�z�h�/:wE#ct:����<t4K�Τ��4I���#��R,�Z�j9IW}�sA&M��#xZ�ۓ�;�LT!jnE��������Lq���0�'�㳎lw�B�� O���_D��)4(mK�W^��ѫ����D���"*�Qx�� r;�5�(����\߄�j5���u)(?�j���R=|�e�f�<��:��6��P�b��Xnm���gY��q��#��7%�z�8V߄�L�5 �܁�&��m�1и�Gk�~�+x6�=Q��]�/�-o?�h�?����CL;�k]�6˒���@��9�;���]����U���������OP�l��ӣ���-�g4Wܩ��=D��`abG2o�aaF��^=��o^�BTD8r������h��mID�����%_���u�ڐ�p��C7X4�L>��E��枸���L:���X� f�N�����ӎ�F���{��vR�:�7�٧81-�ј�D��}���{��#ymHw����ˢ]#���5�˭v�Qp=��a�Qù#>�ї����[zo;�;�2�ӱ�+C�Ņm�f�)V\�~Hebۦ�fƀ�1�`�mH���.ʍ���ɱ;�q=LR����%/$v+��2p۲�sq�����9�n��j�-� <�}�yq�O����j�4�`_����Ǭ��ӳt��'��@*aV g �Jw�b7v!H)�m�-\�0�e�]/So8�je�<CTW:U�q�p�A�JV#���G��X�5!���r��si�qcW�ȅ��2�Ջ5����k,�P��]<��A����Sا.�%�rSw��H&D��(ɉ��� X��n�R�S�U��c�ƣp0A�|�VK��I�7m!m/��n#�r~iӴ��i�rk\d��U<^˫������h��ܔL�%��u�v���S��֘Z��?`S��T}e�����|��7��A)��!Hhū��"��F����n��/jϹ�H� ��X��v��WiKǷ��m�8���ӻ�D�&D�z�@:u�%I�����g�Y H�����/�W��rE'�4O��&���D��e����y��?Sp����*�?c`��RPء�3I������/�r7 �j������u%����&���t����c�t<�C�.���W�m�"Z�����Y�]?�Z��L���|�?bk���Rڇ��3#�/ \ߥzg�]vN��~V��W�AaJ �{����:�@Q8`�q(�}>��;���kj�2� �9un���[�\D�B�f��a9{�?Щ�P��%98Q?pY�3�fI�s��pߞad��6�T�L �2?tMV�������d.�q��e᱄��`�/�(��qo�Q�aK�_��+@꫟�� #�M(�;|4�8�(�o�����u�B�H�i_�̩�K��}���H��ئQN�04�e��J�t���^��6��8�Ҥ��^6x�W�-�&"k�+wFٿ�<$_��}'9���x��z�!Lj����%��� 3Lƽ"�M�x�<{��+$�Z+<|���G�嬻VQx���r7�U^֫7�,O���4�G|�Ѧ[��"���}H�P���j9b�u[��4�ɖ��(&D!' ��.�����o��w!>���r�W{�o4� ��;�}(kQ�}�dxi��1�E �m)V�4�o���5�H�����?U��:Ͻt�����de,����fD��,�i�/�FW����(��!s��ީ��>t"��^�$���X~"O�' �ID���c��h��{a8tψ:< U���`�5)Q3n���Jd��L�T� �w��`�0���wL�$ �K�G[��>�-R�r�`�ȻtTפ���\߁���io�y�y�d��g�sm�-Ҧ�Y���ن�6�yi��f��w*\&ZSE �/ <K� �q>9��qjz�?�QC�+�V�Jx�v�������*>��B��֟\0\f�{PP�XSYV����}��p'�TO6�L]،?���"��v%��h�I���}�q�a|r][h�n;a�0o��{�~\߫��15�'A2JD�$T�E�1�ށ�։��W\ \���n�ځ�5�Ђ����i>���ס��8�lE%�'k��[+���U����'�[N�3c���� "�-,�;�T����Yo����"�"�2]0� Y����Z7��ⵘ�8c�Q(���y�|�����Weu�����&Z��t-�+�F��^�a��}��x*���vVlg�)4]�x�q�Q_�1��7*� �D��P�: ������J�n�>yܗ>k�J-�]�= �e�X�Ibt*r� (:h�1�'mYԙ`��7�]���t\m�'ʈ�fBI��;.r��3Ke�Ӫ«j0˧0Ȥ*t}�W��Xr��9��/�~��K���ٝ����}V���ܓ�l�=^|�f�� �?Oc X��)G�i}����Fy�F�G�pO��D";�#�Ddy�>D{�s�B}b:�9�C� ?r�x���I�sARZ8J��}��WO�8<`�k����8Nh/Q/���5y�aZ��H����R��z�A����Jt��[[���r�����=�̔����� 5�^�Y���s�:��f�W7����GZzl���i���Wk��#'�ub�6�ɚ� ������|�N��ô�t��8��u��L��:ý��3���^��B�<�Ws������Fᫍ�D�����LJ����=8I�+��/h����CKf��[�s������#)G���1)ү��b�'����:J��w�ឳ�$\p�C?#��R��8C\I�W�Q$�$��=V��=@��evLP�>M�e��禎����<�.�-w�⯉$NY�a��Z���⪲���F�F����3���Ҏ���fK܄��8}�?�����4��jBow����(�V;�I�km$����ȷx0�@��d�&����aI�Fz�%љ�:k�[j�N�6��ȯզʕK��WG�����fJb�ލ�Jf��?J9���R�(�0��H���!@���W��x��`mk�E��'v�[�h�J~��IH%\�KN2L&��$;�ۇ�ee/���l��I������H��ww�vtZ� ��jC���&q0������$���jl�b#�lkB���r솤�����yD�"[�\ ���2�HX���^)I(��x���Uw���>���%Wn�G.�kc��"�G&k�}.�i�j=�����f�=^�F����Y#� �G&�=�|��ϟn��#��n�9nD �:�&n���lZr�'���� h�f-�(E~����?Y+Ec���/e~9P�OD�/+s�'��#��p:��q��]!�/X:���������yq�:��fC`�st����l9���į�,M�H��R����&���V�`ʒ{M�������ն�iή�Y(��< ��`_w����ﲩkЭ��G*up4��BՋ�5�c��8�k�`n���n�.��t�w�4P$j�vYvª$R����(,e�H=G��>Q`-劈@�j���a�����Sr��R�E���@�&�K���w��y��6 Z��g�N�_Z%��-���x��@��kC�t��uH�R8p�AO.��`��8bCࣘ�m�YO��h"� 3ʐ gZ�����fD �P�(��+lq�����jVL�]E�D�h�H��qX���"��OM��;�BMv
Static task
static1
Behavioral task
behavioral1
Sample
9aa132ebf5d68bcaed749214cfaab792f0f059f64d1859b70ed01bf787198bac.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
9aa132ebf5d68bcaed749214cfaab792f0f059f64d1859b70ed01bf787198bac.exe
Resource
win11-20240802-en
General
-
Target
9aa132ebf5d68bcaed749214cfaab792f0f059f64d1859b70ed01bf787198bac
-
Size
3.1MB
-
MD5
a4df58fa0870f4e77567658031da32e9
-
SHA1
a319427d4aa7d4e1b66e0121c03850971481dc5c
-
SHA256
9aa132ebf5d68bcaed749214cfaab792f0f059f64d1859b70ed01bf787198bac
-
SHA512
0c5b16f5c7fbc13f3f55089c03520099ff557908aa6e9ae0d4d8c34055c994cc281c5b8a6cdb9fb5354f16d4a4f1c126ec6be138c58b9baff6c8c8b9aea883ae
-
SSDEEP
49152:Fmy76wI0UIpob+M2xXRCpCLhjStv/8CD8thsSbq/l7q/e6pJInZXdc0uT2JVUphs:j66pvYeut8CD1/0QnV5tI1+TWyA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9aa132ebf5d68bcaed749214cfaab792f0f059f64d1859b70ed01bf787198bac
Files
-
9aa132ebf5d68bcaed749214cfaab792f0f059f64d1859b70ed01bf787198bac.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE