J�i�?�M��%�="Um�O����v�k�#fq�!w=�u��տ";�E�Tx(�[�z�V���@ ��w'�}�9��e�Z��U����T�5n��Jj���{�n��s'�!-���=}�{���z���5���z��,ɏ�;���{���zv���M�c^��a01��q\b��F_��%��P�]�<9������O���[����P��"� ����b�;�X�QM,�6e���:�����Ԛ�#%�9�\�Ao��n�l^8����n��Z��2�-*����,Q&P�oBߔ��.�Xi�����I�$�#�W`k�+�c�m5%S6�Y��Xo����V�W�oo����A���;�i��k��ʼn���cI��+�$�������)�<�R�����Aj5x�>hR��&u��a�O0�����f�q��m�.a���J��J�v�����"ȵ��ؓ��:/~�R��ԣ� �l@��cv\O��^�ï\�6BUv%�>�w��6�a1uA�?�������q��ًz�� �늟�J� %l��*A������P3���|�SM���`��ţ)`�C<D��6�fՅ^U� 6,�7����r��]���#��]�%�o��&��3|I�K0��w:��u(���:X.1~P[�Z��/��$^_�5�c�M7��d8�]�ys���_iҫ���ι�DKe&�Wo9�pD�&&2��������l�FYO(L�X^����\u�w$�>Ȓ�Lt��2�G9�͓�hJx� (c!cر��C��5*�G�����a#u�(�_�U���ӆ��t<�����5��� �����X�w�'2v����n7 3� �s��[��g�/�sO�'�������z���YJ����D c1m�:�� =G^�3��m��Aho����r�*�����_7�j��vy��/�vO�ͩ�����X>�n�>�j�!����ҍS�Jjwb�-�+����%n��.�������f�K���*���[-|L���x+ϗ��� P뫷�gwC�k�(NY�I�˼P�D'{"(2�`3�%q==�����\��z��ې���,+���D�z<�;��6gz���L���SnI����Kq?:�=�?mP�M���HeYv �*(}�ʊWq���.��L�O������߄n8s2TJ@�^��fi�0Os�Y��:�bĤu#�tIg[���%6RG���wt/���?<��a�>믇Q�%�?F��Z�����Z�[<���8�^��'5�%�>d�C-�VF��=ۭ-C��}f!����s[���*��Fg��Q R�2�_daʆ57u�Y.Aqh�"��R@��;L���� �n�#+� ���L8óD�%�nFi}6o�䷷����p) ��+���GE�[���kh��.%�z���v ��"����y�Cp9��}�?�����lX���/NV�܃���)�@mG�qYM��T�m������7�M�a��c �O���mm��{��(��\�cQ�}ٗV��3�@+������,J68Cۗ:�8|��r"��㭐 6#Y���Y��(g�ڢ�i��0���Q�V�v�%{�E LM������փh�i�c������am�� ���cy�^���0�����Zc�9%��!��j��pq胢5^Uz�����Lբ������'�:P�F�B��x� ��%�������6ݴ7��5��Y�T�������2��l0�9����f���"O�S!����ws���@�8��{�,��p7�/ =�=,�EV���{�i�B��� ��y����n�C䪅|��u�v���J6������M�tӣ4��?Nڈʔ2p��� �M��c� ��RD�|Qvo�M�F�ճ�5��{BE��\ٷ{-9]7/�Uqh[8^"<[y�C� 9Qv�#F�K����9����|{�Y'ӹ�]|)ߘ`��h�����LŨ���K�/8�Cu���z�7�*X�%c�C�q^ �f�7�uc����0��P��/� jo�%W����C\o�� Ȏ�=(o�3%�%�� �b� !?Y��k���b�Pl}�4����[P�I+�8Z��Ob���TE�p�5J��Q*����RC�2�'^i*��*�c/X�6t��,��Nθ�1�Hsq�b�l;]����X�dk�0J�i�ś� ��PSM�b��p,��ٽ`� ��B�Q�b=lde�[�G6#�����L߅'����BڴϤZ-��{��u�23Eg���O #=��!��T�_��=Ⱞ-�1 0�R �kN���;[�T����e����r��wetz�Af�w�5;�<]ۑm"5�2;nN�����.m!�糺|w+;>�D���˒"�]:�H���� �¬��;e��F27#;��G��&5��lC���s�!�H 1��kzbվuOw������c��4#z�ƛ�O�� ˕��A�qdK��#���{w�;��WJg�tw��kf]�il�vV�g�j��辚�K���Fǩʛ�ϝ���,,�S��䨪���"YRUcH�����ݻku3F5�C��^�:qtd�������� O��L)AFe�AX[d�r���Pmv���Z0���� ���sH�EX�9� �x^NT$�_T�챎*ش`�����ё������x -4d)��/<ZS�M�����l��^�XM���<:��w�������!���D�v���n���)[q��^�ڲ��^Xc$�HT���k�Z&�] »kN� ����u�>7���d@��b��=B�`W�1Po�����]�x���-/#���t��Fܮ���gU�F�K�'�]H�@I �=�c���}���(1=�df $U�<�*����>��`0g��R�^%{�,S@�P��#oc�� m����Û�||��֟���]��?�w^'�'9Q*�P�1���^�D�>���J�R��sX8��:��̊�C�F��R�$�*���̻r'�^'�d|�W%�����x���Kw�*��3��Z���S����p`����.���æ�A��\h.��O�]��x������^�[0����G����]Q�`�,߇�y*Ö���礎W$�IL�f�X�o��Q�j�5{���d�����"��(z;<��?��9� E>�t���t�WQ>�]�So�[6��u���Ƣ �M��!ҏ��&#o Q�%�����.��P�t�ؕ]���`��L'l$w /�m��u ����$�Om��e�9}���>�B�8��<�QN��dI�[/�����.��O
Static task
static1
Behavioral task
behavioral1
Sample
9b56433e9564d0a4424ecb5d6e55de5538282ccfd0df4489e23cf51e70c9e33b.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
9b56433e9564d0a4424ecb5d6e55de5538282ccfd0df4489e23cf51e70c9e33b.exe
Resource
win11-20240802-en
General
-
Target
9b56433e9564d0a4424ecb5d6e55de5538282ccfd0df4489e23cf51e70c9e33b
-
Size
3.1MB
-
MD5
fed298d4946bfb07c12903b95f31e7cd
-
SHA1
a40f1da98274824056b822ef7ad81038185c67f8
-
SHA256
9b56433e9564d0a4424ecb5d6e55de5538282ccfd0df4489e23cf51e70c9e33b
-
SHA512
4b2c3cb87d266cec8223d1be64b48acda6d737e4cfca6453080411596df99b3dc05bd2fd9011933c421d18070b193122cde92ad8ed15ed798b6b444e18eda4b0
-
SSDEEP
49152:47aLw8326icIJ4fyVYh78NjJmj+tnNkc/C4R+9ruDqVYFcVcfGyhGJVbg4/eS:42rGvKeYh78rmjENn/XR+9yxTB4Hg3S
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9b56433e9564d0a4424ecb5d6e55de5538282ccfd0df4489e23cf51e70c9e33b
Files
-
9b56433e9564d0a4424ecb5d6e55de5538282ccfd0df4489e23cf51e70c9e33b.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE