|c�����-�ʘ�~ODon�f��eL���G2WI+O�e��?�]R�'x2y��N5������5K6���i����H�����x�u6l�'2߭u��4���ڍ�?�7p����G�K��~ ��Pf{��7�$�<�1ʝuY��M���k��[�^&�>��A����Y�-����� z�R�g3TXk旑(��<CA�0����`y�:���Z�]�� E���6��Q��V�w�Һ�^N2z�o0�J���k F�>l�D�RÞ��|L��K�B��G�\U�Sf����V���H�1@��ݰ ���\_"澔�Wζz��og;��u�(>�$��;�����6jI�`��ƿV�/�G���^���sR�;=�)�q`���D��VB�Td��� ,FL��#�0&�5{Ip�ch\��y�K#�u5�R���_����I-���O� �=�$�%��C��������-��aD��D'���U����U)W ���q�y�ă�����YhN���@H���G�L|z��O/� VD������[{��� ����H��/k�jA��.ݾ)%E���(a���C<ד��̕n��E,��������e���0kؼ������eר��;���-�8 {M{,MS�:�A��*O�f!�C,g��^� %�FԊ�V������+/a���C"�y�\!��u�_s���ST�A�yod�S.nׯ���<8��%����{v��pe�e�:A���fǧ_��u�� �B�`2���9է���5����k��²~���ZjZHl�0��P�ՄnF�%y�}Dl3����}���0Z�.VY�#�#m<g����oN ��n���?ꍲ����V�#"3�/����-4��yu�翀��qR�iR��� !�_?��?�X���<���8�Mz�j6F�۴�4��*��Ok��2�&Z9�X<���#�O��d����婈q��$���^�ZD���j@<����4ȯ�]� ����~^Y��=6�E�}�\��6ޖ�>����S��.��@�-c:�~���g�bA���n<��C'��5i���mW��&���R�u���F����s��$B[!^Mb� 3uV<�$���Dxv;p�M��e�����P�15wu �z�,'�v����H�o��B2lڱ��� 섖:�dY���_]�>���!�)c��h��_���g�nHM'?U�HNL�+���>_�C"�����R@�@�0��B����2�گ1���������U �D��X�� .�Bg+� �����q9�nXM�Q�+�\����/c�?���r9�F iL�ǩ�S��9_%�% }8�X[w��4��8� 3���v������M��,W��ċj1��m��u��.�#Υlm����Lg���k֒-��;���6��C-q������k0�n������q��bU��Dd/�*d:����� ����ٔ6E�`����#�az����% �;���6���!���y�)L�v���{"dA!{T퓫�h�9�B�����l�4��ߋY�O�'v LH�h�����<�����q�������:8_�P����<{P{ ���Ў?xoE��xW�^��O���Q4�-�� A��`��ږ�!�D�c7��T$��/�Rŗ��WA�V����!�� ���Ƅ���?�z�p����ܴJ+�o���e�;V��z�u�p�,^�����g1���'{G���|IL�X�K� �}|�k�����@!2��,$�[����C�Tq�7>�md�J?!c��ſB6mc)��_ �6�[�M�G\���D�\<�{r�߶���Je�0��Ƞ��B� ���5��=����@9ZU�z�Y�����(Y��e��y9p�P �A{��߈��pL��h�SAd��*�]�3�D���{����n?XX$��s���~b=I�#��b�?�t/ZQ�tľ̐_h�c�l��̔^e���+xHB ��R� [�˨#�5� �q���.��~1����b��!��nt|�I�ib��Myv��5���Sv�r���8;��*ދm(���}�垶����T{���D�G���[��@$A"�$���f՝N������ԵTzۚ���k��v-+<Pu�Iw/$��(Ɖ�)@96�ؽ��*�ޥ5�q9͂{����ծ��{*�hWS_�U$ c��)��#��!xlu/�C()�C�3x2��}���ȻU?Z�z�����笅��φm��J+�{��:Ȧ�%�� M�m���%uF�s4!��<��oRxZ����r!^yq�T!J�M߆$:#�-����s�%�ۃS ml�\���zB�Z��)�WW������?EC��wJ�Z#��6�۶�cmFOkR�����0�.�mDtR����C�?O �:� I ����Le{w�L<�F&�>�;��p�I���@>�io(�����XP���Ig�|�r=�_�Kg��# ���RuqP�Q��t��Q����F�0`�5/˶��eۙ�AB��z����[-ȁ]k9���|���7]��0�b���I�W����v��'#���6�S��D�\ϴ�xx�Z'I�����-���g�Fi������x����^z�tv�vo�����+>MFӡ9r�?[}N�ò�9"c�e�%�7�+c�[ � �k��[�����z�����K����]�&B�dS��InQ�,���k���D�.G�U��)|0C�o�г�rY������ S�;-��`�����ԙ(mԝ��TK�d�goAb,u2�Ƹ�סo��K��r�,DI�2�;���UάV�Tg�5`lj��Gt�RN5#�����@�����c��9�o�R[p�٩�}�_srR2��U����1876�c�6G7t�� q�5�p��Ƞ1;G/�.��l�g#njӿ�8(J� �^Ai6���r����²�Jѹ��ŀ�����?U~jVE�}��-�������<��I{�� \�ڽ[��w)~�����MQ}S�=?Q�Q�uA��L��Ľ{�������Rq*}47�P���5p)����zKe��D��m���hY ;Q���nVy�4S�P�ܴ�G@��g����/*��s�ִ> ���Q7�k���^\ ~�~�Ur���B�j�zʇ���ۛw=���)�|��U<]�;���)�4|̮��4�5Q'*M�R���c�.]]�d7��e]R��R��qj�����z��nA�VJ� ��/6z-M>�}\�W3YB%���Ln�p�'��ۖ��k4��U���`<���t���E��kY�?c��)���!�!��4#P�]0h�L��bKf�6�/� �F��G�b��ۥڅ|*��bT��d)���Sf���@��K�'��}���ɴ��2�P ���o[<̾�iЎe%`���#ۼ�Jf�V?+L��� # �~
Static task
static1
Behavioral task
behavioral1
Sample
TT防闭麦_.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
TT防闭麦_.exe
Resource
win10v2004-20240802-en
General
-
Target
9fbeb3251a215967a37d7f79a0e680cd855463d38634aca486061c2f716072fc
-
Size
9.0MB
-
MD5
d4e353fc363b80950e6690b04deb84ea
-
SHA1
9bf98091a0f936486223f7778f1a4d7b53fb6270
-
SHA256
9fbeb3251a215967a37d7f79a0e680cd855463d38634aca486061c2f716072fc
-
SHA512
57e960f1eea0695a7d8c0a76df882d96340fa882711d9207ea5f590fe51824cefc63de14c2d8650033674283e63c17722156b9d5906395ced05ab2bf3fe0da41
-
SSDEEP
196608:tsPzZ1wpkuy4iVZCW4Cig4t4bDgtX9na2J1P922SWU0QS13swive4r6Wn2iaXGW:tsPzZS3niVZCWcLXD92ze73g9r6Wn2i0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/TT防闭麦_.exe
Files
-
9fbeb3251a215967a37d7f79a0e680cd855463d38634aca486061c2f716072fc.zip
-
TT防闭麦_.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
Size: 275KB - Virtual size: 616KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 27KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE