�g�I]�Q�j�H�n�#�s�uh�ֆ��1�L<qE���Lz��m��9���z o�[���?�Sq���� �zJRp�}![N�@hv +��*gQ����� ( �bv��m���ĸ )���@P��/�Fz}�U5v�?�ء�-}r���OGXj���d��±W4�99�o0����3 -���bҷ$`?����ȃ�5��wF�?�������^WV3:�Gn�V2�u���_J�n�Oa�9�wϹh����6���G��4YBC�;���#��.��1�s颌M���MDy ڜ������P���r���9����w-��S����s(R �ǜ�j�=rZo�Ҡ��p��v�H9!�P�u<*C<��Z����u���f ���o� �ez�N��}�J�l\ʑ�Ho�ݚ�K�f��q���\`]=[��x�z A��@8o��_�f�.HƐ~���T17��b��Yˡ�N��D��nPg����n��vD��cS�Sw�i�x�S�^��PM9E�k��*V���' �zN��-��s �e��b����d\�mʋ��z�Z���ϯ*�Y�>�Tw�Jo��� ��E���aD�g�.�u�mQ�A� 4�]{�#a�����ϼj ���(���T�N����?R������Ҕۨ�A8'B�{.���~�{_�TT4vǸ�,f-����LR�w��_ ���I�6R`/M�����yb�8��ᗐ���b���S1�%�tHC�I�$�����H�ͭ�@�1�2�*�sl���o�Ų2��S��ֈo����a��ܬ�^y�ls�&�:2����`����E�C��[�������?�vM;\v�%��N���_�`����i���]�����{$ ��u�}Q��7"d���,����u���$�� �s��9Rc#�Q�ro����4�i2g�w�q��t�NjZ۟A�4�A�3��7�45Qꝲߙ\����~q V'�>wk�-����I �>%��qJ�E��\�m�0��;Cƴ�kf2��T�t�+ '��9���ayRjnM���<�/�*�ZON �.ܒT, �1�}��ձI�!S.�(�6���ܴ���y*��-���-,`4�G;N��1r~{�� ߫�7ypB�$�;�g�;LH�$��B%�%�T+e�xN+��+�'#��h�'�Y1��X�|�/���Sz�`C[��W��ZNm� �戋ɋ���:h/�����m x5����CxgI�I����#����jӡ8��*�{#֖�$q����=�KuV��o��f qt`ی {���3�k.�3rNQ�&b�g:����V��f>!�yq9�C��*!Q�_[QY8��k�vs�9�a���\���{��� ��O���~�����-�K܋K��&���\D�����'��Di�Z�{e��}dܮ�-�+�\~��`S~ 붼+Sw��YDk�R���zw��<q�IE�^&L{��HdbB�wm��J=f1<Xt$�$�1}<�N��i���f7��Տ��lM����� b�J������DC����@n}�mXg��;Mb�c����3'fS �ojSO�a�2��ZS`Cņ�Q F��]��|�䏶N[&"��_X�1�4�:�Au�H�_��e�c���9,���@?��w��E�K�A�e��r��i7J��� R�����(�;]�]���cX�v���[-�ӱ��3��PB$ �%~�����V�$ƅ&?s��Fx!�r�K��<+nxݢާ۷R8�_���`�צKN.x���,���"T�7�T+��>�6umC�):����<\��� }:��K|H�E�&1��D�sot�0V�}�LOy'H�кⰣ�� ������,cGSz�D�,��EF�k���%%1t����̽E{��FIr%|<�W�U�e����P'����x��4�^�����5��8�ܴp�|�B\������Wz��$M|`R�9�OA���e������I*D ��z+g�!��Ę�j���^�杞ڮH��$F�Fj/��Jh`��J�����s'�TM!��gX|� D��N�n(����@�✉��.�Xa{῾�s�hI��a��f���O���@9�{�yI��(L;�"�r�YZ��~��!#�|zu ��!ܮ��^s��~Y(.vv<����g�Ԇ'�Ƥ ��4�<�d{��՛1cO�?˵�k�$�P.��M��.�ގ³JZՐ0T;�y�Je;^vc�ll�r�x�ψkC�$5���UH$2ɨ"��ט-��k�:����ٞu��c[!7��7Qk��_p^C���܃?��07��ȮqI�Wd8�L���Hy0�8�eX �SpbR0�Ȗx�G<3�|�m4����c_���,Ș���ҿ(>����䜄����� I%u9��ƌ��j~b���6�G�τ�}�nvG���&w�dm)Av6>U���� ��?�p�0_v�<&u�ԋ��rD~U��(XO�P� f���|�3e忴)��t�z�s���km /� ��v-'�������Vdd�����`t?�Q�x���P��l��1���.c�����x�EH�� 1� �1jyi���F���m�O�l��G�{W�Z��~���ȿ��_��1rfNu�ic��0O�� ,�p�o�%Eg�=U q� ��}5� �0d��`��z0�s,${����vie�1)���ʐN:���.��ܭ�Į@Hy���Կ� �ͫ �-���`{{��� [��zW��H�����q6ďf1�4�ͺ��[W�zd�Oz'c�@���8�1d�z��e��Mt+�!Пh�9Sf���&���Cƕ4/�t� ��m^:�N�8�;�VZh;��^h��9Ӑ�]p�X{�:�?v� [���|�g����! �̭���NM���6��˃�wΛ@/�18���}Ѡ��Z�kOu�ˤ4r���"ۄ���_ʬ:�R��/V���O�][(��}$���%V9�,�jA���p�����N�Y�۱�]������\ac ��RC��\�ʒ�ld�NJ �^R����K�����v �g��ӴD!7ޏ�>�� ��@�s���b�x}2]�;�D^D2^Ƙ�r�U�mQ���^��IճJ��Dn[Sd{cx{W8(����m��� j4���o�~q{���K�}*8�����Lu��sI;�Fq�� 1�4�ȃ��T_��dz�|Y����X1ނ���'���tOt���KS�e��V�� ����x���>�s�&�6�9��%��b��ƀy����8�:�4��M�/��'����c&Yk� vnM71:rf?�EA��/:{�G��=�~� H���,.��:t#��Sg�?�\��"��>��u��%���Z�M�}c_A*���'7��ȥla�����LN4IY��z���?�R�П��VH@�iXS=NЪ��j�Ѩ�iQԋ��T4Si9�c����N_��A���6���jĤ�]�/��[�Q^���g|~/7�B�EI�E�6 ��-�'��%hӒ�}�Rn��1P��/rl�H��ˬM�=yP5ڕig�iHN�����UkD�]�e��t�<�|}c,���i�&j��|2X��d�&�ą⣩�
Static task
static1
Behavioral task
behavioral1
Sample
9f57f4447d0988e9064d528d8d7240e75cbd7697f77f9202e6a47406b351ead9.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9f57f4447d0988e9064d528d8d7240e75cbd7697f77f9202e6a47406b351ead9.exe
Resource
win10v2004-20240802-en
General
-
Target
9f57f4447d0988e9064d528d8d7240e75cbd7697f77f9202e6a47406b351ead9
-
Size
2.4MB
-
MD5
2db40594b4fc4bdb956068e3ea1264f5
-
SHA1
b5d7e54e74a2683dcc4f2140b381b66e0b06b656
-
SHA256
9f57f4447d0988e9064d528d8d7240e75cbd7697f77f9202e6a47406b351ead9
-
SHA512
79ae09e6874b8bbb1dd1c6f4aab863968d7340b1f0be37570312c94aa8e39d32bf0c4979dce5470437e04eadd290cffdcc8115cbb4a6f1cd0ac8d616523f89d3
-
SSDEEP
49152:7NIo6TG5anjngaYPLIvNrkrrfUA7Y69BWb/rMoCPeqFEsL:7NIo6TAojgTIviro0WzgrPequsL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9f57f4447d0988e9064d528d8d7240e75cbd7697f77f9202e6a47406b351ead9
Files
-
9f57f4447d0988e9064d528d8d7240e75cbd7697f77f9202e6a47406b351ead9.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 12KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 204KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE