��MI$����+��ڵ�(��q�*]��7�^���{�BP��}�M-����qu�J�f�ߣњڱ��[ �>]9�I}�9��͙�*�Y�IF8�cwUt=��V����5z����REs��p����4�u'��������"?B� �CѰO[;������Z�k�S�|cK Tm�o�p����s�,��|ɂ7�oacJfJ+u9��m�f/��*�\أx�N�cI�^�"��D���oK|��n�� �R��PL�a��memO ���"-���A��r�Ub��{�¿� �58o4k?�1a��P^6��}{Qt�ƾ7w,f�S&���u��0Ov�y_�>l[ ��H ���+���ۢ"Wӣm�!L�ڦV��d��8I�i� �+ӎ�53 �;��H =cX!�n�0푅7`�3�s�mEd���Jk����ҌF����|w6M�������edʈ���a���1m�qU�j��q�,��FZs\[B�N1��58w���]�F�n����{m|Y��ky��C��O�L�q��`�'D����f��KC�c8W��٦��&���c��_4s�L���KU��d���)�m�U�N��y�����';\p��ȿ�5:�9D��v���K��0-IF�(R��F��ߵ�wd*ۇ IAS��h]�l{��&���c�h, ?���|Q4���r� �g�)�e1��*�Y<n�3,چ��� ��\���}+�Qo���`��>I:����ur^x7N��)'��1�)jV���áƌ@�}$1��@ ﲣCnSܻ<�Ջ=�b��h����0p�SRo~�O�T����6B�����94e.�@"U������?�325�й��&�z�^tm-��c)� �4~�E`���Hi~H��c���~_��ŭ!H$��"�T���V���9�3�mD�Y���8�c�ڈ�Lc��B�_���A�R�f��9zA;y�O(/`ǭb���A;�� ߍ��lLD��~�V���Z������W�*����O4��mäX'�NL�-����Y-���@M~?��0dN����z�X�hTx�t���vt�4�p�jv�q�g�}d;��*�k]��'��w� Zk����� ���F�2����8���ͮ�\�w�z�ʉl����)�91DF ݮwDܯ�&�(�u����E��!�Ex����_�^�7u̱���9]�K1���C�T�3%#%ۦ�To��c�!$���U��2Ffl[p>��5}�Gʞ8_���!��c����$m�ܵ�7J�qW64h�7�(�KR���N�&+ڏҫQ\��[��+�آF:�|�����[���p�[���{�l��qS� ��i4��p��ݽRk�6ĭ�2��]Z�� ̅z>r���pܔ��7�c�%�T����3��r�:Ǽ^]ʒ� �.���v�X0�J�����o1(T8�����%1��κр]u*ۀ���،ȼh��t�LܽFJI4*�:�����X�[Ar1b9�O���6������k~�Hf~�n��@�`�݆^-��N�h}�X��j��̄!<&����DC[�j9�@�2{}6�*!Ne���8bN��{' O�c2��t�� W$I���`@��������d<�,���<��J3��٧y1�ѓ,8������Nη ��ֈK�.��RPկ�.�Cq����^�L�ڣ����. 4VȠ�$�j�BX�?�3/��J��H��h���3i嚔�nLgU���eA�ṩ�_�/���&Vj��G�o����T̀Z=�I|�d~H.�aπt9��j�}�7��pmG����U��* j6>� (������2s*]u����Uwջ�Vŧ���*Ͱߊ|x���p&����JT�@4��P��Q _��}�ԑ���%!m�4B��&��_�OoҺ�$�J�XG y��X�.. 8�-L z/����Y�a��p. h�y�������ﷃ �\E ��K��ƿz�((�"g�pV;�����Hq��� c�.q$q�$� �ڡu�� ���q G �v� �H.���H�ϩ��f�@Ҽ����Xʙ�U4H�#�>�R��0�����"Ѯb����S�2f��<!L}�� 2J���H����m���g�������וz�HE������(����%����o�8��G_r��+ 4�6$^�R���Cr�9�B�m�vLU��͔��j������\Ȑ ���uaL"̆Vd i\�J?<�:��$��CTN�N)hi_�E��ᷴ����A%۩$%v��`{�~��Ly�\1E��iE��k��t@g+:dG��7c#��Ln�jƝ_��nҹ2Y��!R�d�>U�����H��ɚߜ���*!�c,}�K�?��ЀՋ~z���_�ٙI-�����A<\nHH噱<��һ1'���%�q�1:}v�g��ZJ����n�!�B��M!�U�����\�p�L�+�lT�'ϱ��^��������2}z��=�S�A�q�<VO�����M>���*)Y�/�8n"fB��� �pɹ���cd���}��n-�}��)�Oq���u�F��]Bi�L�׆�l�R)G.�/�,������5�y�M��3�z3��_?��kY.��`�I��R31�M��{d�_� 9�rfw���6cJ��(&�`fN��U����,ٹ����)7���4��g��Bz�u�\��/j_R��yMB,1"�����2R�TJ}ʳUU���j�q�S�id�D������� ����0���+ȴO��������u�b��� ��h<q�7�i�>� ������p���+j��� ���n���V l��%\�'��L�M}�F�H0�6g���J����¾� Sw��Fg0_�cE�I��ˉ!v?U�Қ$(�B��.�������؟=:?�ւ���1s�J�%�Q��J}�n���� 1e:ʁϡ}��E�+��݇\Y��g/�x�6!�2�'הX�"�ւ�F>}����:%�nd�%K����T/_�Bs�h���K.�a��}i�d� �V��z�� bJu%!gh�y�\c�+�!F�<>zV�A� ᒗ���*D��#áH��0?��f1'ޚ�3�$���6�h��M�癟����ګ�������K�CR�� w��Ŗ8I�3Dm��H>Eo g�� Ůי��6|F˖K1�� ŗ��Ay?sk2:�<B^ NǕ������5"�:%��.&�Ea��K�!a<C9 ���c�� ��=!S>U}����|������u��b���f_������=��?m��ގ��Y�{?�ߠ���;w�M5�!#�֚?��pc�j8 ���v���w���5�� �U)J��lz�f{Ȅ�]G�&�X��< �\@������l����R�ՙ�y��զ������u������aF�(�c Gӹ���gG��e��-���{F��q�O^��=� vV�c��!�� ��M����KGI��'z��v�+�0� �����i��*�����8�!�\���t�'��X�$� ���%��N�ecN�ڦq 0��`M]~��=S���\�ACm(\5�tc�÷����W�g`Z��by�>*�8�ò<����,ٱ.�|)�KN�iYZ6[r����*dG,+�L����$��v���8��U?�v�8[k��ڍG ��)B(~����r/�y�B1xUЅ<tLJ�B��+� h��6�M�$(|^�Tt9�o�
Static task
static1
Behavioral task
behavioral1
Sample
9f0e2a84c568958c1172dc03d3d3e7c742b3eb148d32f89c40169cff8a35579a.exe
Resource
win10v2004-20240730-en
Behavioral task
behavioral2
Sample
9f0e2a84c568958c1172dc03d3d3e7c742b3eb148d32f89c40169cff8a35579a.exe
Resource
win11-20240730-en
General
-
Target
9f0e2a84c568958c1172dc03d3d3e7c742b3eb148d32f89c40169cff8a35579a
-
Size
3.1MB
-
MD5
25a7e8e006f7572ff06bf3cb0e298e78
-
SHA1
f5307def999e5f435bdafb940469be641d23a5b0
-
SHA256
9f0e2a84c568958c1172dc03d3d3e7c742b3eb148d32f89c40169cff8a35579a
-
SHA512
82a6aa58749c5126918345f3d19ca86fbd5531a70de1031001780a5b212e9f0819efb810a57374e2ce119f9852b37316b904d2de94cea9587420bb3b0126d076
-
SSDEEP
49152:uEFiZuit1qCrYomNXFFAmtZGB5VwoJScIWmi16begetRfRjEc602sANx/zawwWA5:uEAZnnLwFbwwQ1EihtR76kM7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9f0e2a84c568958c1172dc03d3d3e7c742b3eb148d32f89c40169cff8a35579a
Files
-
9f0e2a84c568958c1172dc03d3d3e7c742b3eb148d32f89c40169cff8a35579a.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE