����zo���)���HhMdF���T���y�k����#������S����~o� ɝ� /X����/a��ゖ�l��;� �aV�Ř+웇�RMBg��� ��cеr+ҬMi��|��Uδ��^���_\���C�:� ����3 yj���ˇ�H�i��7N\����$�U�.�����F\�m�����2S ]��:7���nBT�O�3aIRxŢ�9��6Q%^o�.�th ���A��b���N �H5��\m5B"��C�L��W ~S\ȡU9]�[DX^��iQּ 4q ���[���\WF�b-0�*������nu[�ģ_���������\���������4�K�� �MJ�e#�k�U�d���O�eY���V4�Yjh'd���E��x6�P�좟�V�i�r� �M�8L!z��`N�u� V�a��꧳g�մ� #��=�hP>͕;�E��o��-=��|ly�MVAӍ�Z�|�f���U�֫ߔY��9<�K��*ɑ�ߙ�#<�_���_��`<�%k�!}�=j�q�+,��>w~T^��U�;���U$"�|������$��mo����F>�T�s�m�q����ꠣs�}��+ 0�C@i*-�o-�e� ��«Z]X4Dw��¢7�#��<�����,�f��$�C����R"�Jp�ju���d�"K�?T�Ú���h�iR�X�k�zQ�$*�K,x�.Dp�ᭊ[��ZQb֊|%fЪF戅�Ú�;F3I��]��m�_��Y�h�ݒ�ֽT_7�=05fvs�մ���lv��&����:�mR�?g��}6��G�W���_ٚȯ���k�uެ%hخ*@� �[T�Z��Oz�G�ũ\��+z�R!�4dl�dTW�'h��(5��Y���~��L��Fu��D�-��:�7B��8p6i(= �&c���ǥ0Yb��#S3��C��5��gõ�ȿz�.H�����x��E����S�� �zwF/v A>�F��)+G5K6՛��l���)��E*�++¡�쩗=�p�ˣ3b��-䶞�\�E� �D��4����K� �&������@������Ԛ��uM�p�+�D&����|)��e�c��s F-.4T�{�S�#G��K�S�`ȝ�6O��=���a�-OHFXk܌ �>#�R���I�>��F�i��9��K!�h��m ��RI�QG�JQױs鳜����6�/`�$U��lX��8�Z�$�x��RE1�!=ꏎ�}�A3̈́@��C�e��@�7l0��f�)��9��̞&w��� �<�>/qyE��,�:y�C�T:N�U��b����[\�i>jitj��S�;��tË�ǪWIDs-���r���y��;X�^0�B��f��Z//�(���t��J��������課0��p�S�W�=K�������'a$�Fz�h��ŗ���������?C�4���5�!zt��Vl`@Nn⩘��^�o�� }m�m���� �#E4��g�<�Om���`�漟��_'c$�;P��b�9�\Vʼ�.a�ME��!�2�0k١^ �Rb���a�u?T�<������F�����w��VZ�ĝ�����V'��Rh��3X�P�ܤ�����t��RXH��"%O�I�b#�U���;CUUy��O n�%�*]����N�MFK���*��1�aNtKlxM2v=H���n�~?�3F��?��x!O�Z2�h1k��Vq6K5a�GJ���b��ܪ�FU��lA�\�j���X+7��*Ѹ�[YI��g��[? T@�l�� �_����Wh�$���_5�Yn��<RU��oQd�?�F�Ȓ���}U&g��o��IR��$��.�n����U�u/��rTܡNŪ;�wΝi��)D}�a�#��w��+D��^ء�?Y/>P#�9�]D����sI�'������3�Ra�JB��in��7��������c��cji(2�a�vt��ɲ�8kӦ�Ҳ������G��!�ޖ�#(R�U�4N�H#�g��&#��o_q�\�������\}|����oW6�A���e�t}B[F��E.G"z=߹�ڑ�y�g¿Mbc��Fa����\z���ˎnsF<)��T�� �� ��E<в����J5��Q�Dҝ��Uɔ����oC�g/��;� `xH�m�q���x 1�7�s�3���ߺHi&4\�a/EP'F���%Pv9���7[��:�{��;���'�)ŀ�uo4���+���2^�h��6�ݒ~�Jq;3V�*�T�H�-[C�o� 1�e�X��ퟲ��s��Tp�6'��2�SOF�N~F��x��2��1���yW� �,��{@[Щ�fo?H� 2���˂!1m{��b���Vz������P���L9m03���!��.��l�֬�<�ю�ݴ�Q����hK�����_v����j�8�P�q�$��8ʹ�.Q1� ���� ���D����Nyj�Ry7������dSEWҖr2-�x�[I�CA10��f4Ro)iV��z8��[h�F�Q�/wt�9���D[HX����j�q�$���Y�{���+��p���ڕ�]�<��n`��]����/lN�����1����k��� ��6.�F����3Hd�Sj���˫�x���Bir���U�RǗ�N��P�2¸�HN�-yn;��Ӱ_��HR���Gɨ@:�ǐ#�����*�)7f��=�9�Ms����:��Z��`~i�m�C�+p�@\*2���0���K�0���5e@�-����A���okaWl�i�'�jl?� 6|��@g���(��<E(�@��L�?��P��;VZ�S��+�AɁ��یϐ֦xI㦇�d^��P�� D�ƞdw�jA!2��S9�������vI`<�h,6�H�Ҹ*�H4)LS��]��xM�K;����7m��ܕC�`�\m��jս�dJ� ����1�ӑj��8����q�֨�#� �:�7@&Ίw��ȞPDځC�����2��>���u��.��� �iw��5 �l h:�L>[�$ҁ2w���ۤ�:Ei~�(�">Ƶwc�wi�GDz�0=���Z^�&��o�)B� (���<~T2�>3�T�1���䯀3����Az�*�����������w%������4��"�����Y�\��@��'�%��;6yK)[��SX� mO�� ���t�65A#�=�K�W=X�l�*p
Static task
static1
Behavioral task
behavioral1
Sample
d09093fcdca073e285c33c3b1173d4f52663f6eae9810972fb2c9d97afa9d94a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d09093fcdca073e285c33c3b1173d4f52663f6eae9810972fb2c9d97afa9d94a.exe
Resource
win10v2004-20240802-en
General
-
Target
d09093fcdca073e285c33c3b1173d4f52663f6eae9810972fb2c9d97afa9d94a
-
Size
5.2MB
-
MD5
7ce28c0feee461845d97f1174dead8ab
-
SHA1
5192802992ca7a2e5342ec334b8404a26fd2ac81
-
SHA256
d09093fcdca073e285c33c3b1173d4f52663f6eae9810972fb2c9d97afa9d94a
-
SHA512
d8336efa9a17ef056d38d485bcb9bdeb20e4b7e511313be7ce1d0b10fd285bf87207b1cac190c57def77f761b7ae8913b3f16a54acc53cbb72a95019c04ce3ec
-
SSDEEP
98304:/Xbr+5NZmumPHOElrz/RK/EOXONF3a+r3EyPEyPrCtBhc9WwASuY:/ra5Nobu+urCB9EsGP296Sb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d09093fcdca073e285c33c3b1173d4f52663f6eae9810972fb2c9d97afa9d94a
Files
-
d09093fcdca073e285c33c3b1173d4f52663f6eae9810972fb2c9d97afa9d94a.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 1.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 783KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 9KB - Virtual size: 336KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 59KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE