NX��0�:�_F6'Q���<�Y3z>8!��V2!'p�I��pɍ5~�+�^K�pY�pS �r�sh���bI�7?�a�?`,�E���۾�j����C�u)������ =��|:�/-0������r�y�Bw����q�O�'SF�~��y����Y��_��2[���F<�vp�yd��#~����ma�T �J)ح4��HWD����G���a�ҹ�&�%']�4����PGI�������-�_�%ӃR+6��ab��?���\zF/�C�G;Xmw#3����,��ԋ��祍���v�k� G[�� �Z ��� s�ݻ���������p�dPp��=,�g�*4��f=<8�1B1c 4�{p�q�Pb|dIO��� �I��O1�5��w{[�5e�_��>������ ����i���stP�Lzܛ��To���(ON`�Uo�,�EW�Љ^��! k��Sf2Z����I�{�{�ЅG� ����;�K�у(@����jË�@��-x�����q��N���f�1�^2��,TV�;�g��BjsJ��5w��-���b�!��d�C��|�������F: @eI�G��*���I�r hA��;���'a��&�H#^�� �*$6��@g\K�}����/0��\��Ea����t�^�.�{��5# [����e�����1�ُ~�j��.�/�Nz��賽�O��S�H΄���,MHD�C�G#������(���'��)�:Ѧ]�<��{ó ,~>�;�"��w�A f�f�]�~G����h/��eـ!/��םwD݄P�O-8�Q�au���KmK���S�r�Z�l���O��o�L%��U������$)���d��%U�!3�L��W�\ �^���#^�m9���R����<�f�x\ � b�|���%zIN�����CFۡ)5��Tp+��¡;la��[o��Lz ���slQW��EM�8��^j|����sb袳2��Z��M��^l��H������9ܠ�#���&���~�w�} �;�Ѥ�YWo<���_o���0xq��VY��6�� ��S'�h���W���dU���!٪@ �Y~#���d�aDf��h�����$a��[���B�&��PT�+K�� ����AU�V����oCnC�K�\�3��º~dﱫ ������"��ii�[���<��`C/��.蚉�3&L狗��{�%��Ѯ��y;�� ) I����d�\�����ѝ��ړ��� ���Z��݆��hR6�߇ƻ���4�����Ϯf`��rG0����VB�8%8c����V��B�� ���|� �Q2 ?�xa�bL��h��+P�ڤ�r��L�DJ�@8����H����+�l���S4�9Lq*�0h\]�0��R���"�P/�(��@��@ۜs��L�8�7���5#�t��扨`����j'N�*�{��m��VvW��R{��~�����|Rj.��V�����=0<B,�T���Lף�FR�J��vo�`�;`SF>/����U���6�v�AAR3yXe/�^^����-Qn�!�/����|j��=��1#�x���]<�y��Z�[�ɍîib��r��69C�Jr�H��ӂ9ls�����S+��F��k�6�Y��b��@�J._')'��� oq19b���5c��rY�* ��}f��p�ѳ<���bL�����x8�̶�vk�='�d��S�a�J��8�P��2��'����i��ئlh������%(�� ��� ��#+Oma<�(C>݀��M�h�\߇$B��;{�f��i��� gE���\����1G�*�K�5�d��If�=uA��[h �[��ł����zu����qr�_זcMW�3_��q?�4ʅ� �mr��B��$�_���R��W��%�J��L� I�o���w6�� ��?����a����p�y�^s=�?G������T^����3���-��0&n���J�~2�# �������7hA�X�5�%g���}��� ]v��,d���u#�5���2'�t�=���k�I�ةú�; ��ɮ�7���c�Xm<-�� n�;^'�e���?���O��0�+n76s��$5�����LJ��w��Yz`��a�f7��Q��`�M���!�RL���4�l�lt#L�� �H!���w�kA�M��Zd���u��+��"�[UH����J ��'Q.Mzi��wP��L:�H^4�1���b^f�6�]�˺�(rO���a 4t��۶M�����xT�� ��)���G/c�/���с� �Q8��9��Q��[";h*�$��%s���'�G?l��P�8���V�.�T��քx3��o���E�0�RN?���x'� ��ߤ���]�#���z�\�qL�M��9u�"���l�G���G�o-�]�(�$<��}�&�Kl�$�����>��]T�W��ٶA44��_<����U��|7犕Oel���PC��E�N��X��"�[� c"")_��R 9��Jd�zi��4 {_�f�%@�[��6��e�=(4x��A�߭x�t ���{`�o�zۻ�Fb����tD-��-����u�l<7x�t��X����xť�0E\ɮ�H�&�}c�wzJ� ��Y�i��.�t+��֨W��S�`+�9K H�ɟ����{~��#�!�?-���t4D�p�� ��GYM�b��:��8�yz������m-�'��Y��h�Oܡ�L��d�f$QȠ���K�ט�|܃KA��0%�dg(AΡ��B����)�]V����˻Vw̼2�ɸ�I#H@�e�߬էY����o�;�z];h.��&�fCPq�C<Ow7rLf��R'WR��G0����o��E�v�-��Q"O�O9Hŵ���v�`��kR�׳Bm����\���I^*��G`b���e8Uv0���?'N����b�����݆l]�ʼn���D h��9� K��@W���uO��2E�^�E!���]�9���-<�{��ׯ'8�a����y�o~�\�(�Iә����-84L`�qS��C&:Ձ-
Static task
static1
Behavioral task
behavioral1
Sample
09d99f2270bebd6d2b4064a2e43324877e999635bd84d2ab27917c5a72f8ac38N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
09d99f2270bebd6d2b4064a2e43324877e999635bd84d2ab27917c5a72f8ac38N.exe
Resource
win10v2004-20240802-en
General
-
Target
09d99f2270bebd6d2b4064a2e43324877e999635bd84d2ab27917c5a72f8ac38N
-
Size
2.4MB
-
MD5
5756eb1d4cadd77e4bcc0740e25a9de0
-
SHA1
24786da316d41a7324043a2db071d6b4e5856cc1
-
SHA256
09d99f2270bebd6d2b4064a2e43324877e999635bd84d2ab27917c5a72f8ac38
-
SHA512
f6963352278b9571eb2f16fe2de6a33afa144ee739dc233854ebf67dba17194ad192fb1dc5cb7a084145687ec4555a7ed5bba0f369a2d9ae23ea14ea0deebde4
-
SSDEEP
49152:UfcGZiP3HwUOPZJy0VwK2aLlR/ZeTL0I40jTS9tOLwjjNFQL2BEGGm9K6LNF2d1g:UfmP3Hd+ZA7aGL0I5jGbOLwjHu2L9K6b
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09d99f2270bebd6d2b4064a2e43324877e999635bd84d2ab27917c5a72f8ac38N
Files
-
09d99f2270bebd6d2b4064a2e43324877e999635bd84d2ab27917c5a72f8ac38N.exe windows:4 windows x86 arch:x86
2f80af3680695c95cb43948654e18a35
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstNe
kernel32
HeapCreate
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE