��[h(�P�`�ɟ�����r/�i���p( �+?�nqI�]2�@�4 �Oj��j@`�# 3Z�K*G����]�p0�R��J�k�����hb=���-�����B��7Ceb�o��Y\rj8�-bmţ^����+y�']���)#�dt�I.� �wd,M�QU�(�3�,�����X���^ �q��&��"fY0YZ�+5�&k�1�ų����w���+�A�����4!E�1�ꁭK"?�C��.D�=�� ,�l�� m�q�d��mgR*_�C 2IH�F�����誆�Ǽ8D�gЂ2��ZFU����p&\���x��0h�RW�o[Х����k���KT�]RfY��ѹ��p�c�vh����u�W���n��H��~���5�) �,�Ώ�C ��|��ӂ�a����T5����(��C~C�����c��Z^�Ƃp? ^E"W(Y�����;Wn� �G�>Zm@I�[�fP�$�6E�"��G����G��'�^ ̓)0��� �E7����"���"|�M�!�X�*�U��*#�%piK���E�t^�N��D��[:�N�)뵓y-=�Sy��h^����9��l�˗"~������((�|��<c/I����C^Զ0����Aog� ����mX�!b{��-�bO�q�������NANW�P��;p+鸱��1�]}j�U��@*�O��un�Xbj�9ȶ�8�^�m��<7a����tg��[�����:Sd;z�m�2ڃ���f�1SPO��y��8������o��$C��.(�%��˟�`��3�C����L�8���*�R�K�es��� ����k�&Q��j�M�F������n�#8H�6����V���ҡA�M ru6�%�%��\"����7L^ g�(2�z9�L�U�R`�������S:����tj�����gw���ڨ�O�I�=�� ��#��4C�gk������tL ©���٬�haL�"_Ak��06�E�B�zI�Q�]!!m!ȷ�\�u=�����0����DI��6�e 5F��s�J�yb������6h ��V� �O��CU:�^�UC~|�#V4J8�d�}a��z���|�ʔX� Sq��)o�)��?oÈ����8��λ�wKauj�J��А+> :�x�E�a4>sJ��5xc�ع�S�R[��˝4�ZC3����Q�\��S�s\�ܒ�=Q�?t�K�O���:嚸��?�\�D�9�l�����*!�`��C�(h|��u}$�R�JP|OSVᲪX0 >�z����k�fƏ� �CJ*���X3�U���est�p���F��-�����T�e�Y��� �@�a���z�z;�$�R�7��xnTXqi���,����Ϊ��u%�m��r�'=H}�?�@ד�� , �_� H�_e����C�Aٗ>��w�K��um��i�@�LS��OY=��L(�(|f�۹Mڀ8���1d�IZSӞK1�)�W�r�| �@ێ��ԱA�I?&u�0-�H���`5����2U����eJ�L]=Uғ�oh|�φ�R����b�ȕ���!��*s��?G��*���Lپ���s]�}KA1���&�|/��N��/n�X�����Y�̮2ᝂ�W85�(��]P.�p���7���������CP};�t�d���|�#�hgF4`X�ݙz=n5�$y���{O+�O�R��D�zح�Q�|��j�#7���kw�{�X�h�w)>")w�Sg� �`�z����Z������}�iyT�����;&h���a�#f��T��`���@�+����b��W��q':Ҧ����7��^UIm�3nܤ[�+�Ͼ�P���KM�y��}NJBg:�r��#�/}��1����:����O�JY�gmU���h���2>�H����&��&-9��A�a'�jZ��S���S�4&FJ�,�xㅞg�h����.Qr�g���bE���Q�!T ��N��N��8� ǃ����X%B��l��5!���u&�p�h�����ι���NY��� ��A������-<>�p? n����p�B���@�*�{��!~��h�KM�E�C]LIk#��܍~}��}?ED ]�2��NSѝ?�R�pi�\ ;�&�\n�{h����<�e�1����֦S�U���}��+���������҉���r��%zPG���3*���`��VL��晧-rN:���Zf�����_?lz��mo�� -*�S/��D���0,�*5t����9(����VH�8�d�Os��`QB��W�M��]�9��n�jFk��c���YW��ᴸ��b�k ���hD�_H��|�;��f�h!��Ю�1!G��B����v�����W]���Qd���kq;� O��t2����A��f��v]ۃ<�+�}«��(�'�@���J䋾��> �ٽmͩ�눥$��P�'��q�l�2Y�E��Gx@�y�!���{x&��} K&�b �Y�ە�t���v��њ�`/�878�h>DqT�K 3�9��u��v/!���J��i/�+�գ%���0�b6�:$����^��=7� \������.s���̅F�?�^������ ǹY���47��wf�E_��O�d�1�~�[�vp��>XN��5�3(�mj�iC�m%�>�Ԥ�4����f�mx��*mq1S����w���m�Rk ��8�u�?���\!�59��}s<I����ІB=bH�v^�C�ht&�L�F�g�W����r2sr�RO��l���w��#��eAz�M�?�\]]�F/��lwA8�� �-�҆��f�����}ຨ><�όo5*�jOd��E��؎��n�Ë��t���o�osY�V�lЬe�N�߭g��o������j��)����W�� ���+�#Hǝ��8�����s�!�(~����g�U���+ �W ��<ݲГ�*�4��]�sɓdsW1�o��_zS�֎�)zR@F,Cg��)yn!���G��J�o�(��>~�:���{(,��1Y�"E�/�O�W�R9ᢲ���|�7�.�p>\�^[^�t_�٥��x貰�H����|�:F��6�B�0�ײ�Y�0�)6�ߝd�x�/���e��L�h�1����3ް=S�B&��v���0q���K&Wə���ձ�,�I�F�?�MjO`X�#$,�{1�ܠ��|���x����:�@�&(D�@���xu�v���/�ͤY%gHU)� ��8S��gL��F�xz�a" �p�8�0��(��eը�|g��
Static task
static1
Behavioral task
behavioral1
Sample
6e9abc3d4414759e85bf7b08ae65d91df90a3455484ce06f40fb2932027ce48d.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6e9abc3d4414759e85bf7b08ae65d91df90a3455484ce06f40fb2932027ce48d.exe
Resource
win10v2004-20240802-en
General
-
Target
6e9abc3d4414759e85bf7b08ae65d91df90a3455484ce06f40fb2932027ce48d
-
Size
10.8MB
-
MD5
d461ba78160c4946d4cf09fea6e3f7be
-
SHA1
1b78e1c9bfa8e16c8179856d96b34cda2651e8fc
-
SHA256
6e9abc3d4414759e85bf7b08ae65d91df90a3455484ce06f40fb2932027ce48d
-
SHA512
7e714f8a953f3f220bf6dc8afe39ce782cae46baedb68e734cc719974f38a8755f6c3bb459130803bf7a27f6fed9093ca83f39f5f1c1f8c7d8c24b6531bdc0d0
-
SSDEEP
196608:24SX4QV/FLUSPJjfKDFjM913PVZ8/vhTypXf2PD1bWoFu1v5HNR9+Xe5t6BiSiR:24SX4QV/KSJKM9No/EkPD1bDFe3GT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6e9abc3d4414759e85bf7b08ae65d91df90a3455484ce06f40fb2932027ce48d
Files
-
6e9abc3d4414759e85bf7b08ae65d91df90a3455484ce06f40fb2932027ce48d.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 883KB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 137KB - Virtual size: 560KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 856KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 167KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 300KB - Virtual size: 38.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8.5MB - Virtual size: 8.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE