�7��s��d�~e���a*�}�#9�w��}P���ɺ r$�گ�Ս�*���M ߰!�x@�zxsj�Î����*~%�0]=�3�*x|�'�@�__��Hf�= 5�:F��vK�a �Aj��5F{��Mt��0s����آ�I2q�<��C>C�<�B���o;�,Uy��Zz��fW_O ��x�❮���;��{���#�+�ЊC�sZ��1L����Q��� ���E>e �o�B�������U� �� )#����>���S����n�m�k�זm�5YO]u�Ͳ��H�\M�Y,9������N�<ꪷ�����Y�Wj�+�R^�G�D�X�x�"=����u�RO;M*� �rG( Lp;BUx�<�a-�T;jh4�2�CaZ4I.15;͐�Иl"S�P�W����[�HW��������h4f�MQ�w�%v��.���w����DT]<M�:mx)R;��#�.� �NJ��2�B]�����������,}QY�_:� �!����p�t ���>_j��m��Xd`�}r��֜�O��)�V��&��6��gj��gk��no��%NmWr*����&牬��f�P�K0Û�"'HM�m�Nk�|ۺ�F��Z|�e����Ǚ�
Static task
static1
Behavioral task
behavioral1
Sample
32016b9fa4a40791faeedf08a7e6944bbe3bf22767d34eb76cc10efc61362eae.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
32016b9fa4a40791faeedf08a7e6944bbe3bf22767d34eb76cc10efc61362eae.exe
Resource
win10-20240404-en
General
-
Target
32016b9fa4a40791faeedf08a7e6944bbe3bf22767d34eb76cc10efc61362eae
-
Size
2.5MB
-
MD5
b0ba860b42be7fd7f182a8b2ec6edb87
-
SHA1
889f4e40928407f1fe58aeb39179fd338837bc3b
-
SHA256
32016b9fa4a40791faeedf08a7e6944bbe3bf22767d34eb76cc10efc61362eae
-
SHA512
ba3cfaa6053a7bd99aa547eaf80a43b2155960e3a4613ed24e02b46efd1b9645ba9527b8abd1b5ec8a3473cdb2366e09df40b08b868f24a22d56f04b4b69133c
-
SSDEEP
49152:53y0V/CK+ulziFeXX1ZYc6bUEr/BgsllRnODc43MHtMCQuMyYks:53y0p8ul0qLYDBJPOIZBMyYks
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32016b9fa4a40791faeedf08a7e6944bbe3bf22767d34eb76cc10efc61362eae
Files
-
32016b9fa4a40791faeedf08a7e6944bbe3bf22767d34eb76cc10efc61362eae.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 140KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 36.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE