���Z /ʔ���t6?d��GC��|���ؒB-Z��A@�юc�^0:0\�}�L5�1��ˠ���AQ�"%�qrO��To�g.�Ƭ����Ӡ������ +"��y��:W������.P{���/��Vf��'�G{�Z��2r�]��Aɇ��B�Fʏk�U�1���*j�I"H�I��f��Q���x�����*NK�RӸ����E;ŷ��P;�7���&JT���Ն���||h<K���j�ZK��՛w�����2b_�H.2�-�,��y�)/(X��\Ub�8��5R=58P���;I�l\���9�z���b��"SYH7��Ռ� SYA[���QWMt�:��Xϝ��С;kp����Od+�-�e/�$���7�N�a,��_�\��F-�B<%� L��{���ߐp{�F��\'#v�ԯ"o 9+L`mP�6Ug��89/�翛�����G.�l�Ӥ�=ݘ70��c9����2���R3�.Ë`���]Oo{�hZ�R�����\%�o����ޡd�+m���SU#�p��6}�����V�D���t{ 2T_�����^������t�{%�b����}dˉ�J�ȁ�Z㇠A������ϵW��84�O9�Ie���K^����K������M� ?�u����GOd �L��7铰\<��:Qj��EelJ-�5Ņ��K��C� f�р�3GN��7�1�YF�p&�c`�{ݼ�;����o�����7A呣Ӊ$��Z�}0 ^7��+�n�И=�ȳ3��R���5���?w�������q��D>e���un?&�U�o��2����>�Y�K�"fxsk�дc;��a[�F��ײ,��5B�_�#��3�~�<Z���� K���ksx��:�3�P�����HKE��H�ppѝF�&�-S2:8�@�k)kl��5�(q��HC�a��@�Ia�:�����z�dTE'�0[5�6��^��`j�"u�az���?���2��h��yb��0�ֺĒ�㍜e|*�˘�C���.]�����~�*q ����P`<��X� ��w��?̪S��=�vϞX9Ƈ�ih{��``z�������76�W��r�3�{[t�V̮ۅh�F�����I��՝;>��c����'��#�%��H���� .��x,��������6a��,�K��!5�����l>�%6/}z��=E��y�U����a뵅�8�X�f[z�|�Bk8q.گ�L�m�x���|`ʥ�=���+p+�tQ3"-0��/���������S�]FϮr��F�d\�d��y�S1~бt@�F�h�8'�s,�D�>������l8hܑ<�3��SR�৷~�ͼ��_�Ɏ|H���>���b[����#n9Ѱ�p��_� ۖ�ty�ʊ�������u����gg�¼U�BX6�;oⴛx���v�^,ׁ����8`hv��_��7h_*<u��H( �� �����"�|$���{�+�DD�M�\����1Uy���k>��z�7/�Ն�Ʌ�Y��]ʳdCQ�/A�-��rB�+�纑w.c�rWL�ऊ��lG��(�.T�[�j\�o?�����`���m)ͅ���ٶI����������u7 T��L�'����Je�~�������x L�Bw4ͻ��e?V��#��̭.�@��U�4j�k������J }����(�fTlǘ���p��S�ӣ�5��T- w���ɹ�0$� �[a+�����بa#��Q��u�8~��Ͻ�����{���E�&�̎�&ª�i�+-3ۤ�9(�)s��!)��-o3X���B��!K� �����i�on���Ώj���"!*��)Ny�����=�W5$l,�m�����D�z��˝^�ӪF`|�o�K�U��c�랝�mY=���.���q���Pޯ�k8haN�����$�����`m�>zD�P������0�oUԱ��?��JY}Y�%y� ��f��نn�uk�NHkeI�����W+ ��\�]��q<�2(5�V}q(g��FKa��U[��̿�`��\�� (��U��ɳ@gT�%�f�:����B�\;u^ҼX̘5x��.�8r�U�uŭ:��gR�w{ ]`�N��7�D�Se���Z5�oj������cn�Z�>O��ؖ�(G>hxQǔ��L�����1Z����ωھ�k�T���0�~= "V�'�C����1.N�Ua��/�ؑ��Fԁ�X[�@*2�jS�c�ٿw��V��^�bԴ%�e|ۨĎXd� ϯ2�V�p3|Xܡ� %�f'������V�F�7�B��Ϳ�"�/F�`�r/�z������F�h(�YFۀ��ܡʄ����^��WOs_�P�Eݔ��]_��!�wEw#��߅��E Hu���-�������p��eι ='����g*�WT�� �����jBy�4�-��»�R�z�������8��Pr�F��m����d��Bj{���z��u�d�E%罕�s����ų�� :DJZ'���=M3��~k(�^�@@|O�V�lE�?�,[��TP�-ђ�ټ�`�$��6�h(cj-�dx�����=@ˉ���*C�:�$� s[S��T!ܸ5�ڢyKE��T�,�s�=X���-�t$I���^Mᶪ�O���G��O����/˿�g�#��<i lg��� �D��i����c�1��헫k���f hᄨ�B�%w��E� ��'��Hs�UM�D��lD��Q��^~!���z~����S�rc�x]6c������kⲬ)�����)^�F��xgDG#����Sg`�`ev�2L��d*��hK�� ���f� ���%�T7���S����}e�tٜ�l�iR�������+މ"�$OP 26�2�Dc:��rh^i1|��džh��s�.�[Vo�;���M�!�E�Q�w?{�"�|g۠�slm�If�}�u��5Y�������D�MN����"�*;�b�y--���x���E]=d�_=ЁY�����]�s7,r�+dZ���E;9�Ӌm�[n�Z�h���>���Q�@n�%��n�8�Ue���Q�X���7R#���d�Q��`����@�#2+#NWp=�T����6<z �2�����m`�'���;KF�3�欨�j�(���>/�>vNB�3�z�����6��U��/�i�'����%h� ����q=�%���u �&����ND�:g<��zISY7�E0"���-�L�F�����X��.~<��mwBqr����&�w,D�!(�[�������Y`=���p�W�{�f�K��A���1>��|���Y-U?�Gz��\;���M�b�5Mx��A�?�3a��\�ہ-"'4Q�M#*�\��e�Wrw��>����5�I/Y �/Q�4<�Y���}:�#EӸl�WD���sVV�T������t ����/v�PXPcY��&�8���R'�tk������Tl�M�`WF_8��f��#U���j$а@CU��pm�,�P�f������:�[���Oы{C8����:��6z��c�/���
Static task
static1
Behavioral task
behavioral1
Sample
9c5870f5a18669646aba9ed5f990c5972ec1aceec8b2781ce21b5e6d02d273f0.exe
Resource
win7-20240705-en
General
-
Target
9c5870f5a18669646aba9ed5f990c5972ec1aceec8b2781ce21b5e6d02d273f0
-
Size
2.4MB
-
MD5
0d950575d6dc1bf67bccfb947dba1953
-
SHA1
355a2c74154480712491ec91b861479a9e205376
-
SHA256
9c5870f5a18669646aba9ed5f990c5972ec1aceec8b2781ce21b5e6d02d273f0
-
SHA512
33f9e0baa67fe3aaf0d6e528053e852bc2d3eaaf5b605497a4831a76dc4fbea658a047360fef3bdb350f1b31799ab48c25d6ea4ca4454e5d5be5c700a87859a2
-
SSDEEP
49152:bU5saHXuT5adam1vH6Sh41h5UKKJcHZ84S2NJYotf+xhBlk7fwKZ:bUOa3W5aUmxaSh4h5ZKWH7fHDSBmcK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9c5870f5a18669646aba9ed5f990c5972ec1aceec8b2781ce21b5e6d02d273f0
Files
-
9c5870f5a18669646aba9ed5f990c5972ec1aceec8b2781ce21b5e6d02d273f0.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 131KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE